ZephyrusWare Privacy Policy

**Version:** 2.0 **Effective date:** October 5, 2026 ### 1. About This Policy This policy describes how ZEPHYRUS VIRTUAL SOLUTION, LLC, doing business as ZephyrusWare ("**ZephyrusWare**", "**we**", "**us**"), handles personal information through its website, its applications, and its customer and partner portals (together, the "**Services**"). It applies to: - **Visitors** to our website; - **Business accounts**: people who use the Services for a business or other organization, including its administrators and users, and partners and their staff; and - **Personal accounts**: individuals in the United States who open a ZephyrusWare account for themselves. If you use the Services through your employer, another organization or a partner, that organization may also decide how information about you is used, and its own privacy practices apply to information it manages. Contact its administrator about information managed on its behalf. Where you buy through a partner, the partner handles the information it holds about your purchase under its own privacy practices. ### 2. Who May Use Personal Accounts Personal accounts are offered only to residents of the fifty states of the United States and the District of Columbia who are at least 18 years old and old enough to make a binding contract where they live. When you open a Personal account you confirm that you meet these requirements. The Services are not directed to children, and we do not knowingly collect personal information from anyone under 18 for a Personal account. If you believe someone under 18 has opened a Personal account, contact us and we will close the account and delete its information, except records we must keep by law. ### 3. Information We Collect | Category | Examples | Applies to | | --- | --- | --- | | Identity and contact | First and last name, email address, the sign-in identifier our sign-in provider assigns, the sign-in method you use, and multi-factor authentication settings held by that provider. | All accounts | | Account | Account type (Personal or Business), business name, account number, roles and memberships, license assignments and account settings. Your Security PIN is never stored as entered: we keep only a one-way verifier that cannot be turned back into the PIN. | All accounts | | Legal acceptance | When you accept our Terms, Billing Policy and Refund Policy: the version of each, a fingerprint (SHA-256) of the exact text shown, the date and time, and your name and email address at that time. For a Personal account, also your confirmation that you are a resident of one of the fifty states or the District of Columbia, at least 18 years old and old enough to make a binding contract where you live. We do not record your IP address or browser details for this purpose. | All accounts | | Purchases and billing | Products, Tiers, quantities, prices, amounts charged, sales tax, the billing address used to calculate tax and set the time zone of your renewals, subscription and renewal dates, cancellation and refund records, payment status and the payment processor's transaction references. When you agree to automatic renewal, the exact wording you were shown, its fingerprint and the time you agreed, and likewise when you accept a price increase. The billing address is the full address you give at checkout: street address, city, state and ZIP code. Your country is always the United States. | Direct purchasers | | Payment card details | Collected and processed by our payment processor, Stripe, on its own pages. This includes the payment method you provide to start a trial, which we do not charge. We do not receive or store your full card number or security code. | Direct purchasers and trial users | | Emails we send you | Your email address, the content of billing and account emails, the email provider's message identifier, when each email was sent and any delivery events the provider reports. For security emails, such as a Security PIN, we keep only body-free records and never keep the message content. | All accounts | | Communications | Support requests and replies, sales and contact-form inquiries (which can include company name, contact name, email, phone number and message), and notes our staff write about support cases. Our systems reject messages that appear to contain card numbers, government identifiers, secrets or health information. | Anyone who contacts us | | Application content | Information you or your organization enters into our applications, such as work items, comments, work logs and attachments. | Users of applications | | Technical and security | IP addresses in security audit records and request rate-limit records, request times, browser information (user agent) in some records, sign-in and security events, support identity-verification attempts and lockouts, and records of support staff access to an account. | All visitors and accounts | | Website and portal usage | Page visits and browser performance measured by Cloudflare Web Analytics, which does not use analytics cookies, and aggregate usage counts. | Visitors and users | | Cookies and browser storage | Storage needed for sign-in, session continuity, preferences and security. See our Cookie Notice. | Visitors and users | We ask you not to send card numbers, card security codes, bank credentials, passwords, government identification numbers or health information in forms, support messages or application content. ### 4. Where Information Comes From - **From you**, when you register, buy, contact us, use the applications or change your settings. - **From your organization**, when its