Privacy Policy

1. Who We Are

Zenban is operated by Hexagon Intergalactic Ltd, a company registered in Finland. We are the data controller for the personal information collected through Zenban.

Contact: [email protected]

2. Information We Collect

Account Information

When you create an account, we collect your email address and name. If you sign in with Google, we receive basic profile information from Google.

Your Content

We store the boards, lists, and notes you create. This is necessary to provide the service.

Note on sensitive content: Your boards and notes may contain personal reflections or sensitive information. We treat all user content with the same high level of confidentiality. We do not access, review, or analyze the content of your notes except as necessary to provide the service (like AI-powered features you explicitly use).

Voice Recordings

When you use voice input, audio is recorded temporarily and sent to your chosen AI provider (OpenAI or Google) for transcription. We don't store voice recordings after transcription is complete.

AI Features

AI features like task breakdown and board suggestions are powered by our server-side infrastructure. When you use AI features, your content is sent to AI providers (OpenAI or Google) for processing. We handle all the AI configuration - you don't need to set up anything.

Important: Your content is processed for immediate features only. We do NOT use your data to train AI models - neither our own nor those of our AI providers. Our contracts with OpenAI and Google explicitly prohibit them from training on your data.

Technical Information

We collect standard technical information including session tokens (for authentication), push notification tokens (if enabled), and your preferences (theme, language settings).

Payment Information

Payments are processed by Polar.sh using Stripe. We don't store your payment card details. Polar.sh and Stripe handle payment information under their own privacy policies.

3. How We Use Your Information

We use your information to:

• Provide and maintain the Zenban service
• Authenticate you and secure your account
• Process your subscription payments
• Send you important service updates (security alerts, major changes)
• Respond to your support requests

We don't sell your data or use it for advertising. We don't send marketing emails unless you explicitly opt in.

4. Legal Basis for Processing

Under GDPR, we process your data based on:

• Contract: Processing necessary to provide the service you signed up for (account, content storage, payments).
• Legitimate interests: Security monitoring, service improvements, and responding to legal obligations.
• Consent: For optional features like push notifications. You can withdraw consent at any time.

5. Data Storage and Transfers

Our service infrastructure is hosted in the United States (database on NeonDB, application hosting). This means your data is transferred from the EU to the US.

We rely on Standard Contractual Clauses (SCCs) and adequacy decisions where applicable to ensure appropriate safeguards for international data transfers under GDPR.

6. Third-Party Services (Sub-processors)

We use the following third-party services to operate Zenban. All transfers are protected by Standard Contractual Clauses (SCCs) and Data Processing Agreements (DPAs):

Each service has its own privacy policy governing how they handle data. We maintain DPAs with each provider to ensure GDPR compliance.

7. Data Retention

• Account and content: Retained until you delete your account. Upon deletion, your data is permanently removed from our systems within 30 days.
• Voice recordings: Not retained after transcription.
• Payment records: Retained as required by tax and accounting laws (typically 10 years).
• Session tokens: Expire after 7 days of inactivity.

8. Your Rights

Under GDPR, you have the right to:

• Access: Request a copy of your personal data.
• Rectification: Correct inaccurate data.
• Erasure: Delete your account and data.
• Portability: Export your data in JSON format.
• Restriction: Request limited processing in certain circumstances.
• Object: Object to processing based on legitimate interests.

You can delete your account directly from the settings page. For other requests, contact us at [email protected].

You also have the right to lodge a complaint with a supervisory authority. In Finland, this is the Data Protection Ombudsman (tietosuojavaltuutettu).

California Residents

If you're a California resident, you have similar rights under the California Consumer Privacy Act (CCPA), including the right to know, delete, and opt-out of the sale of your personal information. We don't sell personal information. To exercise your rights, contact us at [email protected].

9. Cookies and Local Storage

We use essential cookies for authentication (session tokens). We also use browser local storage to enable offline functionality as part of the Progressive Web App (PWA) features.

Analytics (Optional)

With your consent, we use PostHog for product analytics to understand how users interact with Zenban and improve the product. PostHog collects anonymized usage data such as page views, feature usage, and error reports. This data is processed in the EU and is not used for advertising purposes.

You can manage your analytics preferences at any time through the cookie consent banner that appears when you first visit the site, or by clearing your cookies and localStorage to see the banner again.

We respect your choice. If you decline analytics cookies, no usage data will be collected.

10. Children's Privacy

Zenban is not intended for children under 13. We don't knowingly collect information from children. If you believe a child has provided us with personal information, please contact us.

11. Security

We take reasonable measures to protect your data, including:

• Encryption of data in transit (HTTPS)
• Secure authentication with session management
• Regular security reviews

No system is perfectly secure. If you discover a security issue, please report it to [email protected].

Data Breach Notification

In the unlikely event of a data breach affecting your personal information, we will notify affected users within 72 hours of becoming aware of the breach, as required by GDPR. We will also notify the Finnish Data Protection Ombudsman (tietosuojavaltuutettu) within the same timeframe.

12. Changes to This Policy

We may update this privacy policy from time to time. We'll notify you of significant changes via email or through the app. The "Last updated" date at the top shows when the policy was last revised.

13. Contact Us

If you have questions about this privacy policy or how we handle your data, contact us at:

[email protected]

Hexagon Intergalactic Ltd
Finland