Privacy Policy — Zelatonia

1. Who We Are

Zelatonia is a B2B SaaS platform providing decision management, goal tracking, compliance, and organizational planning tools to businesses and their teams.

For the purposes of applicable data protection laws, Zelatonia acts as the data processor on behalf of your organization (the data controller) when processing your employees' personal data within the platform.

2. Data We Collect

Category	Examples	Purpose
Account data	Name, email, job title, department, role	Authentication and access control
Profile data	Avatar photo, bio, contact details	User identity within the platform
Usage data	Actions taken, pages visited, session duration	Audit logs, platform improvement
Content data	Goals, plans, decisions, documents, messages	Core platform functionality
Technical data	IP address, browser type, device type	Security and fraud prevention
Billing data	Company name, billing email (card data held by Stripe)	Subscription management

We never store raw payment card data. All payment processing is handled by Stripe, which is PCI-DSS Level 1 certified.

3. How We Use Your Data

Provide and maintain the Zelatonia platform and its features
Authenticate users and enforce role-based access controls
Generate audit logs for compliance and governance requirements
Send transactional emails (e.g., password resets, account notifications)
Process billing and manage subscriptions
Monitor and improve platform performance and security
Comply with legal obligations

We do not sell your personal data to third parties, use your data for advertising, or use it to train AI models without explicit consent.

4. Data Sharing

We share data only with trusted sub-processors necessary to operate the platform:

Sub-processor	Purpose	Location
Stripe	Payment processing	USA (SCCs applied)
Cloud hosting provider	Infrastructure and storage	Configurable per contract
Email delivery service	Transactional emails	USA (SCCs applied)

We may disclose data if required by law, court order, or to protect the safety and security of the platform or its users.

4b. Gmail & Outlook Access (Email Agreement)

Zelatonia lets a user connect their own Gmail or Outlook account so they can send an Email Agreement — a message asking someone to agree or disagree with a business decision — directly from their own email address.

What we access: only the permission to send email on your behalf (Google scope gmail.send; Microsoft Graph Mail.Send), plus your email address so we can show which account is connected. We do not read, store, or scan your inbox or any of your messages.
When we use it: only when you click Send on an Email Agreement. Each email goes only to the recipient you type, with the decision you chose.
What we store: an access token for your connected account (kept encrypted in transit and stored on our servers), used only to send the emails you ask for. You can disconnect at any time from the Email Agreement card ("Change"), or revoke access from your Google or Microsoft account settings.
No sharing or selling: we never sell this data, never use it for advertising, and never let people read it, except where needed for security or required by law.

Zelatonia's use and transfer to any other app of information received from Google APIs will adhere to the Google API Services User Data Policy, including the Limited Use requirements.

5. Security

We implement technical and organizational measures to protect your data, including:

JWT-based authentication with expiry controls
Role-based access controls (RBAC) enforced server-side
Encrypted data transmission (HTTPS/TLS)
Audit logging of all sensitive actions
Regular security reviews

No system is 100% secure. If you believe your account has been compromised, contact us immediately.

6. Data Retention

We retain your data for as long as your organization's account is active. Upon account termination:

Active data is deleted within 30 days of account closure
Backup copies are purged within 90 days
Audit logs may be retained for up to 7 years for legal compliance

You may request early deletion of specific data by contacting us (see Section 8).

7. International Transfers

If data is transferred outside your region, we ensure appropriate safeguards are in place, including Standard Contractual Clauses (SCCs) for transfers from the EU/EEA, and compliance with UK GDPR for UK-based customers.

8. Your Rights

Depending on your location, you may have the following rights regarding your personal data:

Access — Request a copy of your data
Rectification — Correct inaccurate data
Erasure — Request deletion of your data ("right to be forgotten")
Portability — Receive your data in a machine-readable format
Restriction — Limit how we process your data
Objection — Object to certain types of processing

To exercise these rights, contact: privacy@zelatonia.com

Note: Many rights (like access and rectification) can be exercised directly through your profile settings inside the platform.

9. Cookies & Local Storage

Zelatonia uses browser localStorage (not traditional cookies) to store your session token, user preferences, and cached permission data. This data stays on your device and is cleared when you log out.

We do not use third-party tracking cookies or advertising pixels.

10. Children's Privacy

Zelatonia is a business platform not intended for individuals under 18 years of age. We do not knowingly collect personal data from children.

11. Contact Us

If you have questions about this policy or want to exercise your rights:

Email: privacy@zelatonia.com
Subject line: "Privacy Request — [Your Organization Name]"

We will respond to all requests within 30 days.

12. Changes to This Policy

We may update this policy from time to time. When we make material changes, we will notify account administrators via email and display a notice in the platform at least 14 days before changes take effect.

Continued use of the platform after the effective date constitutes acceptance of the updated policy.