administrators invite you, assign licenses or manage your access in a Business account. - **From a partner**, when you buy through that partner, about the account and order it manages. We also read the billing address you gave at the partner's checkout from the partner's Stripe account, when we need it, only to set the time zone of the dates in our notices about your subscriptions. We do not store that address. - **From the sign-in method you choose** through our sign-in provider, such as your name and email address. - **From our payment processor**, about the status of your payments, refunds and disputes. - **Automatically**, from your browser and our systems when you use the Services. ### 5. How We Use Information We use information to: - provide the Services, create and manage accounts, and let you switch between a Personal account and Business accounts you belong to; - authenticate you and decide, on each request, what you may access; - process purchases, calculate sales tax, manage subscriptions and renewals, and handle refunds and payment disputes; - send the emails the Services require, including purchase confirmations, renewal reminders, price-change notices, cancellation confirmations, failed-payment notices and trial-ending notices, and keep a record that each was sent; - record your acceptance of our Terms and your consent to automatic renewal, so we can show what you agreed to; - provide support, including verifying your identity with your Security PIN before discussing your account; - protect the Services, including by checking for automated abuse when you register, limiting request rates and investigating security events; - help prevent repeated use of free trials by requiring a payment method that we do not charge; - keep the Services reliable and improve them using aggregate measurements; and - comply with the law, keep business and tax records, resolve disputes and enforce our agreements. We do not use personal information for advertising, and we do not make decisions about you that produce legal or similarly significant effects based solely on automated processing. ### 6. Service Providers And Other Disclosures We use service providers to run the Services. They process personal information for us under their agreements with us, including their data processing terms. | Provider | What it does for us | Information it handles | | --- | --- | --- | | Cloudflare | Hosts our website, portals and applications, stores our databases, protects the Services against attacks and automated abuse, and measures website and portal performance. | All information the Services hold, technical and security data including IP addresses | | Auth0 by Okta | Sign-in, multi-factor authentication and business organization membership. | Names, email addresses, sign-in identifiers, sign-in and security events | | Stripe | Payment processing and sales tax calculation for purchases from ZephyrusWare, and payments for purchases from partners. | Payment details you enter on Stripe's pages, billing address, amounts, products and order references | | Resend | Sending our emails and reporting delivery events. | Email addresses, email content, message identifiers and delivery events | | GitHub | Hosts our source code and runs the automated jobs that make encrypted backups of our databases. | Encrypted database backups, which contain account, billing and application records | | Atlassian Statuspage | Our public status page. | Status of our service components only; no customer information is intended to be sent | Stripe also processes payment information under its own privacy policy, for example to prevent fraud and meet its own legal obligations. We also share personal information: - **within your organization**, with the administrators and users of a Business account according to its access settings; - **with a partner** that sold to or manages a Business account, as needed for that partner's sale and service; - **when the law requires**, or to protect the rights, safety or security of our customers, the Services or others; - **in a business transfer**, such as a merger or sale of our business, subject to this policy; and - **with your consent** or at your direction. ### 7. No Sale Or Sharing For Advertising We do not sell personal information, and we do not share it for cross-context behavioural advertising. We do not use advertising cookies or third-party advertising scripts on our website or portals. The only third-party analytics script we use is Cloudflare Web Analytics, which measures page visits and performance without analytics cookies, and we use no other analytics or tracking tools. Stripe handles payment information under its own privacy policy. ### 8. Cookies And Browser Storage The Services use cookies and browser storage for sign-in, session continuity, preferences and security. Blocking them can stop these functions from working. Cloudflare Web Analytics measures page visits and performance without analytics cookies. We do not use advertising cookies. See our Cookie Notice (https://zephyrusware.com/cookies/). ### 9. How Long We Keep Information We keep information for the periods below, and then delete or de-identify it, unless the law requires us to keep it longer, or it is needed to resolve a dispute, enforce an agreement or protect security. Deleted information can remain in encrypted backups until those backups expire. | Information | How long | | --- | --- | | Account and profile information | While your account is open, then deleted or de-identified within 60 days after it closes (the 30-day export period in this Section plus up to 30 days to finish