Privacy Policy

1. Introduction

This Privacy Policy explains how Zolt Ltdwe collects, uses, stores, and protects your personal information when you use our platform at zolt.me.

Zolt Ltd is a company registered in England and Wales (registration pending). We are the data controller for personal information we collect through our Service.

2. Information We Collect

3. Legal Basis for Processing

We process your personal data based on the following legal grounds:

• Contract — To provide our Service under our Terms of Service
• Legitimate interests — To improve our Service, prevent fraud, and ensure platform security
• Consent — For optional marketing communications (withdrawable at any time)

4. How We Use Your Information

• To create and manage your account
• To display your public creator page
• To provide platform features (page builder, products, memberships)
• To send transactional emails (payment notifications, account updates)
• To prevent fraud and ensure platform security
• To improve our Service and user experience
• To comply with legal obligations
• To enforce our Terms of Service

5. Information Sharing

We do NOT sell your personal information. We share information only with:

• Stripe — FCA-authorized payment processor, for payment processing and identity verification
• Supabase / AWS — Cloud database and storage provider
• Vercel — Hosting provider for our web application
• Resend — Email service provider for transactional emails
• Law enforcement — When required by law or court order

6. Public Information on Your Creator Page

The following information is publicly visible on your creator page:

• Your display name and username
• Your bio and what you create
• Your profile picture
• Your social media links
• Your products and their prices
• Supporter names and messages (supporters can choose anonymous)

Your email address, Stripe account details, and payment information are never publicly visible.

7. Data Storage & Security

• Your data is stored securely using industry-standard encryption
• We use Supabase (hosted on AWS) for database storage
• Passwords are hashed using bcrypt and never stored in plain text
• All data transmission uses HTTPS encryption
• We regularly review and improve our security practices

8. Cookies

We use only essential cookies to maintain your login session. We do not use tracking cookies, advertising cookies, or third-party analytics cookies that follow you across the web. You can disable cookies in your browser, but this will affect your ability to stay logged in.

10. Data Retention

We retain your personal data for as long as your account is active. Upon account deletion:

• Profile and product data: deleted within 30 days
• Transaction records: retained for up to 7 years for accounting and tax purposes
• Fraud prevention data: retained as necessary to protect against ongoing threats

11. Children's Privacy

Our Service is not intended for individuals under 18 years of age. We do not knowingly collect personal information from children. If we become aware we have collected data from a child, we will delete it promptly.

12. International Data Transfers

Your data may be processed in countries outside the UK and EEA, including the United States, where our service providers (Supabase, Vercel, Stripe) operate. We ensure appropriate safeguards are in place for such transfers in compliance with UK GDPR, including Standard Contractual Clauses where applicable.

13. Changes to This Policy

We may update this Privacy Policy from time to time. We will notify you of material changes by email and by posting the updated policy on our website. Your continued use of the Service after changes are posted constitutes acceptance.

14. Contact Us

For privacy questions or to exercise your rights, contact us: