Skip to content
ZEPREACH

Privacy Policy

Last updated: November 4, 2026

This policy explains what personal data ZEPREACH ("we", "us") collects, why we collect it, who we share it with and the rights you have. It applies to this website, the free AI visibility score, client accounts and dashboards, and our paid services. We are the controller of this data. For any privacy question or request, email [email protected].

1. What we collect

  • Audit data. The website address you submit to the AI visibility score and the results we generate. If you unlock the full report, your name and email.
  • Contact data. What you send through the contact form: name, email, company, website, market, budget and message.
  • Account data. For clients: name, email, company, country, phone, a hashed password, plan and billing status.
  • Payment data. Payments are handled by Stripe or Razorpay. We receive the payment status, amount, currency, a transaction reference and limited card details such as brand and last four digits. We never receive or store your full card number, CVV, UPI PIN or banking password.
  • Access credentials. Logins you choose to share in the dashboard vault. These are encrypted at rest with AES-256-GCM and visible only to the staff assigned to your project. Every time staff reveal a credential it is logged.
  • Project data. Information about your website, content, competitors and results that we create or receive while delivering the service.
  • Usage and analytics data. Pages viewed, links and buttons clicked, time on page, scroll depth, referring site, campaign tags, device, browser and operating system, and an approximate country derived from your IP address. See our Cookie Policy.
  • Security data. A one-way hash of your IP address for rate limiting and abuse prevention. We do not store raw IP addresses for analytics.

2. Why we use it, and our lawful bases

  • To run the audit you requested and show your report (performance of a request you made).
  • To reply to enquiries and send the information you asked for (legitimate interests, or steps before a contract).
  • To create your account, deliver your plan, process payments and refunds and provide support (performance of a contract).
  • To understand how the website is used and improve it (legitimate interests, or consent where required by local law).
  • To keep the service secure, prevent fraud and abuse, and enforce our Terms (legitimate interests).
  • To keep accounting and tax records and meet other legal obligations (legal obligation).

We do not use your data for automated decisions that have legal or similarly significant effects on you, and we do not sell or rent personal data.

3. Who we share it with

Only with service providers who help us run the business, under contracts that protect your data:

  • Hosting and database: Railway.
  • Payments: Stripe and Razorpay, who process your payment under their own privacy policies.
  • AI analysis: OpenAI or xAI, which receive the public text of the web page you audit and generated test questions. We do not send them your name, email or account details.
  • Email and communication tools we use to reply to you.
  • Authorities or advisers where required by law, or to protect our rights.

If ZEPREACH is involved in a merger or sale, data may transfer to the new owner under the same protections.

4. International transfers

We work remotely and our providers may process data outside your country, including in the United States, the European Union and India. Where the law requires it, transfers are protected by standard contractual clauses or equivalent safeguards.

5. How long we keep it

  • Audit and contact data: up to 24 months after your last interaction.
  • Analytics data: up to 25 months.
  • Client and payment records: for the engagement plus the period required by tax and accounting law (typically up to 8 years).
  • Shared credentials: deleted when you remove them, or when the engagement ends.

6. Security

Data is sent over HTTPS, passwords are hashed with bcrypt, sensitive values are encrypted at rest, staff access is limited to those who need it, and payments are handled by PCI DSS compliant providers. No system is perfectly secure, but we will notify you and the relevant authorities of a breach where the law requires.

7. Your rights

Depending on where you live, including under the EU and UK GDPR, India's Digital Personal Data Protection Act, California privacy law and the UAE PDPL, you can ask to:

  • access the personal data we hold about you and get a copy;
  • correct inaccurate data;
  • delete your data, where we do not need to keep it by law;
  • object to or restrict certain uses, including analytics;
  • receive your data in a portable format;
  • withdraw consent where we rely on it;
  • appoint someone to exercise these rights for you.

Email [email protected] from the address linked to your data. We respond within 30 days and will not treat you differently for using your rights. You can also complain to your local data protection authority.

8. Children

Our services are for businesses and are not directed at anyone under 18. We do not knowingly collect children's data. If you think a child has given us data, email us and we will delete it.

9. Marketing

We only send marketing emails if you have asked for them or are a client, and every message includes a way to opt out. Service emails about your account or payments are not marketing.

10. Changes

We will update this page when our practices change and revise the date at the top. Material changes affecting clients will be emailed.

11. Contact

Privacy questions and requests: [email protected]