deletion), except for the records in this table, which are kept for their own periods. | | Application content | While your account is open, and for 30 days after it closes so it can be exported on request, then deleted within 30 days. | | Terms acceptance records | For as long as you are our customer and for seven years after your account closes. These records cannot be changed. | | Billing emails and the record of each notice we sent you (message identifier, time sent and content fingerprint) | Seven years. | | Other account emails | 400 days. | | Service emails | 90 days. | | Security email records (no message content) | 30 days. | | Orders, payments, subscriptions, refunds, tax and automatic-renewal consent records | Seven years from the transaction. | | Security audit records | At least 400 days. | | Request rate-limit records, which can include an IP address | 2 days. | | Revoked or expired invitations | 90 days. | | Support requests and messages | For the life of the request and 24 months afterward. | | Support identity-verification attempts and support access records | At least 400 days. | | Account number and Security PIN verifier | For the life of the account. An account number is never reused. | | Sales and contact-form inquiries | For 24 months after our last contact with you. | | Encrypted database backups | 7 days. Backups exist in two places: the recovery history kept by our database provider, and the encrypted backup files created by our automated jobs, which are attached to each job run and also kept for 7 days. | ### 10. Your Choices And Requests You can ask us to: - **access** the personal information we hold about you, or receive a copy of it; - **correct** inaccurate information; - **delete** your personal information; or - **export** your information. **How to ask.** Email privacy@zephyrusware.com or open a support request in the customer portal. Tell us which account the request is about. Do not send passwords or identity documents in your first message. **Verification.** We verify your identity before acting on a request, for example by confirming the request through your signed-in account or your Security PIN, and we may ask for more information where needed. **Personal accounts.** You can see much of your information in the customer portal. To correct the name on a Personal account, open a support request. To close your account, cancel your subscriptions and ask us through support. **Business accounts.** Your organization's administrators manage much of the information in a Business account. We may refer a request to them or need their involvement before we act. **What we keep after a deletion request.** Some records must be kept even if you ask us to delete your information, including the record of your acceptance of our Terms, order, payment, tax and refund records, the record of notices we sent you, your account number, security and support verification records, and records needed for a payment dispute. We keep only what we need and only for the periods in Section 9. We will not treat you differently because you made a request. ### 11. Your State Privacy Rights Depending on where you live, and if a state privacy law applies to us, you may have the right to know what personal information we collect, use and disclose; to access, correct or delete it; to receive it in a portable form; and to opt out of its sale, of sharing for targeted advertising and of profiling. Because we do not sell or share personal information for advertising (Section 7), there is nothing to opt out of today. You may use an authorized agent where the law allows, and you may appeal our decision on your request by replying to it. ### 12. Security We use administrative, technical and organizational safeguards designed to protect personal information, including: - access to account information limited to the account it belongs to and checked again on every request; - connections to our website, portals and applications protected with HTTPS; - sign-in through our identity provider, with multi-factor authentication available; - Security PINs held only as one-way verifiers; - payment card details entered only on our payment processor's pages; - encrypted database backups; and - records of security events and of staff access to accounts. No system is perfectly secure, and we cannot guarantee that unauthorized access will never happen. If we confirm a security incident that affects your personal information, we will notify you as the law requires. We do not claim any security certification or attestation. ### 13. Where Information Is Processed Personal accounts are offered only to residents of the fifty states of the United States and the District of Columbia. Our service providers may process information in the United States and in other countries where they operate. Our primary databases are hosted by Cloudflare, and we ask Cloudflare to place them in Eastern North America. Cloudflare treats that as a preference, not a guarantee, so database information and its backups may be stored or processed elsewhere. ### 14. Changes To This Policy We may update this policy. The version number and effective date at the top show when it last changed. If we make a material change, we will email Personal account holders and Business account administrators before it takes effect, and we keep earlier versions. ### 15. Contact Questions about this policy or your personal information can be sent to privacy@zephyrusware.com or by mail to ZephyrusWare, PO Box 212, Eagle Lake, FL 33839. Support is available through the customer portal. Security concerns can be sent to security@zephyrusware.com.