Legal

Privacy Policy

What we collect, why, who we share it with and the choices you have, across every Zactonz website, product and API.

Effective 15 September 2026. Supersedes all earlier versions.

  1. Who is responsible and what this covers
  2. Data we collect
  3. How we use data and our legal bases
  4. Google services and Limited Use
  5. APIs and data you send through them
  6. Cookies and analytics
  7. Who we share data with
  8. International transfers
  9. Retention and deletion
  10. Security
  11. Your rights and choices
  12. Children
  13. Client engagements
  14. Changes to this policy
  15. Contact

1. Who is responsible and what this covers

Zactonz Technologies ("Zactonz", "we", "us"), a sole proprietorship registered in Pakistan at 2-C1, Block C, Elite Town, Lahore, Punjab 53100, is the controller of personal data processed through:

  • zactonz.com, developers.zactonz.com and other zactonz.com subdomains;
  • the products we develop and host: VitalLens, Zotiba, ClassTools24 and NeuronFlow (the "Products");
  • the APIs hosted under api.zactonz.com (the "APIs");
  • the WordPress, cPanel and WHM extensions we publish, to the extent they send data to us; and
  • our client work, contact forms and business correspondence.

Where you use a Product to process other people's data, for example contacts you import into Zotiba or records that flow through a NeuronFlow workflow, you are the controller of that data and we process it on your behalf under our Terms of Use. This policy also explains how we handle that data as a processor.

2. Data we collect

Data you give us. Account details (name, email address, password hash, organisation), billing details (billing name, address, tax number; card details go directly to our payment processor), profile and card content you enter in Zotiba (name, title, photo, phone numbers, email addresses, postal address, links, files, audio and video), monitoring targets and settings in VitalLens, workflow definitions and the data submitted to them in NeuronFlow, text and files you submit to ClassTools24 tools, and anything you send us through contact or quote forms, email or support.

Data collected automatically. Server logs (IP address, timestamps, request URL, user agent, referrer, response status), device and browser information, approximate location derived from IP address, usage events within a Product (pages viewed, features used, errors), and, for published Zotiba cards, view and tap counts as described in section 3.

Data from third parties. Data you choose to import from a connected service, such as Google Calendar events and Google Contacts (section 4); payment status from our payment processor; and information a client gives us about its users in the course of an engagement.

We do not intentionally collect special categories of personal data (such as health, religion or biometric data) and ask you not to submit them.

3. How we use data and our legal bases

We use personal data to:

  • provide the Services you request, including creating and hosting your account, cards, workflows and monitors, syncing data you asked us to sync, and processing API requests (performance of a contract);
  • bill and manage subscriptions, including sending receipts and renewal notices (contract; legal obligation for tax records);
  • report card analytics to you: when someone opens a published Zotiba card we record a view, the link tapped, the platform it was opened from and whether the contact was saved, and show these totals to the card owner. We do not show the card owner the visitor's identity (legitimate interest of the card owner in knowing how the card is used);
  • keep the Services secure and reliable, including detecting abuse, rate limiting, debugging and monitoring uptime (legitimate interest);
  • communicate with you about the Services, including support replies, security notices and material changes (contract and legitimate interest);
  • improve the Services using aggregated or de-identified usage data (legitimate interest);
  • send marketing about our own products only where you have opted in or where permitted for existing customers, always with an unsubscribe link (consent or legitimate interest); and
  • comply with law, respond to lawful requests and enforce our Terms (legal obligation and legitimate interest).

We do not sell personal data, and we do not use it to serve third-party advertising. Automated decisions with legal or similarly significant effects are not made about you.

4. Google services and Limited Use

Zotiba offers optional features that use Google APIs. Each is off until you turn it on, and you choose the Google account and the permissions (scopes) you grant on Google's consent screen.

  • Google Calendar. When you enable meeting sync, Zotiba reads the calendars and events you select in order to show your availability and to create, update and cancel meeting events booked through your card. We store event identifiers, titles, times and attendee addresses for the meetings Zotiba manages, and nothing from other events beyond what is needed to compute availability.
  • Google Contacts. When you import contacts, Zotiba reads the contacts you pick so that you can save them to your Zotiba address book or share your card with them. Only the contacts you select are stored.
  • Google Maps. Addresses on cards are rendered with Google Maps. Google receives the address and the viewer's IP address to draw the map, under the Google Privacy Policy.
  • Google reCAPTCHA. Forms are protected by reCAPTCHA, which sends hardware, software and interaction signals to Google to distinguish people from bots. Its use is subject to the Google Privacy Policy and Terms of Service.

Zotiba's use and transfer to any other app of information received from Google APIs will adhere to the Google API Services User Data Policy, including the Limited Use requirements. In particular, we:

  • use Google user data only to provide or improve the user-facing feature you enabled;
  • do not transfer it to others except as necessary to provide that feature, to comply with law, or as part of a merger or acquisition with prior notice to you;
  • do not use it for advertising, and do not sell it; and
  • do not allow humans to read it unless you have given explicit permission for specific data, it is necessary for security purposes such as investigating abuse, it is required to comply with law, or it has been aggregated and anonymised for internal operations.

