This Privacy Policy explains how Zeloxa Labs LLC ("Zeloxa", "we", "us") collects, uses, shares and protects personal information, and the choices and rights you have. It applies to our website at zeloxalabs.com, the client dashboard, and our services: website and app projects, Care plans, Zeloxa Host, Zeloxa Cloud, our API, command-line tool and integrations (the "Services").
Two roles. For information about our own customers, prospects and website visitors, we decide how it is used (we are the "business" or "controller"). For information about the visitors of websites our customers host with us, such as what they type into a contact form, our customer decides and we process it on their behalf (we are a "service provider" or "processor"). Section 3 explains the second case; the rest of this policy covers the first. If you visited a website hosted on Zeloxa and have a question about your data, contact that website's owner first; we will help them respond.
Contents
- Information we collect
- How we use it
- Data on websites we host for customers
- Cookies and similar technologies
- How we share information
- How long we keep it
- How we protect it
- Your rights and choices
- California privacy rights
- Visitors from the EU, UK and Switzerland
- International transfers
- Children
- Changes to this policy
- Contact us
1. Information we collect
Information you give us
- Account information: your name, email address, password (stored only as a secure hash by our authentication provider), the organization you create or join, and your role in it.
- Team invitations: the email address of anyone you invite, and the role you choose for them.
- Contact, quote and newsletter requests: your name, email address, company, phone number (if you give it), and the content of your message.
- Project estimates: if you use our estimate questionnaire, your name, email address, business name and phone number (if you give them), your answers, and the website or campaign that referred you (for example a search engine or a link's campaign tag). Once you agree to be contacted on the first step, your answers are saved as you go, so we may follow up about your project even if you don't finish. We use them to prepare and discuss your estimate; we don't add you to marketing emails unless you tick the separate newsletter box.
- Project and support information: materials, instructions, feedback and messages you send us about your projects and requests.
- Billing information: your billing name, email and address, and subscription details. Card details are collected and stored by our payment provider, Stripe; we see only the card brand, last four digits and expiry date.
Information collected automatically
- Service and security logs: IP address, browser and device type, pages and API endpoints requested, timestamps and error information, when you use our website, dashboard or API.
- Account activity: actions taken in your organization, such as deployments, settings changes, domain changes and token use, recorded with the person or token that took them, so your team can see who did what.
Information from connected services
- GitHub: if you connect a GitHub repository, the GitHub App you install gives us the repository and branch names, commit identifiers and messages, and the code of the repositories you choose, so we can build and deploy them. You control which repositories it can see in your GitHub settings.
- Stripe: payment status, subscription status and invoices.
- Automation tools: if you connect Zapier, Make or similar tools with an API token, we record the connection and the address events are sent to.
2. How we use it
| Purpose | Information used | Legal basis (EU/UK) |
|---|---|---|
| Provide the Services: accounts, projects, hosting, builds, domains, billing | Account, project, billing, connected-service information | Performing our contract with you |
| Communicate with you: service, security and billing notices, replies to your requests | Contact and account information | Contract; legitimate interests |
| Send alerts you have turned on (failed deployments, domain problems, form notifications) | Account email, notification settings | Contract; your choices in notification settings |
| Keep the Services secure: detect abuse, fraud, spam and attacks | Logs, account activity | Legitimate interests; legal obligations |
| Improve and fix the Services | Logs and usage information, in aggregated form where possible | Legitimate interests |
| Marketing emails such as a newsletter | Email address | Consent (unsubscribe at any time) |
| Comply with law, enforce our terms, defend legal claims | As needed | Legal obligations; legitimate interests |
We do not sell personal information, we do not share it for cross-context behavioral advertising, and we do not use it to make decisions with legal or similarly significant effects based solely on automated processing.
