Privacy notice
Who we are
Zukeys ([legal name and address of the business to be confirmed]) runs this website (zukeys.com) and the Zukeys application (app.zukeys.com). Questions, requests and complaints about personal data: hello@zukeys.com ([name or role of the person who answers to be confirmed]).
Two different roles
- Data a business puts into Zukeys (its customers, suppliers, employees, invoices and so on): the business decides why and how that data is used, so it is the data fiduciary. Zukeys processes the data on the business's behalf. If your details are in a business's Zukeys account, please contact that business first; we help it answer you.
- People who use Zukeys and visitors to this website: for your user account, sign-in records and messages you send us, Zukeys is the data fiduciary.
What we collect
This website (zukeys.com)
These pages contain no analytics, advertising or tracking code, load nothing from other websites and set no cookies themselves. Our web host may keep its own technical server logs under its terms [host log retention to be confirmed]. If you e-mail us, we keep your message to answer it.
The Zukeys application (app.zukeys.com)
- Account details: name, e-mail address, the organisation you belong to, your role and preferences.
- Security records: sign-in times, IP address, browser and device, two-factor settings, and an audit log of changes made in the account.
- Content a business enters or imports (see "Two different roles").
- E-mails sent through Zukeys on a business's request (for example invoices or password-reset links), and whether our mail server accepted them. Delivery failures that arrive later are checked by hand; a reply that reaches our sending address by mistake is passed on to the business it was meant for and then deleted.
Why we use it
To provide the service you or your business signed up for; to keep accounts and data secure (sign-in checks, abuse prevention, audit logs); to give support when the business allows a support session; to keep backups so data can be restored; and to meet legal obligations. We do not sell personal data and do not use it for advertising.
Where it is stored and who else handles it
- The application and its database run on a server in India rented from our hosting company (Hostinger).
- Backups are kept on that server: frequent backups taken every few minutes, protected by the server's access controls but not separately encrypted, and one encrypted copy per night.
- The nightly encrypted copy is also kept on a second storage account with the same hosting company [location of the second account to be confirmed]. Only the owner of Zukeys, who runs the service (not the businesses using it), holds the key that opens these encrypted copies.
- The hosting company also keeps its own backups and snapshots of the whole server (including the data and backups above) under its terms [their location and retention to be confirmed].
- E-mails from Zukeys are sent through a mailbox at the same hosting company.
- During the pilot no data is sent to an outside AI service, tax portal provider or payment provider: these features run in test mode only. A business may itself connect another service (for example a webhook to its own system); data then goes where that business chose.
How long we keep it
| What | How long |
|---|---|
| Web server access logs of app.zukeys.com (IP address, time, page address without any query string, result, browser). One-time link codes and private sharing links are never written to these access logs. | 14 days |
| Web server error logs (the full page address, which can include a one-time link code, of a request the application could not answer, for example during an update) | 14 days |
| Server system and application logs (these can include full page addresses with link codes) and database server logs (error details can include values such as an e-mail address) | 30 days |
| Backups on the server | A rolling set of recent backups (hours to days, at most 14 days; not separately encrypted), plus one encrypted copy per night for 14 days |
| Encrypted off-site backup copies | 14 days |
| The hosting company's own backups and snapshots of the whole server | As the hosting company's terms say [to be confirmed] |
| Business content, audit log and account data | While the business uses Zukeys, then as the business decides; accounting, tax and payroll records are kept as long as the law requires [periods to be confirmed] |
How we protect it
Encrypted connections (HTTPS), two-factor sign-in, permissions checked on the server for every request, separation between businesses' data, encrypted and signed off-site backups, and access to servers by key only. No system is perfectly secure; if a personal data breach happens we will inform the affected business and, where the law requires, the Data Protection Board of India and the people affected.
Your rights
Under the DPDP Act you can ask for a summary of your personal data and how it is used, ask us to correct, complete, update or erase it, withdraw consent where we rely on consent, nominate someone to act for you, and have a complaint addressed. Write to hello@zukeys.com. We aim to acknowledge a request within 7 days and answer within 30 days [response times to be confirmed]. Some records (for example accounting and tax records) must be kept by law even after a request to erase them; we will tell you when that applies. If you are not satisfied with our answer, you may complain to the Data Protection Board of India.
Children
Zukeys is meant for businesses and their staff. We do not knowingly collect personal data directly from children.
Changes
We will update this page when our practices change and show the date at the top.