Zeroheight privacy & data

Under the GDPR, zeroheight may act as either a data controller (where we determine the purpose and means of processing) or a data processor (where we process data on behalf of another controller).

Contact information Name, email address

Billing details for plan purchases (card data is held by Stripe, not us)

Account information Name, email, IP address (used for authentication and session security)

Usage information Features used, links clicked, time spent

User content Images, comments and other content you upload or post

Log data IP address, device/browser type, OS, pages visited, search terms, frequency of use

Marketing preferences Name, email, and your communication preferences

Provide, operate and improve our platform and services

Authenticate users and maintain security

Respond to support queries and communicate with you

Personalise your experience and target relevant offers

Facilitate marketing, surveys and promotions

Detect and prevent fraud and unauthorised activity

Comply with legal obligations

We are required under UK tax law to retain name, contact details and billing data for a minimum of six years (or longer if required by applicable law).

Recruitment data: Retained for two years after we notify an applicant of our hiring decision.

All other data: Deleted when there is no longer a lawful basis for processing it.

UK adequacy regulations - for countries the UK government has found to provide adequate protection, including EEA countries.

For transfers to certified US organisations, we may rely on the UK Extension to the EU-US Data Privacy Framework (UK-US Data Bridge), in force since 12 October 2023.

Standard Contractual Clauses (SCCs) - the 2021 EU Commission SCCs, where no adequacy decision applies.

International Data Transfer Agreement (IDTA) - the ICO-approved transfer mechanism for UK restricted transfers where no adequacy regulation applies.

A list of our third-party software tools is available on our website.

To exercise any of these rights, contact support@zeroheight.com.

Access - request a copy of your personal data

Rectification - ask us to correct inaccurate data

Erasure - ask us to delete your data (in certain circumstances)

Restriction - ask us to restrict processing (e.g. while accuracy is disputed)

Portability - receive your data in a structured, machine-readable format (in certain circumstances)

Object - object to processing for direct marketing (including profiling) at any time, or to other processing based on legitimate interests

No automated decisions - not to be subject to solely automated decisions that significantly affect you

Withdraw consent - at any time, without affecting prior lawful processing

We will never sell your personal data to any third party.