Snapshot 16573
Normalized text
Scripts and page chrome removed; this is what change detection compares.
Refresh to view the mobile styleguide 📱
Privacy Policy
What personal information we collect and why
We take your privacy seriously. This policy explains what personal data we collect, why we collect it, how we use and share it, and what rights you have. Please read it carefully.
Who we are: ZERO HEIGHT LIMITED ("zeroheight", "we", "us"). You can contact us at support@zeroheight.com.
Scope of this policy: This policy applies to the platform owned and operated by zeroheight. Depending on where you live, we may be subject to the UK GDPR and Data Protection Act 2018, the EU GDPR (for individuals in the EEA), and applicable US state privacy laws including the CCPA/CPRA, to the extent they apply.
1. Our role: controller and processor
Under the GDPR, zeroheight may act as either a data controller (where we determine the purpose and means of processing) or a data processor (where we process data on behalf of another controller).
When you use our platform and make decisions about personal data processed on it (e.g. uploading content), you are the controller and zeroheight is the processor. In other cases - such as managing contact information for marketing or monitoring platform usage - zeroheight is the controller.
2. What data we collect
Category
Examples
Contact information
Name, email address
Financial information
Billing details for plan purchases (card data is held by Stripe, not us)
Account information
Name, email, IP address (used for authentication and session security)
Usage information
Features used, links clicked, time spent
User content
Images, comments and other content you upload or post
Log data
IP address, device/browser type, OS, pages visited, search terms, frequency of use
Marketing preferences
Name, email, and your communication preferences
Sensitive data: We do not intend to collect special category data (UK/EU GDPR) or sensitive personal information (US state laws). If you include sensitive data in user content, you do so at your own discretion - please avoid doing so.
3. How we collect data
We collect data when you create an account, log in, interact with the platform, upload content, or communicate with us. Collection methods include:
Cookies: Small text files saved by your browser when you use our service.
Unique identifiers: Cookies, email addresses, or pseudonymised customer IDs used to understand individual usage patterns.
Web beacons and tracking tools: Used by us and our third-party service providers to understand how you use the platform and to deliver relevant content. Web beacons in emails help us track engagement such as link clicks.
We will ask for your consent to place non-essential cookies and similar technologies where legally required. For more detail, see our cookie policy.
4. How we use data
We use personal data to:
Provide, operate and improve our platform and services
Authenticate users and maintain security
Respond to support queries and communicate with you
Personalise your experience and target relevant offers
Facilitate marketing, surveys and promotions
Detect and prevent fraud and unauthorised activity
Comply with legal obligations
Publish anonymised, aggregated usage statistics (these are not personal data)
We do not sell personal information. We do not share personal information for cross-context behavioural advertising in a way that constitutes a "sale" or "share" under the CCPA/CPRA. If this changes, we will update this policy and provide the required opt-out mechanisms.
Statistical data derived from personal data, where it cannot identify any individual, is not subject to this policy.
4A. AI processing
We may use AI-enabled tools to support our services - for example, to help summarise support requests, improve search, detect spam, or assist internal productivity. Where AI processing involves personal data:
We use personal data only for the purposes described in this policy (purpose limitation).
We process the minimum necessary data and use aggregated or de-identified data where possible (data minimisation).
We do not use customer content - including any personal data within it - to train public, general-purpose AI models.
Third-party AI vendors act as processors under contract, with appropriate safeguards in place.
AI outputs may be reviewed by authorised personnel for support, security or quality purposes.
5. Legal basis for processing (UK/EU GDPR)
We process personal data only where we have a lawful basis to do so:
Contractual necessity - to provide our services to you. This covers: contact information, account information, financial information, usage information, and user content. Without this data, we cannot provide the service.
Legitimate interests - where processing furthers our legitimate business interests without overriding your rights. This covers: all of the above, plus log data. Examples include improving our platform, marketing, customer support, fraud prevention, and corporate compliance. We carry out a balancing assessment before relying on this basis.
Consent - in some cases, such as certain cookies or marketing. We will make this clear at the point of collection. You may withdraw consent at any time by contacting support@zeroheight.com.
Legal obligation - where we are required to process data to comply with a legal or regulatory requirement.
For US residents: US state privacy laws do not use "lawful bases" terminology. The purposes for which we process personal information are described in Sections 4 and 8. We provide rights and choices as described in Section 7.
6. Opting out
Cookies and tracking tools: You can manage or block these through your browser settings (Tools > Internet Options or similar). You may be able to delete existing cookies, disable future cookies, or set a warning before cookies are placed.
Do Not Track: We do not currently respond to DNT signals from browsers.
Marketing emails: Click the unsubscribe link in any marketing email. Note that you cannot opt out of service-essential emails (e.g. billing, security, legal notices).
Withdrawing consent / objecting to processing: Contact support@zeroheight.com at any time. Withdrawing consent does not affect the lawfulness of processing carried out before withdrawal.
Additional opt-outs (US residents and others): Where required by applicable law, you may have the right to opt out of targeted advertising, profiling, or certain analytics. Please use available cookie controls or contact us at support@zeroheight.com.
7. Your rights
UK and EU rights (exercisable free of charge):
Access - request a copy of your personal data
Rectification - ask us to correct inaccurate data
Erasure - ask us to delete your data (in certain circumstances)
Restriction - ask us to restrict processing (e.g. while accuracy is disputed)
Portability - receive your data in a structured, machine-readable format (in certain circumstances)
Object - object to processing for direct marketing (including profiling) at any time, or to other processing based on legitimate interests
No automated decisions - not to be subject to solely automated decisions that significantly affect you
Withdraw consent - at any time, without affecting prior lawful processing
We respond to requests within one month. Complex or multiple requests may take up to three months; we will notify you if this applies. We may need to verify your identity before acting on a request. Requests that are manifestly unfounded or excessive may be subject to a reasonable fee or refused.
