Privacy policy

1. Who we are

Zeno Innovations is responsible for processing personal data as described in this privacy policy. It applies to the website zeno-innovations.com, the hosting platform and dashboard at zeno-innovations.com/dashboard, the Zeno CLI and our services (custom websites, bots and apps).

Questions about privacy? Get in touch through [email protected].

2. What data we process and why

2.1 When you visit our website

Every time you visit zeno-innovations.com, or a website hosted on our platform (*.zeno-innovations.com), our server records technical data:

• a shortened IP address (only the first two parts, for example 81.204.x.x);
• the country you're visiting from;
• the type of browser, operating system and device (for example “Chrome · Windows”);
• the requested page, the referring website, the time and the status code.

To count unique visitors we create a daily code (hash) from your IP address and browser. That code changes every day, is not stored together with your IP address and cannot be used to follow you across days.

Why: to keep the website safe and working (for example to stop abuse and attacks) and to produce anonymous visitor statistics. Legal basis: legitimate interest. Retention: statistics for 31 days; a list of the last 2,000 requests per website, with shortened IP addresses, is continuously overwritten.

We do not use Google Analytics, advertising networks or tracking cookies. Fonts are loaded from our own server, so your browser doesn't connect to Google for them.

2.2 When you contact us

Through the contact form we receive your name, email address, your message and the language of the page. The form is sent through Formspree, which forwards the message to us. If you contact us through WhatsApp, Discord or email, we receive the details you send yourself, such as your name, phone number or username.

Why: to answer your question or prepare a quote. Legal basis: legitimate interest, or taking steps at your request before entering into a contract. Retention: until your question has been handled and then up to 12 months, unless you become a client (see 2.4).

2.3 When you create an account on the hosting platform

• Account details: name, email address and password. We only store your password in encrypted form (hashed with scrypt); we can't read it ourselves.
• Signing in with GitHub, Google or Discord: we then receive your name, email address, profile picture and user ID from that service. If you connect GitHub to fetch code, we store the access token encrypted (AES-256-GCM).
• Usage data: your projects, the files and code you upload, deploys, build and server logs, environment variables, settings and your subscription.
• Session: a cookie that remembers you're logged in (see the cookie policy).

Why: to provide the platform, secure your account and email you about your account (for example a confirmation or password link). Legal basis: performance of the contract. Retention: as long as your account exists. If you delete your account, we erase your data and projects within 30 days, except what we're legally required to keep.

2.4 When you're a client or have a subscription

For quotes, invoices and payments we process your name, contact details, (business) address and, if you provide them, your Chamber of Commerce and VAT numbers. Payments for Pro go through Stripe. Stripe processes your payment details; we don't receive full card or account numbers, only whether and when you paid.

Legal basis: performance of the contract and the legal (tax) retention obligation. Retention: 7 years, as Dutch law requires for business records.

2.5 When you order from the shop

When you order from the shop, we receive your name, email address, phone number, shipping address and what you ordered through Stripe. We pass those details to our production partner Printify, which makes the product and ships it to you, and to the carrier that delivers the parcel. Your cart and language choice are only stored in your own browser. Legal basis: performance of the contract and the tax retention obligation. Retention: 7 years for business records.

2.6 Websites that clients host with us

If you host a website or app with us, you are responsible for the personal data your site processes (for example through a form). We are then your processor: we only store and process that data to provide the hosting. The arrangements for this are in article 15 of the terms of service.

3. Who we share data with

We never sell personal data. We only share it with service providers we need to deliver our services:

Our servers are located in the Netherlands. Where data goes to countries outside the European Economic Area, this is based on the EU-US Data Privacy Framework or the European Commission's standard contractual clauses. We also hand over data when the law requires us to.

4. No profiling or automated decisions

We don't build profiles of visitors and don't make decisions about you that are taken by a computer alone. We do automatically check for abuse of the platform, for example with a limit on the number of requests per visitor. An account is never deleted without a human review.

5. Security

We take appropriate measures to protect your data, including: encrypted HTTPS connections, hashed passwords and session codes, encrypted access tokens, user code that runs isolated in its own container, and restricted access to the systems. Notice something that looks like a security problem? Report it through [email protected].

6. Children

Are you under 16? Then you need permission from your parent or guardian to create an account or send us personal data.

7. Your rights

You have the right to access your personal data, have it corrected or deleted, have its processing restricted, object to processing based on legitimate interest, and receive your data in a common format (data portability). If you gave consent, you can withdraw it at any time.

You can delete your account and projects yourself in the dashboard, under Delete account. For other requests, get in touch through [email protected]. We respond within one month. To prevent abuse we may ask you to identify yourself; don't send a copy of your ID unless we ask for it.

Don't agree with how we handle your data? Let us know first, and we'll look for a solution together. You also always have the right to file a complaint with the Dutch Data Protection Authority, the Autoriteit Persoonsgegevens.

8. Changes

We may update this privacy policy, for example when our services change. The date at the top shows when it was last changed. For important changes we'll let account holders know by email or in the dashboard.