Zenso Privacy & Cookies Policy

Effective Date: November 5, 2026 | Version: 1.0

This Policy governs personal data processing and cookie usage across the Zenso ecosystem (zenso.ink, panel.zenso.ink, schemas.zenso.ink, and related software).

1. Data Controller

The Controller of your personal data is Konrad Stępień, operating under the business name Konrad Stępień Techio, ul. Górczewska 200A lok. 36, 01-460 Warszawa, Poland, EU VAT/Tax ID: PL8161712508, REGON: 389671282.
Privacy contact: [email protected].

2. Purposes, Scope, and Legal Bases for Processing

Providing personal data is voluntary but necessary to use Zenso services. We do not engage in automated decision-making or profiling.

• Newsletter & Waitlist (zenso.ink): We process your email address, IP address, and opt-in confirmation timestamp to send product updates and offers (Art. 6 (1)(a) GDPR – consent) and to demonstrate consent compliance (Art. 6 (1)(f) GDPR – legitimate interest).
• Account & Service Provision (panel.zenso.ink): We process account details (email, optional username, hashed password, time zone, OAuth identifiers and tokens) and user-supplied screen/plugin configurations strictly to provide the services under the Terms of Service (Art. 6 (1)(b) GDPR – contract performance).
• Device Connectivity & Self-Hosted Instances: We process hardware identifiers (including MAC addresses), device parameters, firmware version, server IP addresses, and auth tokens to deliver content to your device (Art. 6 (1)(b) GDPR and Art. 399 of the Polish Electronic Communications Law – PKE), and for diagnostics and license verification (Art. 6 (1)(f) GDPR – legitimate interest).
• Security & Support: We process connection logs (IP address, timestamps, User-Agent) and support emails to prevent abuse, handle inquiries, and defend against legal claims (Art. 6 (1)(f) GDPR – legitimate interest).

3. Data Recipients & International Transfers

We use third-party data processors under Data Processing Agreements (DPAs):

1. Supabase, Inc. (USA) – database and authentication (data hosted exclusively in the EU – AWS Frankfurt, Germany).
2. Cloudflare, Inc. (USA) – CDN, hosting, DNS, and WAF/DDoS protection.
3. Plus Five Five, Inc. / Resend (USA) – transactional and newsletter email delivery.

Any transfer of network metadata or email addresses to the US is safeguarded under the EU-US Data Privacy Framework (DPF) (Art. 45 GDPR) or the European Commission's Standard Contractual Clauses (SCCs) (Art. 46 (2)(c) GDPR).

4. Data Retention

• Newsletter: until consent is withdrawn or the project ends (unconfirmed sign-ups are deleted after 7 days).
• Account & Configurations: for the duration of an active Account, and up to 30 days after deletion (until encrypted backups rotate). Temporary pairing sessions and cached renders expire automatically after synchronization.
• Security Logs & Support Correspondence: up to 12 months, or until applicable statutory limitation periods expire.

5. Your Rights (GDPR)

You have the right to: access your data and obtain a copy (Art. 15), rectification (Art. 16), erasure (Art. 17), restriction of processing (Art. 18), data portability (Art. 20), object to processing based on legitimate interest (Art. 21), and withdraw consent at any time (Art. 7 (3)).
You may lodge a complaint with the Polish supervisory authority (PUODO, ul. Stawki 2, 00-193 Warsaw, uodo.gov.pl) or the data protection authority in your EU Member State of residence.

6. Cookies & Local Storage

1. We do not use third-party analytics, advertising, or tracking scripts.
2. We rely exclusively on strictly necessary technical cookies and browser storage (localStorage / sessionStorage) exempt from consent banners under Art. 399 (3) PKE and Directive 2002/58/EC: authentication session tokens, Cloudflare security cookies (__cf_bm, cf_clearance), and UI language/theme preferences.

7. Policy Updates

Registered Users will be notified of material updates via email or an in-app notice.