3. Data on websites we host for customers
When a customer hosts a website on Zeloxa Host, we process information about that website's visitors only to provide the service to the customer, under our Data Processing Addendum:
- Form submissions: whatever the visitor enters into the site's forms, plus the time, the page it was sent from, the browser's user-agent, and a one-way, salted hash of the visitor's IP address used only to limit spam and abuse. We do not store the IP address itself. Submissions are kept for 12 months and then deleted automatically; the customer can delete them sooner.
- Visitor analytics: page views counted without cookies. For each page view we record the page, referring site, country, device type and browser, and a visitor identifier made by hashing the IP address and browser with a secret that changes every day, so a visitor cannot be recognized from one day to the next or across sites. We do not store IP addresses. Analytics are kept for 90 days.
- Delivery logs: like any web host, our infrastructure briefly processes the IP address and request details of each visit to deliver the page and protect against attacks.
- Third-party tags the customer enables: customers can add tools such as Google Analytics, Meta Pixel, chat widgets or their own code to their sites. Those tools are chosen by the customer and governed by the customer's and the tool provider's privacy policies, not this one. Customers can turn on a consent banner that holds those tags until the visitor agrees.
The customer is responsible for telling their visitors how their information is used and for answering their requests. We help customers do so.
4. Cookies and similar technologies
We set only cookies that are necessary for the Services to work:
| Cookie | Where | Purpose | Duration |
|---|---|---|---|
Sign-in session (sb-…) | zeloxalabs.com | Keeps you signed in to the dashboard | Until you sign out or the session expires |
Preview access (__Host-…) | Preview addresses of customers' sites | Lets the customer's team, or people they share a link with, view private previews | 12 hours for team members; up to 7 days for shared links |
Password access (__Host-zeloxa-access) | Password-protected customer sites | Remembers that a visitor entered the site's password | 7 days |
We do not use advertising or cross-site tracking cookies on our own website, so there is no cookie banner for them.
Some parts of our website load content from other providers, which therefore receive your IP address and browser information when you view the page: images from Unsplash, and a copyright-protection badge from DMCA.com. Their own privacy policies apply.
Do Not Track and Global Privacy Control. We do not track you across other websites, so there is nothing for these signals to switch off on our own site; we treat a Global Privacy Control signal as a request to opt out of any sale or sharing, which we do not do in any case.
5. How we share information
We share personal information only as follows:
Service providers who process it for us under contracts that require them to protect it and use it only for our instructions:
Provider What they do Where Cloudflare, Inc. Hosting, content delivery, DNS, security, transactional email, analytics storage Global network; United States Supabase, Inc. Database and sign-in (authentication) Canada Stripe, Inc. Payments and subscriptions United States and other countries GitHub, Inc. Source code integration (only if you connect it) United States We list changes to these providers on this page; customers covered by the Data Processing Addendum receive notice as it describes.
Integrations you choose. When you connect Zapier, Make, Slack, Discord, a webhook or another tool, we send it the data you selected, to the address you gave.
Your organization. Members of your organization can see the organization's projects, activity and, depending on their role, its billing and members.
Legal reasons. When we believe in good faith that disclosure is required by law, a valid legal process or a government request, or is needed to protect the rights, property or safety of Zeloxa, our customers or others, including to investigate abuse. Where the law allows, we will tell the affected customer first.
Business transfers. If Zeloxa is involved in a merger, acquisition or sale of assets, personal information may be transferred as part of it, subject to this policy.
With your consent or at your direction.
