Your workspace, your data.

Zolodek (“we”, “us”) is the operator of the Zolodek web application at zolodek.vercel.app and any related subdomains (the “Service”). We are the data controller for the account information you provide us and a data processor for the project content you create inside your workspace.

We try to collect the minimum needed to run the Service. In practice that is:

• Account details. The name, email address, and password hash you give us when you sign up. If you sign in with a magic link, we also store the delivery metadata Supabase needs to verify the link.
• Workspace content. The projects, tasks, clients, quotes, invoices, notes, expenses, files, and vault entries you or your teammates create. This is your data. We store it so you can read it back.
• Billing details. If you subscribe to a paid plan, our payment processor (Stripe) holds your card. We only see the subscription status and last four digits, never the full card number.
• Operational logs. Our hosting provider records short-lived request logs (IP address, URL, status code, user agent) so we can debug outages and stop abuse. These logs are not tied to a marketing profile.

We do not run third-party analytics, ad networks, session replay tools, or fingerprinting scripts on the Service. There is no Google Analytics, no Facebook Pixel, no PostHog, no Segment.

We use strictly necessary cookies only. Those are the session cookies Supabase sets when you sign in so you stay signed in, and a small amount of local storage the app uses to remember your theme, sidebar layout, and Zolo assistant preferences. We do not set advertising cookies, and we do not need a consent banner because we do not run non-essential tracking. If that ever changes, we will ask before we set anything new.

We use your data to:

• Run the Service and keep your workspace available.
• Send you transactional email you asked for (password resets, invitation acceptance, billing receipts).
• Answer support requests you send us.
• Keep the Service secure, detect abuse, and comply with legal obligations.

We do not sell your data. We do not use the content inside your workspace to train machine-learning models. When you use the optional Zolo AI features, your prompt is sent to our model provider via the Vercel AI Gateway to generate a response, and neither we nor the provider retain that prompt for training.

We rely on a small number of infrastructure partners to run the Service. Each of them is a data processor bound by a written agreement:

• Vercel hosts the web application and stores request logs.
• Supabase hosts our database, authentication, and file storage.
• Stripe processes payments and stores billing information.
• Vercel AI Gateway routes optional Zolo AI requests to the current model provider (for example OpenAI). AI features are off by default in your profile settings and can be disabled at any time.

We may add or replace a processor. When we do, we will update this page. We do not share your workspace content with anyone else, and we do not disclose personal data to authorities unless we are legally required to.

We keep your workspace content for as long as your account is active. If you close your account, we delete workspace content within 30 days, subject to a short backup retention window. We keep minimum billing records for as long as tax law requires (typically seven years) and operational logs for up to 30 days.

If you are in the EEA, the UK, California, or another jurisdiction with a similar privacy regime, you have the right to:

• Ask for a copy of the personal data we hold about you.
• Ask us to correct data you think is wrong.
• Ask us to delete your account and the data linked to it.
• Object to a specific use of your data.
• Complain to your local data-protection authority.

You can act on most of these from Settings inside the app. For anything you cannot do yourself, email us at legal@zolodek.app and we will respond within 30 days.

Data in transit is encrypted with TLS. Data at rest is encrypted by Supabase and Stripe. Vault entries you save in the app are encrypted in your browser with a key we never receive, so a Zolodek employee could not read them even with database access. That said, no online service is unbreakable, and we ask you to use a strong, unique password for your account.

Zolodek is a tool for professional work and is not intended for anyone under 16. If you believe a child has created an account, email us and we will delete it.

If we make a material change to this policy, we will update the “last updated” date at the top and, where the change affects you, notify you inside the app or by email before it takes effect.

Privacy questions, data-access requests, and complaints go to legal@zolodek.app. A real person reads that inbox.