Privacy from the
first request.

How we use it

What we do with the data we collect.

The complete list:

• Respond to inquiries. Contact-form submissions go to our inbox so a human can reply. That is the entire purpose.
• Operate Piper. Messages you send to Piper are processed by the Anthropic API to generate a response, which is returned to your browser. Then the message is gone from our servers.
• Site security. IP, user-agent, and request path are used by Cloudflare and our own functions for rate limiting, bot mitigation, and intrusion detection.
• Aggregate analytics. We currently do not have analytics on zeblade.com. If we add privacy-preserving analytics in the future (e.g. Cloudflare Web Analytics, which is cookie-less), we will update this notice and disclose it here before turning it on.

That is the full list. We do not use your data for any other purpose.

How long we keep it

Retention.

We keep the minimum amount of data for the minimum amount of time required to operate the site.

Contact-form submissions

Retained for up to 24 months from the date of submission, or until you ask us to delete it — whichever comes first. After 24 months, the record is removed from our KV namespace as part of normal cleanup.

Piper conversations

Never stored on our servers. History lives only in your browser's sessionStorage and is cleared when you close the tab.

Edge server logs (Cloudflare)

Retained by Cloudflare per their standard log retention (typically days, not months). We do not export, archive, or mirror these logs.

Notification emails (Resend)

Resend retains email delivery records per their standard policy. Email content is not retained beyond the delivery window.

For California residents

California privacy rights.

If you are a California resident, the California Consumer Privacy Act ("CCPA") as amended by the California Privacy Rights Act ("CPRA") gives you additional rights. zeblade.com falls within scope of the CCPA because we accept inquiries from California residents, including business contacts.

Categories of personal information we collect

Mapped to the CCPA's defined categories. We collect only what is listed below, only when you take the action described, and only for the purposes described in "How we use it" above.

Sources, purposes, and disclosures

• Sources. Directly from you (contact form, Piper messages) or as a byproduct of your visit (Cloudflare edge logs).
• Purposes. As described in "How we use it" — to respond to your inquiry, operate the site, and secure it. No advertising, marketing, or profiling purposes.
• Disclosed to. Only the sub-processors named above (Cloudflare, Resend, Anthropic). We do not "sell" personal information as defined by the CCPA, and we do not "share" it for cross-context behavioral advertising.

Your CCPA/CPRA rights

• Right to know — request a copy of the personal information we hold about you, plus categories, sources, purposes, and third parties we disclosed it to.
• Right to correct — ask us to fix inaccurate personal information.
• Right to delete — ask us to delete your personal information, subject only to limited exceptions (such as completing a transaction or complying with a legal obligation).
• Right to opt out of sale or sharing — we do not sell or share for cross-context behavioral advertising, so there is nothing to opt out of. You may submit a request anyway and we will confirm in writing.
• Right to limit use of sensitive personal information — we do not collect sensitive personal information, so this is moot. We will confirm in writing if you ask.
• Right to non-discrimination — we will not deny services, charge different prices, or provide a different level of service because you exercised any CCPA right.

How to exercise these rights

Email [email protected] with "California privacy request" in the subject line. We will respond within 45 days as required by the CCPA, though we typically respond within 7 business days. The CCPA allows us to extend the response window by an additional 45 days when reasonably necessary; if we need that extension, we will tell you why before the original window closes.

Authorized agents

You may designate an authorized agent to make a CCPA request on your behalf. We will require verification that the agent is in fact authorized to act for you (typically a signed permission), and we may contact you directly to confirm before we action the request.

One more thing

The platform is governed separately.

This Privacy Notice covers zeblade.com — the marketing site. It does not cover the Zeblade GRC Portal (`*.zeblade.io`), which is the production platform our customers log into.

Customer data inside the GRC Portal — policies, controls, risks, vendor information, evidence — is governed by a separate Master Subscription Agreement and Data Processing Addendum signed at the start of an engagement. The platform runs on customer-controlled infrastructure (self-hosted) or within an isolated Zeblade Cloud tenant; the two domains share no data and no infrastructure.

If you are a Zeblade customer asking about how the platform handles your data, please refer to your MSA or contact us directly.