Round 4 Media

Audience privacy and requests

Updated October 16, 2026. This notice describes the R4M Audience website activity service and its browser controls. The website you visited determines the purpose of its own activity records; Round 4 Media operates Audience. Separate product, account, app, payment and contact-form services may have their own notices and records. This notice page has no Audience or legacy tracking script.

What Audience records

On enabled website routes, Audience uses a random browser identifier to recognize returning visits within that site. Its server stores a site-specific keyed hash, allowed page paths, event type (page view, service view or contact-link click), a configured service category when supplied, and timestamps. A browser profile may show a service interest and first and latest activity. These observations identify a browser, not a person, purchase or verified intention to buy.

On enabled Round 4 Media website routes with the attribution update, events may also include a recognized source and channel, a registered R4M campaign label, and the type of contact action selected: phone, email, booking, contact page or contact section. The browser checks a small allowed list of campaign parameters and known search or social referrers after analytics is authorized. It sends only the recognized labels. Unrecognized external referrers are grouped as referrals; their actual domain and path are not retained. A contact selection does not show that a message was sent, a call connected or an appointment was booked.

The SDK does not send or retain raw page query strings, arbitrary campaign values, advertising click identifiers, referrer URLs, form contents, full destination URLs or browsing across unrelated sites. It does not fingerprint devices or look up names or emails. App routes and explicitly disabled pages are excluded by the SDK. Privacy choices and authorization receipts are kept in browser storage so choices and requests can persist. Clearing that storage can remove the ability to identify your prior records automatically.

The attribution update keeps only recognized source, channel and campaign labels in session storage for up to 30 minutes, so navigation within a site can retain the same source. This entry has no browser identifier and is cleared when analytics is withdrawn or authorized Audience data is deleted. No available referrer is reported as direct or unavailable; internal navigation without a saved source stays unknown. Reports compare first and latest recorded touches within retained events, rather than claiming lifetime history. Staff and testers can explicitly mark their own browser for exclusion from business activity reports. That local reporting setting is separate from privacy choices, lasts until changed or cleared, and does not identify a person or guess their role.

On an enabled R4M scheduling link, recognized source, channel and campaign labels may accompany the link to Cal.com while analytics is active. The link does not add an Audience browser identifier or personal details. Those labels alone do not establish that an appointment was completed or joined to an Audience record.

Where a site separately enables Audience inquiry forms, a voluntary inquiry can include your name, email, consumer or business selection, company, chosen service, postal code, timeframe and contact or marketing choices. An inquiry is linked to browsing only with a valid browser receipt. A separate secret inquiry token authorizes access to its identified fields.

Cloudflare hosts this service and database. Requests necessarily reach its network. Audience uses a keyed, time-limited IP-derived value for request limits and country metadata to select the collection setting. The reviewed Audience database does not store raw visitor IP addresses. Hosting security and delivery processing is separate from browser analytics.

Purposes and choices

Audience helps a site understand its own visits and service interest and respond to voluntary inquiries. It does not currently sell profiles, send advertising audiences to other companies, or combine identities across site tenants. A service-contact request is separate from analytics and marketing permission.

For supported US visits, enabled sites use first-party analytics unless you turn it off. Non-US and unknown locations require an affirmative choice in the current implementation. This setting is not a claim that every possible tracking use is permitted by law. Prior refusals are preserved.

Use Privacy choices on the website you visited to turn off analytics, record a sale or sharing opt-out, download your authorized Audience copy, or delete authorized Audience data. Global Privacy Control records a sale or sharing opt-out; it does not itself turn off first-party analytics or delete records. You can make those separate choices in the controls. A download or deletion is limited to the site tenant and authorization held by that browser.

Retention and deletion scope

Current Audience raw events are retained for 90 days, including any source, channel, campaign, contact-action and staff or tester reporting labels recorded with them. These fields are included in authorized browser event downloads and removed with the event on deletion. New browser profiles are removed after 365 days without activity. Earlier records remain subject to the previously disclosed 90-day limit; Audience inquiries retain their current 90-day rule. These are operational retention rules, not a claim that every historical system has already been remediated.

A successful browser deletion removes authorized Audience profiles, linked Audience inquiries, events and receipts for that site. Minimal keyed hashes for suppression and privacy choices remain so the system can honor refusals and avoid recreating deleted records. The service also retains limited operational audit evidence for up to 365 days. Suppression and choice records currently have no automatic expiry; their continued need requires operational review.

Legacy and separate records require assisted review. Historical Site Intent tracking used a different system and could store additional URL, referrer, campaign, IP and submitted contact information. A September 2026 audit found older records beyond their stated retention period. Remediation is being handled separately; an Audience deletion does not establish that those records, separate forms or product records were deleted. Unsigned old browser IDs are not accepted as proof of identity for access or deletion.

Request access, correction, deletion or an appeal

Email info@round4media.com for access, correction, deletion, an appeal, or help with an authorized-agent request. Include the website or product, the type of request, and enough context to locate the relevant interaction, such as an approximate date. For a correction, describe which information you believe is inaccurate. For an appeal, identify the earlier response and the reason for your appeal.

Please do not send passwords, payment details, identity documents, authorization tokens or sensitive files. We may ask for information needed to verify your connection to the records. An authorized agent should identify that role; we may need proof of authority and appropriate verification of the person represented. Supplying an email address or browser ID alone does not grant access to records.

This is an assisted email process. Opening the email link does not submit a request, create a case or complete verification. Send the email from your mail application. Our review process identifies the responsible site and systems, acknowledges the request with a reference and applicable response date, and explains the outcome, any scope limits, and how to appeal. A missing browser receipt or an expired token does not prevent you from using this route. No automated correction or blanket deletion across products is offered here.

Browser exports omit identified inquiry fields unless the separate inquiry token is available. Large or incomplete exports, other browsers, historical activity and separate product records need assisted review. Rights and response periods depend on the applicable law and circumstances; this notice does not limit those rights.

For a concern about a response, email the same address with “Privacy appeal” in the subject. You may also contact the privacy regulator or attorney general responsible for your jurisdiction.