6. How long we keep it
| Information | How long |
|---|---|
| Account and organization information | While your account is open, then deleted within 30 days of closing it, except as below |
| Billing records and invoices | As long as tax and accounting law requires (generally 7 years) |
| Project files and messages | For the life of the project and any Care plan, then up to 2 years unless you ask us to delete them sooner |
| Form submissions (customers' sites) | 12 months, or sooner if the customer deletes them |
| Visitor analytics (customers' sites) | 90 days |
| Account activity history | While the organization exists |
| Service and security logs | Generally up to 30 days, longer if needed to investigate abuse or security incidents |
| Contact and newsletter requests | Until you unsubscribe or ask us to delete them, or 2 years after our last contact |
| Project estimate answers | Unfinished questionnaires: up to 12 months. Finished ones: 2 years after our last contact, or for the life of any project that follows |
| Backups | Deleted data may remain in encrypted backups for up to 30 days until they expire |
7. How we protect it
We use administrative, technical and physical safeguards appropriate to the information, including encryption in transit (HTTPS everywhere) and at rest by our providers, hashed passwords and API tokens, encryption of stored environment variables, role-based access within organizations, access restricted to staff who need it, and audit logs of account activity. No method of transmission or storage is completely secure, so we cannot guarantee absolute security. If a breach affects your personal information, we will notify you and the authorities as the law requires.
8. Your rights and choices
Depending on where you live, you may have the right to:
- access the personal information we hold about you and get a copy in a portable format;
- correct inaccurate information;
- delete it;
- object to or restrict certain uses, and withdraw consent where we rely on it;
- not be discriminated against for exercising these rights.
Many of these you can do yourself: update your profile in the dashboard, manage notification emails in notification settings, unsubscribe from marketing emails with the link in each one, and close your account. For anything else, email privacy@zeloxalabs.com. We will verify your identity (usually by confirming control of your account email) and respond within 30 days, or sooner where the law requires. You may use an authorized agent; we will ask for proof of their authority. If we decline a request, we will explain why, and you may appeal by replying to our decision; we will respond to an appeal within 45 days.
We cannot change or delete information that we process for a customer about its website's visitors without that customer's instructions; we will pass your request to the customer.
9. California privacy rights
This section applies to California residents and supplements the rest of this policy, including for purposes of the California Consumer Privacy Act as amended by the California Privacy Rights Act (CCPA) and the California Online Privacy Protection Act.
- Categories collected in the last 12 months: identifiers (name, email, IP address); customer records (billing name and address); commercial information (subscriptions and purchases); internet or network activity (logs and usage of the Services); professional information (company and role); and inferences we do not make. Sources, purposes and recipients are described in sections 1, 2 and 5. Retention is in section 6.
- Sensitive personal information: we collect account passwords (stored as hashes) only to authenticate you, and we do not use or disclose sensitive personal information for any other purpose.
- No sale or sharing: we do not sell personal information or share it for cross-context behavioral advertising, and have not done so in the last 12 months. We do not knowingly sell or share the personal information of consumers under 16.
- Your rights: to know, access, correct and delete your personal information, and to not be discriminated against for exercising these rights, as described in section 8.
- Shine the Light: we do not disclose personal information to third parties for their own direct-marketing purposes.
10. Visitors from the EU, UK and Switzerland
Zeloxa Labs LLC is the controller of the personal information described in sections 1 and 2. The legal bases we rely on are listed in the table in section 2. In addition to the rights in section 8, you have the right to lodge a complaint with your local data protection authority, although we would appreciate the chance to address your concern first at privacy@zeloxalabs.com.
11. International transfers
We are based in the United States. Our main database is hosted in Canada, and our providers process information in the United States, Canada and other countries where they operate. Where we transfer personal information from the European Economic Area, the United Kingdom or Switzerland, we rely on appropriate safeguards such as the European Commission's Standard Contractual Clauses and the UK Addendum to them, included in our providers' data processing terms and, for our customers, in our Data Processing Addendum.
12. Children
The Services are for businesses and are not directed to children. We do not knowingly collect personal information from anyone under 16 (13 in the United States). If you believe a child has given us personal information, contact privacy@zeloxalabs.com and we will delete it.
13. Changes to this policy
We may update this policy. We will post the new version here with a new effective date and, if the changes are material, email account owners before they take effect.
14. Contact us
Zeloxa Labs LLC, Orange County, California, United States
- Privacy requests and questions: privacy@zeloxalabs.com
- Everything else: legal@zeloxalabs.com