Privacy Policy

Depending on the form, we receive your name, work email, phone number, role, organization and the details of your enquiry, partnership application or product interest. Separately submitted assessment or qualification details are also collected. Please do not include passwords, access credentials or unnecessary personal information.

A separate testing-authorization form records the signer, organization, authorized scope, accepted wording, signature, time and technical evidence of acceptance, including an IP address. Sending an enquiry or partner application does not authorize security testing or create a service agreement.

Hosting and security services process request information such as IP address, browser information and request time. Our form controls use verification records and counters to prevent abuse and duplicate submissions. These technical identifiers are not necessarily anonymous.

Providing an enquiry is voluntary. Required fields identify information needed to process that request; without it, we may be unable to accept the form or respond. The public self-check does not submit its answers or result, including when you follow its contact link.

We use request details to review and route enquiries, discuss the requested service or partnership and respond. We use necessary technical records to protect forms, keep delivery reliable and investigate problems. Authorization evidence records the scope and acceptance of authorized work.

Where the applicable law permits these grounds:

• Business correspondence, necessary security checks and evidence of authorization serve our legitimate interests in responding to organizations, protecting the website and demonstrating the scope of agreed work, subject to your rights and reasonable expectations.
• When you personally request or enter a contract, information necessary to take those requested steps or perform that contract is processed for that purpose. This does not automatically apply to a contact acting for a separate company.
• Information required by a specific legal obligation is processed to meet that obligation. Optional marketing relies on a separate choice or consent where required.
• Limited, cookie-free website analytics serves our legitimate interest in understanding which pages, links and campaigns lead organizations to contact us and in improving the website. We have weighed this interest against visitors' rights and limited the analytics accordingly: it uses no cookies, persistent identifiers, profiles or session recording, IP addresses are discarded, and a Do Not Track signal switches it off.

Sending an enquiry is not marketing consent. We do not sell website enquiry information or share it for advertising.

Relevant staff use company-managed accounts to handle requests and follow-up. Our service providers support hosting, form protection, website analytics, internal intake, email, collaboration and backups:

• Netlify: website hosting and request delivery.
• Cloudflare Turnstile: protection against automated form abuse.
• OVH: hosting for our internal intake system.
• Resend and Google Workspace: email and related office collaboration.
• DigitalOcean Spaces: encrypted database backups.
• PostHog: limited website analytics, hosted in the European Union.

Cloudflare also processes Turnstile signals to improve its bot detection, under its own Turnstile Privacy Addendum. When a request becomes a customer engagement, relevant details may pass to the systems used to deliver that service. We may disclose necessary information when an applicable legal requirement requires it.

Zeroday operates remotely. Authorized staff in Saudi Arabia, Türkiye, Lebanon, Indonesia and Egypt access enquiries, customer details or agreements through company-managed accounts. Our providers may also process information in other countries. Information is not confined to the country from which you contact us.

Contact privacy@zeroday.group for information about the processing locations and transfer arrangements relevant to your request, including any safeguards applicable to it.

We use PostHog Cloud EU, an analytics service hosted in the European Union, to understand which pages, links and campaigns lead visitors to contact us. It runs without cookies, persistent identifiers, visitor profiles or session recording: each page load gets a new random identifier that is kept only in the page's memory. We do not use advertising tracking.

Analytics records only these events: pages viewed; a form being started, sent and accepted, including whether a self-check report was requested; and clicks on main buttons, service links and links to other websites. Each event can include the page address without its query string, the page language, the kind of form and enquiry topic, the button clicked and, for a link to another website, that site's name only. It never includes what you type into a form, your self-check answers or result, or your contact details.

Events also carry the name of the site that referred you (not the full address of the page you came from) and the page where your visit began. If the link you followed carried campaign tags (utm_source, utm_medium, utm_campaign, utm_content and utm_term), the website reads them, removes them from the address bar and attaches them to these events as well. Campaign tags describe the channel, campaign or message that carried the link; we do not use them to identify individual recipients.

PostHog also receives the technical information sent with any web request, such as your IP address, and the browser, device type, screen size, language and time zone your browser reports. The website asks PostHog not to look up a location from your IP address, and our PostHog project is set to discard IP addresses rather than store them. If your browser sends a Do Not Track signal, the website sends no analytics events and does not store campaign tags. Hosting and security request processing still occurs, and Cloudflare Turnstile checks forms for automated abuse.

We use browser session storage for functions such as access to a submission receipt, your motion preference and optional qualification flow state, and to keep the campaign tags, referring site and the page where your visit began until the browser session ends. Storage duration depends on your browser session and restoration settings. You can clear it through your browser; blocking necessary storage or security checks may prevent a form or receipt from working.

Retention depends on the record and its purpose: whether a request or relationship remains active, whether follow-up is needed, applicable agreement deadlines, and any specific legal, accounting or dispute-related need. Enquiries, authorization evidence, delivery records, email and backups may therefore have different retention needs.

Deletion of intake records currently requires review, and there is no automatic deletion deadline for enquiry records or mailboxes. Two automatic limits apply on the servers we operate: encrypted database backups are deleted within 35 days unless a specific recorded hold applies to them, and the servers' operating-system logs (the system journal and syslog) are kept for no more than 90 days. A closed or archived request is not necessarily erased; removing a primary record does not immediately remove every backup or provider-held copy.

PostHog keeps website analytics events for one year from when they are recorded. Expired events are then removed under PostHog's deletion process, and we do not export analytics events to other systems.

Existing commitments in accepted service agreements and testing authorizations continue to apply. This notice does not extend those deadlines or create an exception for backups. Contact privacy@zeroday.group for information about a particular record or to request deletion; we will explain any applicable requirement that prevents us from fulfilling the request.

Depending on the applicable law, you may request access, correction, deletion, restriction or a portable copy of your information. Where processing relies on consent, you may withdraw it without affecting processing already carried out.

Your right to object

Where applicable, you may object to processing based on legitimate interests, including the business correspondence, security and website analytics purposes described above. To stop analytics in your browser, turn on its Do Not Track setting. You may also object to direct marketing. Send your request to privacy@zeroday.group.

We may ask for proportionate information to verify your identity and locate the relevant records. We respond within the time required by applicable law and explain any conditions or exceptions affecting your request. You may complain to the competent data-protection authority where that right applies.

We use HTTPS, access controls and encrypted website delivery storage to help protect information. No system can guarantee complete security. Our website is intended for businesses and adult users; contact privacy@zeroday.group if you believe a child has provided personal information.

We will update this notice when relevant practices change and show the updated date above. This notice covers this website; separately operated websites, including the Academy, have their own applicable notices.