Google user data is not used to develop, improve or train generalised artificial-intelligence or machine-learning models. You can disconnect Google at any time in Zotiba's settings or at myaccount.google.com/permissions; on disconnection we delete the stored Google access and refresh tokens immediately and the synced calendar and contact data within 30 days, except for meeting records you have chosen to keep in your own Zotiba account.

5. APIs and data you send through them

Requests to the APIs, such as content to encode in a QR code, a URL or HTML to screenshot, text to translate or an email address to verify, are processed to return the result and are not used for any other purpose. Generated files (for example QR images and screenshots) are stored so that the returned URL works and are removed on a rolling basis as documented for each API. Request logs containing IP address, key identifier, endpoint and status are kept for security, billing and rate limiting for up to 90 days. If you send personal data through an API, you are responsible for having a lawful basis to do so.

6. Cookies and analytics

We use strictly necessary cookies and local storage for sessions, sign-in, security (including reCAPTCHA) and remembering preferences. Where a site uses analytics to understand aggregate traffic, it runs with IP anonymisation and without cross-site advertising identifiers, and where local law requires consent we ask for it before setting non-essential cookies. You can block or delete cookies in your browser; necessary cookies cannot be disabled without affecting sign-in.

7. Who we share data with

  • Service providers acting under contract and on our instructions: hosting and infrastructure, payment processing, email delivery, error monitoring, analytics and the Google services described in section 4. They may use the data only to provide their service to us.
  • People you share with. Content you publish or send, such as a public card, a shared file, a meeting invitation or a workflow notification, is disclosed to the recipients you choose.
  • Authorities and legal process where required by law or to protect the rights, safety or property of Zactonz, our users or the public.
  • A successor in a merger, sale or transfer of the business, with notice to you before your data becomes subject to a different policy.

We never sell personal data and never share it with third parties for their own marketing.

8. International transfers

We operate from Pakistan and use hosting and service providers that may store or process data in other countries, including the United States and the European Union. Where data is transferred out of the country where it was collected, we rely on the provider's contractual commitments and safeguards recognised under applicable law, such as standard contractual clauses, and on the transfer being necessary to perform the service you requested.

9. Retention and deletion

We keep personal data only as long as needed for the purposes above. In general: account and content data for the life of your account and up to 30 days after closure, after which it is deleted from live systems; encrypted backups are overwritten within a further 30 days; billing records for as long as tax and accounting law requires; server and API request logs up to 90 days; contact-form and support correspondence up to two years after the last exchange; and Google data as described in section 4. Aggregated data that no longer identifies anyone may be kept.

10. Security

We protect data with encryption in transit (TLS), encryption of stored credentials and tokens, access limited to what operating the Services requires, separated environments, monitored uptime, and regular software updates. No system is perfectly secure; if we learn of a breach affecting your data we will notify you and any authority as the law requires.

11. Your rights and choices

Depending on where you live, you may have the right to access, correct, delete, restrict or object to our processing of your personal data, to receive a copy in a portable format, and to withdraw consent at any time without affecting earlier processing. Residents of the European Economic Area and the United Kingdom have these rights under the GDPR and UK GDPR; California residents have equivalent rights under the CCPA, including the right to know and delete and the right not to be discriminated against for exercising them. We do not "sell" or "share" personal information as those terms are defined in the CCPA.

You can exercise most rights directly: edit or delete your profile, cards, monitors and workflows in the Product, export your data from account settings where offered, disconnect Google in settings, and unsubscribe from marketing using the link in any message. For anything else, contact us at the address in section 15; we respond within 30 days and may ask you to verify your identity. You may also complain to your local data-protection authority.

12. Children

Our Services are not directed at children under 13, and we do not knowingly collect personal data from them. Accounts require the user to be at least 18. ClassTools24 tools that need no account may be used in classrooms under a teacher's or parent's supervision; text submitted to those tools is processed to produce the result and is not linked to a child's identity. If you believe a child has given us personal data, contact us and we will delete it.

13. Client engagements

When we build or maintain software for a client, we process the client's and its users' data only on the client's documented instructions, under the applicable contract and, where required, a data-processing agreement. We keep such data only for the duration of the engagement and any agreed support period, return or delete it on request, and apply the security measures in section 10.

14. Changes to this policy

We may update this policy. The current version is always at zactonz.com/privacy with its effective date. For material changes we give at least 14 days' notice by email or in the affected Service before they take effect.

15. Contact

Privacy questions and requests: info@zactonz.com. Post: Zactonz Technologies, 2-C1, Block C, Elite Town, Lahore, Punjab 53100, Pakistan. Telephone +92 (42) 35 493 422.