Additional rights for US residents (where applicable under state law):
Right to know/access the personal information we collect, use and disclose about you
Right to delete personal information (subject to exceptions)
Right to correct inaccurate personal information
Right to a portable copy of your personal information
Right to opt out of targeted advertising and, where applicable, the "sale" or "sharing" of personal information (as noted above, we do not engage in these practices)
Right not to be discriminated against for exercising your rights
Right to appeal a denial of your request - email support@zeroheight.com with "Privacy Appeal" in the subject line
To exercise any of these rights, contact support@zeroheight.com. We may need to verify your identity or, where applicable, the authority of any agent acting on your behalf.
8. How and when we disclose data
Within our group: We may share personal data with other members of the zeroheight group.
Service providers: We share data with third parties who provide services on our behalf (e.g. payment processing, hosting, marketing, support, data enrichment, database management). These parties are engaged under contract and may only process personal data to provide services to us, not for their own purposes.
Professional advisors: Lawyers, accountants and auditors, where necessary for the operation of our business.
Legal and regulatory authorities: Courts, tribunals, law enforcement and regulators, where required by law or to protect our legal rights, prevent fraud or ensure the security of our services.
Corporate transactions: In connection with a merger, acquisition, asset sale or restructuring. Data may be shared with the counterparty and their advisors; recipients will be bound by confidentiality obligations. Where possible, data will be anonymised.
We will never sell your personal data to any third party.
A list of our third-party software tools is available on our website.
9. International transfers
Where we transfer personal data internationally, we use appropriate safeguards as required by applicable law.
Transfers from the UK: We rely on one or more of the following:
UK adequacy regulations - for countries the UK government has found to provide adequate protection, including EEA countries. For transfers to certified US organisations, we may rely on the UK Extension to the EU-US Data Privacy Framework (UK-US Data Bridge), in force since 12 October 2023.
International Data Transfer Agreement (IDTA) - the ICO-approved transfer mechanism for UK restricted transfers where no adequacy regulation applies.
EU Standard Contractual Clauses with the UK Addendum - where contracts already use the 2021 EU SCCs, we attach the ICO's UK Addendum to make them valid for UK transfers.
Where we use the IDTA or UK Addendum, we carry out a Transfer Risk Assessment (TRA) as required by the ICO.
Transfers from the EEA: We rely on one or more of the following:
EU adequacy decisions - for countries the European Commission has found adequate under Article 45 EU GDPR. For US transfers, this includes the EU-US Data Privacy Framework, adopted in July 2023.
Standard Contractual Clauses (SCCs) - the 2021 EU Commission SCCs, where no adequacy decision applies.
In all cases, if we can no longer rely on a given mechanism, we will suspend the relevant transfer until an alternative lawful basis is in place, and update this policy accordingly.
A list of countries to which we transfer data is available on our third-party tools page. Any changes to transfer destinations or mechanisms will be notified in accordance with Section 12 below.
10. How long we keep your data
We retain personal data only for as long as necessary for the purposes described in this policy, or as required by law.
Billing and financial data: We are required under UK tax law to retain name, contact details and billing data for a minimum of six years (or longer if required by applicable law).
Recruitment data: Retained for two years after we notify an applicant of our hiring decision.
All other data: Deleted when there is no longer a lawful basis for processing it.
11. Security
We use commercially reasonable technical and organisational measures to protect your data against loss, misuse and unauthorised access. No security measures are perfect, and we cannot guarantee the security of data in transit. We are not responsible for the actions of third parties who may receive data in accordance with this policy.
12. Changes to this policy
We may update this policy from time to time. We will publish any revised version on our platform with the date of the latest revision. Your continued use of the service after the revised policy takes effect constitutes acceptance of the updated terms.
13. Third-party websites
Our platform may link to third-party websites. We are not responsible for those sites' privacy practices. We encourage you to read their privacy policies when you leave our platform.
14. Applying for a role at zeroheight
If you apply for a job with us, we will collect and use personal information to assess your application. This includes:
What we collect: Personal details (name, address, contact details), email address, employment and education history, CV and correspondence, interview notes, right-to-work documents, and (where applicable) DBS check results.
Sources: Directly from you, recruitment agencies, referees and former employers, and publicly available sources (e.g. LinkedIn).
How we use it: To assess suitability, establish right to work, carry out background checks, communicate with you, and comply with legal obligations.
Legal basis: Contractual necessity (steps prior to entering a contract of employment). Where we process for other purposes, we rely on our legitimate interests.
Retention: Two years from the date we notify you of our hiring decision.
15. How to complain
If you have concerns about how we use your personal data, please contact us first at support@zeroheight.com - we hope to resolve any issues directly.
You also have the right to complain to a supervisory authority:
UK: The Information Commissioner's Office (ICO) - ico.org.uk/make-a-complaint or 0303 123 1113
EEA: The data protection authority in your country of habitual residence, place of work, or where an alleged infringement occurred (list of EEA authorities)
16. EU Representative
We have appointed DataRep as our Data Protection Representative in the EEA.
To raise a question or exercise your rights as an EEA resident, contact DataRep at:
Email: datarequest@datarep.com (quote "Zero Height Limited" in the subject line)
Online: www.datarep.com/data-request (quote "Zero Height Limited")
17. Contact us
For any questions about this policy or the data we hold about you, or to exercise your rights:
Email: support@zeroheight.com