Privacy Policy

1. Who We Are & What This Covers

Zamblek ("we", "us", "our") builds and licenses self-hosted software products, and provides development services. We are the controller of the personal information described here — we decide what is collected and why.

This policy applies to everyone who deals with us online: visitors who only read the site, people who create an account, customers who buy a licence, anyone who opens a support ticket or writes to us, newsletter subscribers, and people who apply for a job with us.

It does not cover the products themselves once you have installed them. Our software runs on your server, under your control — we do not host it and we have no access to the data your installation collects from your own users. What you do with that data is your responsibility, and your own privacy policy governs it. For anything about this policy, write to us through our Contact page — no account needed.

2. Information We Collect

We ask for the least we need to do the job in front of us. Reading the site needs nothing at all — no account, no form.

2.1 What you give us

• Account — your name, email address, country, and password. Optionally a profile picture. If you switch on two-factor authentication we store the secret and your recovery codes, both encrypted. Your password is never stored in a readable form.
• Support — the subject and text of every ticket and reply, any files you attach, and the internal review (Good or Bad) and note you leave when a ticket is closed.
• Contact and sales enquiries — your name, email, and message, plus company, Telegram, and the service you are asking about if you fill those in. This form is saved as a contact request so our team can reply; it is not emailed to a shared inbox.
• Newsletter — your email address, optionally your name, your language, and which topics you asked for. Subscribing is double opt-in: nothing is sent until you confirm from the email we send you.
• Product reviews — your rating and review text, published under your account name once approved.
• Job applications — your name, email, phone, portfolio link, cover letter, and the CV you upload.

2.2 What we collect automatically

When you sign in, we record the session so you can see and manage it: the IP address it came from, your browser and device as reported by your browser, the country that IP resolves to, and when it was last active. This is tied to your account — it is not anonymous — and you can review the list and sign out any session from your account settings at any time.

Our servers and our hosting provider also keep ordinary request logs for security and troubleshooting.

If you allow browser notifications, we store the subscription your browser gives us so we can send them. If you decline or revoke it, we cannot. Cookies are covered in section 5 and listed individually in the Cookie Policy.

2.3 What we receive from others

• From Freemius, after a purchase: your email address, the product and plan, your licence key, the order reference, and the dates that set your access and support window. Card details are never among them — see section 7.
• From Google or Envato, if you choose to sign in with them: your name, email address, and profile picture. We do not receive your password and we ask for nothing beyond basic profile details.
• From Envato/CodeCanyon: publicly published reviews of our products, including the reviewer's public username and country, which we may show on our testimonials page.

3. How We Use Your Information

Each use below maps to something you asked us to do, something we are required to do, or keeping the service working:

• create your account, sign you in, verify your email address, and reset your password;
• show you your licences, downloads, and updates, and keep them working for as long as you are entitled to them;
• check whether a product is still in support before opening a ticket, and answer the tickets you open;
• send you account and transactional email — verification, password resets, ticket replies, licence and renewal notices;
• send the newsletter and product updates you subscribed to, and stop as soon as you unsubscribe;
• send browser notifications, but only if you switched them on;
• assess your application if you apply for a job with us;
• publish your review of a product, after moderation;
• detect and prevent fraud, licence abuse, spam, and unauthorised access, and keep the site secure;
• show you your active sessions and where they signed in from, so you can spot one you do not recognise;
• meet legal and accounting obligations, and enforce our terms;
• understand which pages are useful and improve the site — only through analytics, and only if you accepted it.

We do not make decisions with legal or similarly significant effects about you by automated means alone.

4. Lawful Bases for Processing

Where data-protection law requires us to name a basis for each use, these are ours:

• Performing our contract with you — running your account, delivering licences, downloads, and updates, and providing support. Without this information we cannot give you what you bought.
• Legal obligation — keeping records for tax and accounting, and complying with sanctions and export rules.
• Legitimate interests — securing the site, preventing fraud and licence abuse, showing you your own sessions, answering enquiries, and assessing job applications. We use only what those purposes need.
• Consent — analytics cookies, the newsletter, and browser notifications. Each is off until you turn it on, and you can withdraw any of them at any time without affecting anything you bought.

5. Cookies & Analytics

We use two kinds of cookie. Strictly necessary ones make the site work — they keep you signed in, protect our forms, and remember your language, appearance, and cookie choices. Analytics cookies are optional: Google Analytics 4 is held back until you accept it in the cookie preferences window, and nothing is sent to Google before then.

The Cookie Policy names every cookie we set, what it does, and how long it lasts, and is the authoritative list. You can change or withdraw your choice there at any time.

6. Who We Share Information With

We use a small number of providers to run the service. Each one gets only what it needs for its job, and none of them may use your information for their own purposes. This is the complete list:

Two more things reach a third party without us sending them anything. If you allow browser notifications, the notification is delivered through the push service your browser uses — Google, Apple, or Mozilla depending on the browser. And our pages load web fonts and one small script from external addresses, which means those services see your IP address when a page loads, as they would on any site that uses them.

