Privacy Notice

DRAFT — pending legal review. This text is a structural placeholder for the US privacy notice, including the California (CCPA/CPRA) section. It has not been written or approved by counsel and must not be relied on until it is replaced by a reviewed version.

1. Who we are

This notice describes how [contracting entity — to be confirmed by counsel] handles personal information in the ZETT United States region. For workspace content, we act as a service provider to the business that owns the workspace.

2. Information we collect

• Account information: name, e-mail address, password hash, sign-in sessions, preferences.
• Workspace information: members, clients and contacts, leads, quotes, contracts, projects, calendar, invoices.
• Files and media: uploads, video deliverables, review comments.
• Usage information: product analytics events, unless you opt out.
• Technical information: server logs and traces with truncated IP addresses; browser error reports without identifiers.
• Records: which versions of our terms you accepted and your privacy choices.

3. How we use it

To provide and secure the service, support you, bill subscriptions, improve the product, and meet legal obligations. [Counsel: complete purposes.]

4. How we share it

With service providers that run the service for us:

We do not sell personal information. [Counsel: confirm whether product analytics could be "sharing" for cross-context behavioral advertising; we do not use it that way.]

5. Cookies and tracking

See the Cookies and tracking notice. You can opt out of analytics from "Your privacy choices" in the footer, and we honor Global Privacy Control.

6. Retention

[Counsel: retention periods per category.]

7. Security

We use access controls, row-level security, encrypted transport and encrypted storage of secrets. No system is perfectly secure.

8. California privacy rights (CCPA/CPRA)

8.1 Categories collected

[Counsel: map section 2 to the CCPA categories, sources, purposes and retention.]

8.2 Sale and sharing

We do not sell personal information. To opt out of any sharing, use "Your privacy choices" (Do Not Sell or Share My Personal Information). A Global Privacy Control signal is treated as an opt-out.

8.3 Your rights

California residents can request to know, delete and correct personal information, and to limit the use of sensitive personal information where applicable, without discrimination. [Counsel: verification process, authorized agents, response times.]

8.4 How to submit a request

[Counsel: request methods; the contact details on the Support page in the meantime.]

9. Other US state privacy laws

[Counsel: notices for other states as advised.]

10. Children

The service is not directed to children. [Counsel: age threshold.]

11. Changes

We version this notice and will ask you to review material changes.