Privacy Policy

This website is deliberately simple. It sets no cookies, runs no analytics or advertising scripts, embeds no third-party content, and has no user accounts. The only form is the voluntary waitlist for our products (section 7).

The only personal data processed is what is technically required to deliver the pages to your browser, plus whatever you choose to send us by e-mail or enter in a waitlist. The sections below explain this in detail.

The controller responsible for data processing on this website within the meaning of Art. 4(7) GDPR is:

E-mail for privacy matters and data requests: privacy@zyloft.eu

We are not legally required to appoint a data protection officer. For any question about this policy or your data, please write to the address above.

This website is hosted by Hostinger International Ltd., 61 Lordou Vironos Street, 6023 Larnaca, Cyprus. The servers used for this website are located in: Frankfurt, Germany (EU). The provider processes data on our behalf under a data processing agreement pursuant to Art. 28 GDPR.

Whenever you open a page, your browser automatically transmits information that the hosting provider records in server log files:

• IP address of the requesting device
• date and time of the request
• the page or file requested and the referring page (referrer)
• HTTP status code and amount of data transferred
• browser type and version, and operating system

Purpose: delivering the website, keeping it stable and secure, and detecting and defending against attacks and misuse.

Legal basis: Art. 6(1)(f) GDPR. Our legitimate interest is the secure and reliable operation of this website.

Retention: log data is deleted after 30 days, unless it must be kept longer to investigate a specific security incident. We do not combine it with other data or use it to identify individual visitors.

You are not obliged to provide this data, but the website cannot be delivered to your browser without it.

We do not use cookies or comparable technologies such as local storage identifiers, tracking pixels or fingerprinting. We do not use analytics tools, advertising networks or social media plug-ins. No usage profiles are created, which is why you will not see a cookie banner here.

The fonts, scripts and style sheets used on this website are served from our own hosting. Nothing is loaded from Google Fonts or other third-party servers, so opening a page does not transmit your IP address to any third party.

If you write to support@zyloft.eu or privacy@zyloft.eu, we process your e-mail address, your name if you provide it, and the content of your message in order to handle your request.

Legal basis: Art. 6(1)(b) GDPR where your message relates to a contract or to steps prior to entering into one, for example a question about a purchase or support for an app you use. In all other cases the basis is Art. 6(1)(f) GDPR, our legitimate interest in answering enquiries.

Retention: we delete your enquiry once it has been fully resolved, unless statutory retention periods under German commercial and tax law (§ 257 HGB, § 147 AO) require us to keep the correspondence for longer.

Our mailboxes are operated by an e-mail hosting provider that processes messages on our behalf (Art. 28 GDPR). Please remember that unencrypted e-mail is not a secure channel for sensitive information.

For products that have not been released yet, such as Zyloft Desk, you can join a waitlist. We then process your email address to inform you about the product's launch and any early-bird offer. Optionally, you can tell us which group you belong to (“I am…”) and what annoys you about your current solution. We use this information to gauge demand and improve the product.

Double opt-in

After submitting the form, you receive an email with a confirmation link. You are only added to the waitlist after clicking it. To be able to prove your consent, we store the time of sign-up and confirmation and the IP address used.

Legal basis

Processing is based on your consent under Art. 6(1)(a) GDPR. Storing proof of consent is based on our legitimate interest in being able to demonstrate it under Art. 6(1)(f) GDPR.

No external newsletter services

We run the waitlists ourselves. Your details are stored in a database on our hosting provider's server (see section 3), and we send the confirmation emails from our own mailbox (see section 6). We do not use any newsletter or marketing service. The emails contain no tracking pixels and no links that track opens or clicks.

To prevent abuse, we store a non-reversible hash of your IP address for at most 24 hours and use it to limit the number of sign-ups per hour. The legal basis is our legitimate interest in secure operation under Art. 6(1)(f) GDPR.

Retention

We store your data until you withdraw your consent or the waitlist has served its purpose, but no later than 6 months after the product's market launch. Unconfirmed sign-ups are deleted after 30 days at the latest.

Withdrawal

You can withdraw your consent at any time with effect for the future. Use the unsubscribe link in every email or write to privacy@zyloft.eu. Withdrawal does not affect the lawfulness of processing carried out before it.

This website links to external services such as the Apple App Store, Google Play and, for writing to us, the webmail services Gmail and Outlook.com. No data is transferred to these providers until you click a link. Once you do, the provider of the linked site is responsible for the processing and its own privacy policy applies.

This policy covers the website zyloft.eu and the waitlists only. Each Zyloft app and software product comes with its own privacy notice, available inside the product or on its store listing, describing exactly what it processes.

Purchases through Polar

We sell our software and code templates through Polar Software, Inc., 3500 S Dupont Hwy, Dover, Delaware 19901-6041, United States. Polar acts as reseller (Merchant of Record): the purchase contract is concluded with Polar, which handles payment, VAT, invoicing and any refunds. Polar is the controller for this processing, and Polar's privacy policy applies. Data may be transferred to the USA in the process.

The buy button takes you to Polar's checkout page; no Polar script is loaded on our website. To receive a template, you connect your GitHub account at Polar so Polar can invite you to our private repository, which tells us your GitHub username. After a purchase we also see order details (email address, product, amount, order number) so we can assign licences, provide support, handle refunds and keep our books. The legal basis is Art. 6(1)(b) GDPR (performance of a contract) and Art. 6(1)(c) GDPR (statutory retention under § 147 AO). We keep this data for the statutory retention periods.

We do not sell your personal data and we do not share it with third parties for their own purposes. The only recipients are the service providers named in this policy (web hosting and e-mail hosting, also for the waitlists), who act on our instructions.

If personal data is processed outside the European Union or the European Economic Area, this happens only where an adequacy decision of the European Commission exists or appropriate safeguards such as standard contractual clauses are in place (Art. 44 et seq. GDPR).

Under the GDPR you have the right to:

• access the personal data we hold about you (Art. 15)
• have inaccurate data rectified (Art. 16)
• have your data erased (Art. 17)
• restrict its processing (Art. 18)
• receive your data in a portable format (data portability, Art. 20)
• withdraw consent at any time with effect for the future, where processing is based on consent (Art. 7(3))

Right to object (Art. 21 GDPR)

Where we process your data on the basis of legitimate interests (Art. 6(1)(f) GDPR), you may object at any time on grounds relating to your particular situation. We will then stop the processing unless we can demonstrate compelling legitimate grounds that override your interests, or the processing serves to establish, exercise or defend legal claims.

How to exercise your rights

Send an e-mail to privacy@zyloft.eu. We respond without undue delay and at the latest within one month (Art. 12(3) GDPR). Exercising your rights is free of charge.

Right to lodge a complaint (Art. 77 GDPR)

You may complain to a data protection supervisory authority, in particular in the EU member state where you live or work. The authority responsible for us is:

This website is delivered exclusively over an encrypted HTTPS (TLS) connection, which protects the data exchanged between your browser and our server from being read by third parties.

We do not use automated decision-making or profiling within the meaning of Art. 22 GDPR.

We update this policy whenever the website or the legal situation changes. The current version is always available on this page. Our provider details can be found in the legal notice.