Privacy Policy

3.1 Account information

When you register for a Zivlo account, we collect:

• Your full name
• Email address
• Account password (encrypted using industry-standard hashing - we cannot read it)
• Any other information you voluntarily provide

3.2 Payment information

All payments are processed by Stripe, our payment processor. We do not collect, store or have access to your full payment card details. Stripe provides us with:

• The last four digits of your payment card
• Card expiry date
• Billing address (if provided to Stripe)
• Payment confirmation and transaction history

Stripe processes your payment data under its own privacy policy. We recommend you review Stripe's privacy policy at stripe.com/privacy.

3.3 Usage data

We automatically collect information about how you interact with the Service:

• Log data: IP address, browser type and version, pages visited, time and date of visits, time spent on pages
• Device data: device type, operating system, unique device identifiers
• Feature usage: which features you use, search queries (business type and location terms), generated pitches
• Error reports: technical errors or crashes

3.4 Communications

When you contact us (for example, for support or account queries), we collect:

• Your email address and any information you include in your message
• Support ticket history

3.5 Cookies

We use only strictly necessary cookies that are essential for the Service to function, including:

• Session cookies to keep you signed in to your account
• Security cookies to protect your account

We do not use analytics cookies, tracking cookies or any cookies for marketing purposes. Because we only use strictly necessary cookies, no cookie consent banner is required. You can control or delete cookies through your browser settings, but doing so may prevent the Service from functioning correctly.

4.1 Contract (Article 6(1)(b))

Processing necessary to perform our contract with you: providing the Service, managing your account, processing payments, and sending service-related communications.

4.2 Legitimate interests (Article 6(1)(f))

Processing necessary for our legitimate business interests, provided your rights do not override these interests: fraud prevention, network security, service improvement, and analytics. We do not use your data for direct marketing.

4.3 Legal obligation (Article 6(1)(c))

Processing necessary to comply with the law: tax and accounting requirements (we retain billing records for 6 years as required by HMRC), and responding to legal requests from authorities.

6.1 Stripe

Stripe processes all payment transactions. We never see your full card number. Stripe is certified to PCI DSS Level 1. Stripe may process data in the United States and European Union.

6.2 Resend

Resend delivers transactional emails on our behalf (account-related emails only - we do not send marketing emails). Resend may process data in the United States.

6.3 Supabase

Supabase provides our database infrastructure and authentication services. Your account data and usage data are stored on Supabase servers. Supabase may process data outside the UK/EEA.

6.4 Hostinger

Hostinger provides application hosting infrastructure for the Service. All data transmitted through the Service passes through Hostinger's servers.

6.5 Companies House and Google Maps

The Service queries public data from Companies House (UK government register) and Google Maps Places API. These are public record databases. We do not share your personal data with them when you make searches.

6.6 Other disclosures

We may also disclose your personal data:

• To comply with a legal obligation, court order or regulatory request
• To enforce our Terms & Conditions or protect our rights
• If we are involved in a merger, acquisition or asset sale (we will notify you before your data is transferred)
• To protect the vital interests of you or another person (in emergencies)

7.1 Active accounts

We retain your personal data for as long as your account is active.

7.2 Cancelled accounts

After you cancel your subscription, we delete your account data within 30 days, except where we are legally required to retain it.

7.3 Billing and tax records

We retain billing records and payment transaction data for 6 years after cancellation, as required by UK tax law (HMRC record-keeping obligations). This data includes transaction amounts, dates and payment method details (last 4 digits of card), but does not include your full card number, which we never possess.

7.4 Anonymised data

After the retention period ends, we either delete your personal data or anonymise it (so it can no longer identify you). Anonymised statistical data may be retained for analytical purposes indefinitely.

7.5 Legal retention

In some cases we may be legally required to retain data for longer periods (for example, if required by a court order or regulatory investigation).

10.1 Right to access

You have the right to request a copy of the personal data we hold about you. We will provide this within one month of your request, free of charge.

10.2 Right to rectification

You have the right to ask us to correct any inaccurate or incomplete personal data. You can update most account information directly in your account settings.

10.3 Right to erasure ("right to be forgotten")

You have the right to ask us to delete your personal data. We will comply unless we have a legal obligation to retain it (for example, billing records kept for HMRC). You can delete your account from your account settings, or contact us to request deletion.

10.4 Right to restrict processing

You have the right to ask us to restrict processing of your data in certain circumstances (for example, if you contest its accuracy).

10.5 Right to data portability

You have the right to receive your personal data in a structured, commonly used format, and to transfer it to another controller.

10.6 Right to object

You have the right to object to processing based on legitimate interests. Since we do not conduct direct marketing, this right primarily applies to our analytics processing.

10.7 Right to complain

If you are unhappy with how we handle your personal data, you have the right to complain to the Information Commissioner's Office (ICO), the UK supervisory authority for data protection issues:

• Website: https://ico.org.uk/make-a-complaint/
• Telephone: 0303 123 1113
• Post: Information Commissioner's Office, Wycliffe House, Water Lane, Wilmslow, Cheshire, SK9 5AF

We would appreciate the chance to deal with your concerns before you approach the ICO, so please contact us in the first instance at help@zivlo.io.

10.8 Exercising your rights

To exercise any of these rights, please contact us at help@zivlo.io. We will respond within one month. We may need to verify your identity before processing your request.