Privacy Policy — Zeliora

1. Who is responsible

The controller of account and company data is Tigran Sarkisyan, an individual based in Turkmenistan, Parahat 7/3, Ashgabat ("Zeliora", "we"). Data protection contact: hello@zeliora.app. Data protection officer (DPO): not appointed. EU / UK representative: not appointed.

We process the client and staff data a company enters into the service as a processor on that company's behalf (section 8 of the Terms). For questions about such data, contact the company that entered it.

2. What we collect

Account data: name, email, password (stored only as a hash), chosen language, role in the company.
Company data: name, page address (slug), currency, time zone, branches, settings, staff, subscription details.
Payment data: handled by the payment provider; we do not store card numbers and only receive the payment status, period and payment identifiers.
Technical data and logs: IP address, browser and device type (user agent), request times and URLs, error details, a server session when the page loads.
Device signals at signup: a hash of browser and device characteristics (user agent, platform, languages, time zone, screen size and colour depth, CPU cores, device memory if the browser reports it, a canvas rendering hash and the WebGL graphics renderer name), a random browser identifier, the IP address and its network (/24 or /48), the email address in normalised form. See section 4.
Consent: when you accepted the Terms and the Policy, the document version and the IP address.
Correspondence: emails and support requests.
Cookies and local storage: only those needed for the service — see the Cookies and local storage page.

3. Purposes and legal bases

Performance of the contract: creating and running your account and company, the service features, billing, support, service notices (subscription, trial, data deletion).
Legitimate interests: security of the service, protection against account takeover and fraud, detecting trial abuse (several accounts of one person), proving consent, improving the service with aggregated statistics, defending our legal rights. We have assessed that these interests do not override your rights and limited the data used.
Legal obligation: accounting and tax records, responding to lawful requests of authorities.
Consent: optional analytics and marketing emails — not used at the moment; if we add them, we will ask for consent first and you can withdraw it at any time.

4. Device signals and abuse prevention

The free trial is once per business and per person (section 4 of the Terms). To notice when one person registers several companies to get new trials, at signup we store the signals listed in section 2 and compare them with earlier signups.

Browser characteristics are turned into a one-way hash (SHA-256) in your browser; the raw values are not sent to our servers.
The random browser identifier is kept in local storage and contains no information about you.
A match is only flagged for review by a Zeliora staff member. No automated decision with legal effect is made: signup is not blocked and the trial is not changed automatically.
The signals are not used for advertising, not shared with third parties and not used to track you on other websites.
The signals are kept for 12 months and then deleted automatically.
You can object to this processing (section 8) — we will review your case individually.

5. Retention

Account: while the account exists; after deletion no longer than required by law or to defend a claim.
Company data: during the subscription and for 12 months after it ends, then permanently deleted (section 6 of the Terms).
Signup signals: 12 months from the signup date.
Technical logs: up to 90 days.
Proof of consent: while the account exists and for the limitation period afterwards.
Accounting records: for the periods required by law.

6. Who we share data with

We do not sell personal data. We share it only with sub-processors that help us run the service, under contracts with data protection obligations:

Hosting and databases: [Hosting provider, hosting country]
Email delivery: Resend, Inc. (USA)
Payments: Paddle.com Market Limited (United Kingdom) — reseller and Merchant of Record for subscription payments

Data may also be disclosed on a lawful request of authorities, to protect our rights, or in a corporate reorganisation — keeping the safeguards of this Policy.

7. International transfers

Zeliora is used in many countries, so data may be processed outside your country, including outside the EEA. In that case we rely on adequacy decisions or on the European Commission's Standard Contractual Clauses (and their UK equivalents) with supplementary measures where needed. You can request a copy of the safeguards at hello@zeliora.app.

8. Your rights

access — know what data about you we process and get a copy;
rectification of inaccurate data;
erasure ("right to be forgotten") where there is no ground to keep processing;
restriction of processing;
portability — get your data in a machine-readable format;
objection to processing based on legitimate interests, including the device signals;
withdrawal of consent at any time where processing is based on consent;
a complaint to the data protection authority of your country.

To exercise your rights, write to hello@zeliora.app from the address of your account. We reply within one month (extendable for complex requests, in which case we will tell you) and may ask you to confirm your identity. If your data was entered by a company where you are a client or an employee, we will forward the request to that company or help it respond.

9. Security

We use encrypted connections (HTTPS), store passwords only as hashes, isolate each company's data in a separate database schema, restrict staff access, require two-factor authentication for platform administrators and log their actions. No system is perfectly secure; we notify breaches affecting your data within the time limits set by law.

10. Children

The service is for businesses and is not directed at children. We do not knowingly collect data of people under 16 to create accounts. A company enters data of underage clients at its own responsibility as the controller.

11. Cookies and local storage

We use only strictly necessary cookies and browser storage entries; there is no optional analytics and no advertising. The full list is on the Cookies and local storage page.

12. Changes to this Policy

We may update this Policy. We will give advance notice of material changes; the version and the update date are shown at the top of the page.