Privacy Policy

1. Who We Are

ZeroBloat Ltd operates zerobloat.io. This policy explains what data we collect, how we use it, and your rights.

2. Data We Collect

• Account data: email address, name, billing address when you register or purchase.
• Payment data: processed by Paddle or PayPal. We never store raw card numbers.
• Usage data: license activation domain, last-ping timestamps (for quota enforcement).
• Analytics data: aggregated, non-personal site usage statistics via self-hosted analytics only.
• BYOK API keys: stored encrypted in your WordPress user meta on your own server — never transmitted to us.

3. How We Use Your Data

• To deliver your license keys and validate activations
• To send transactional emails (receipts, password resets, renewal reminders)
• To calculate affiliate commissions and process payouts
• To detect fraud and enforce plan limits

4. Data Sharing

We share your data with: Paddle (payments), PayPal (payments), Amazon SES / Mailgun / SendGrid (email delivery based on your chosen provider). We do not sell your personal data.

5. Data Retention

Account data is retained as long as your account is active, plus 90 days after closure. Payment records are kept for 7 years for accounting compliance. You may request deletion at any time (see Section 7).

6. Cookies

We use one persistent cookie: zerobloat_ref (60-day affiliate tracking, HttpOnly, SameSite=Lax). We do not use analytics cookies or third-party tracking pixels.

7. Your Rights

You have the right to access, correct, export, or delete your personal data. Email legal@zerobloat.io with your request. We respond within 30 days.

8. Security

All data is transmitted over HTTPS. Passwords are hashed using WordPress's default bcrypt implementation. API secrets are stored hashed and never displayed in full after creation.

9. Changes

We'll notify active customers by email if we make material changes to this policy.