Privacy Policy

What we collect

When you become a client we store your business name, contact name, email address, phone number if you give us one, and your website address. We also keep internal notes about your account and a log of activity on it.

If you sign in, we store your email and a hashed password. Passwords are hashed with scrypt and are never stored or recoverable in plain text. If you turn on two-factor authentication we store the secret needed to verify your codes.

When you contact support, we keep the messages you send and our replies so the conversation has history.

We record IP addresses and browser user-agent strings alongside administrative actions and sign-in attempts. This is a security measure: it is what lets us tell a real login from an attack, and it is why the record exists at all.

What we never see

Card numbers. Payments are handled entirely by Stripe, on Stripe's own pages and forms. Your card details go from your browser to Stripe and never touch our servers or our database.

We receive from Stripe only what we need to run billing: an anonymous customer reference, the amount, the status, and the last four digits shown on your receipts.

Why we collect it

To provide the service you bought: hosting your site, running your plan, answering support, and keeping your account working.

To bill you, send invoices and receipts, and send payment reminders before a charge.

To keep the account secure, which covers rate limiting, fraud prevention, and the administrative audit trail.

We do not sell your information, we do not share it with advertisers, and we do not use it to build profiles or train models.

Who we share it with

Only the services needed to run the business, each handling one job:

Stripe processes payments and stores your billing details. Neon hosts our database. Vercel hosts the site and portal. Resend delivers our email. Documenso handles contract signing when your work involves an agreement. Telegram delivers support notifications to us, which means the subject and body of a support ticket you send can pass through it.

Each of these receives only what its job requires. We share your information with no one else, except where the law requires it.

How it is protected

Everything travels over HTTPS. The database is hosted by Neon with encryption at rest and automatic backups. Secrets and API keys live only in encrypted environment configuration, never in our code.

Access to client data is restricted to the account owner and enforced in code on every request, not just hidden in the interface. Administrative access additionally requires two-factor authentication.

The audit log is append-only at the database level, so a record of who did what cannot be edited or deleted, including by us.

Sessions expire after 15 minutes of inactivity.

How long we keep it

Account and billing records are kept while you are a client and afterwards for as long as tax and accounting rules require, which in the United States is generally seven years for financial records.

Support conversations are kept while your account is active. Security and audit records are kept for the life of the account, because a trail with gaps is not a trail.

Your choices

You can ask us for a copy of what we hold about you, ask us to correct it, or ask us to delete it. Email us and we will respond within 30 days.

Deletion has one limit worth stating plainly: we cannot delete records we are legally required to keep, such as paid invoices. We will delete everything else and tell you exactly what was kept and why.

Our email is transactional, covering invoices, receipts, reminders, and support replies. We do not run marketing email, so there is no list to unsubscribe from.

Cookies

We use cookies for one thing: keeping you signed in. There is no advertising, analytics, or third-party tracking on this site, so there is nothing to opt out of and no consent banner to click.

Children

This is a service sold to businesses. It is not directed at children, and we do not knowingly collect information from anyone under 13.

Changes and contact

If this policy changes in a way that affects you, we will update the effective date above and tell existing clients by email.

Questions about any of this, or a request about your data: support@zekecreations.com.