Beyond that we share personal information only where the law requires it — a valid legal request, a court order, or to establish or defend a legal claim — or to a buyer of the business, in which case this policy continues to apply to information transferred with it.

7. What We Do Not Do

Some things are easier to state plainly:

• We do not sell or rent your personal information, and we do not share it with anyone for their own marketing.
• We run no advertising. There are no ad networks, no advertising partners, no ad-targeting cookies, and no tracking pixels on this site. We do not build advertising or behavioural profiles, and we do not use analytics data to identify you personally.
• Your card details never reach us. Freemius is the merchant of record and operates the checkout, so card numbers, CVV codes, and bank credentials are captured and held by Freemius and its payment providers under their own PCI-DSS obligations. We cannot see them and we do not store them — see the Payment and Compliance Notice.
• We have no access to the data inside your installation. Our products run on your own server; whatever your users give you stays with you.

8. How Long We Keep Information

We keep each kind of information for as long as it is doing a job, then remove it:

• Account details — while your account is open. Close it and we delete or anonymise them, except where we must keep something.
• Licences and order records — for as long as the licence lasts, and after that for as long as tax and accounting law requires us to hold the record of the sale.
• Support tickets and attachments — kept as your support history so we do not ask you to explain the same problem twice. Ask us and we will delete an individual attachment.
• Contact and sales enquiries — these live in our admin inbox, and are kept only as long as the conversation is useful.
• Newsletter records — until you unsubscribe. After that we keep the minimum needed to make sure we do not email you again by mistake.
• Job applications — for up to twelve months after the role closes, so we can consider you for something similar, then deleted. Ask us sooner and we will delete it sooner.
• Sessions — until you sign out or the session expires.
• Browser notification subscriptions — until you revoke them or they stop working.
• Server logs — kept for a short period for security and troubleshooting, then rotated away.

9. International Transfers

We work with international providers, and the internet does not respect borders. The providers in section 6 operate across several countries, so your information may be processed outside the country you live in — including outside the European Economic Area and the United Kingdom.

Where that happens, we rely on the safeguards those providers put in place for international transfers, such as standard contractual clauses or an adequacy decision covering the destination country. The protections in this policy follow your information wherever it is processed.

10. Security

Traffic to and from this site is encrypted in transit. Passwords are stored as one-way hashes and cannot be read back, by us or by anyone else. Two-factor secrets, recovery codes, and our own integration credentials are encrypted at rest. Access to production systems is limited to the people who need it. You can turn on two-factor authentication for your account, and review and end any active session, from your account settings.

Never send card numbers, passwords, API keys, or private keys in a support ticket. We do not need them, and we will ask you to delete the message and change anything you exposed.

No system is perfectly secure, and we will not pretend otherwise. If a breach affects your personal information, we will notify you and the relevant authority where the law requires it.

11. Your Rights

Depending on where you live, you have some or all of the following rights over your personal information:

• Access — ask for a copy of the personal information we hold about you.
• Rectification — have anything inaccurate corrected or anything incomplete filled in. Most of it you can edit yourself in your account settings.
• Erasure — ask us to delete your information, where we are not required to keep it.
• Restriction — ask us to pause processing while something is in dispute.
• Objection — object to processing we base on legitimate interests.
• Portability — receive the information you gave us in a machine-readable format, or have it sent to another provider.
• Withdraw consent — turn off analytics, unsubscribe from the newsletter, or revoke browser notifications at any time. Withdrawing does not undo processing that already happened, and does not affect your purchases.

To exercise any of these, write to us through our Contact page. You do not need an account — this route is open to everyone, including newsletter subscribers and job applicants. If you are a customer with an account, a ticket from Support works just as well. We respond within one month and there is no charge. We may need to confirm who you are first, so that nobody else can make a request in your name. If we cannot do what you asked, we will explain why.

If you think we have handled your information badly, tell us first — we would rather fix it. You also have the right to complain to the data-protection authority in your country.

12. Children

This site, our accounts, and our products are for adults. You must be at least 18 years old to create an account or buy a licence, as our Terms of Use also require.

We do not aim any part of this site at children and we do not knowingly collect personal information from anyone under 18. If you believe a child has given us their information, contact us and we will delete it promptly.

13. Changes & Contact

We update this policy when what we do with personal information changes — a new provider, a new feature, a new obligation — and revise the "Last updated" date at the top of the page. If a change materially affects your rights, we will do more than change the date: we will tell you. Adding anything that needs your consent will ask you for it rather than assume it.

For questions about this policy, or to exercise any of your rights, write to us through our Contact page — no account needed. Customers can also open a ticket from Support. You can also review our Cookie Policy, Payment and Compliance Notice, and Terms of Use.