Privacy policy

02Data we collect

We collect only what we need to run the service:

• Account data — the email address you sign in with, and authentication metadata (sign-in timestamps, session tokens) held by our authentication provider.
• Subscription and billing data — the plan you bought, its status and renewal date. Card details are entered on our payment processor's pages and are never received or stored by us.
• Usage data — the dashboards and pages you open, and any context or notes you save into a dashboard.
• Technical data — IP address, browser and device type, and error logs, recorded when you load the site.
• Communications — the content of emails you send us, and our replies.

03How we use it

We do not sell your personal data, and we do not share it with third parties for their own advertising.

• To give you access to the dashboards and research you have subscribed to.
• To take payment, renew or cancel a subscription, and issue receipts.
• To secure the service — detecting unauthorised access, abuse and credential sharing.
• To fix faults and improve the product, using aggregated usage data.
• To answer your enquiries and send service notices (billing, security, material changes to these terms).
• To meet legal, tax and record-keeping obligations.

04Legal bases

Where the GDPR applies, we rely on: performance of a contract (providing the service you paid for); legitimate interests (securing the service, understanding how it is used, and direct communication with subscribers about the product they hold); legal obligation (tax and accounting records); and consent, where we ask for it separately — for example a marketing newsletter, which you can withdraw at any time.

05Processors and sub-processors

We keep the list of companies that process data on our behalf deliberately short. Each is bound by a data-processing agreement and may use your data only on our instructions:

• Supabase — database, authentication and session storage.
• Stripe — payment processing and subscription billing. Stripe is an independent controller of the payment data it collects; see stripe.com/privacy.
• Our hosting and CDN provider — serving the site and retaining short-lived request logs.
• Our email provider — transactional and support email.

06International transfers

Our providers operate infrastructure in the United States and elsewhere. Where personal data moves out of the UK or European Economic Area, the transfer is covered by the UK International Data Transfer Addendum or the European Commission's Standard Contractual Clauses, together with the additional safeguards those clauses require.

07Retention

We keep account and usage data for as long as your account is open, and for 12 months after you close it so that you can be reinstated and so that we can resolve any dispute. Billing and tax records are kept for the period our tax obligations require, typically seven years. Request logs are kept for up to 90 days.

08Your rights

Subject to the exceptions in the applicable law, you may ask us to give you a copy of your data, correct it, delete it, restrict or object to how we use it, or send it to another provider in a portable form. You may also withdraw any consent you have given.

If you are in California, you additionally have the right to know what we collect, to delete it, to correct it, and not to be discriminated against for exercising those rights. We do not "sell" or "share" personal information as the CCPA defines those terms, so no opt-out is required.

Write to support@zentradings.com and we will respond within one month. If you are unhappy with the outcome, you may complain to your local supervisory authority — in the UK, the Information Commissioner's Office.

09Cookies and similar technologies

We set a small number of first-party cookies that are strictly necessary: they keep you signed in, remember your theme preference, and protect forms against cross-site request forgery. These do not require consent.

If we later add analytics or any non-essential cookie, we will ask for your consent through a banner before it is set, and update this section.

10Security

Data is encrypted in transit with TLS and at rest by our infrastructure providers. Access to production systems is limited to the people who need it and protected by multi-factor authentication. No system is perfectly secure, so if we become aware of a breach affecting your personal data we will notify you and the relevant regulator as the law requires.

11Children

The service is intended for professional and institutional users and is not directed at anyone under 18. We do not knowingly collect data from children.

12Changes to this policy

We will update this page when our practices change and revise the date at the top. If a change materially affects your rights, we will email subscribers before it takes effect.