Privacy Policy

This Privacy Policy explains how Zinkosoft LLC collects, uses, discloses, and protects personal information in connection with the zblocks website builder. Please read it carefully.

1. Who We Are and What This Policy Covers

Zinkosoft LLC (“Zinkosoft,” “zblocks,” “we,” “us,” or “our”) is a limited liability company organized in the State of Florida, United States. We operate the zblocks website builder, available at zblocks.app and related subdomains, together with our marketing website, dashboard, and account services (collectively, the “Service”).

This Privacy Policy applies to:

• Visitors to our marketing website at zblocks.app.
• People who create an account and use the Service to build, manage, or publish websites.
• People who contact us for support or other communications.

This Privacy Policy does notgovern the websites that our customers create and publish using zblocks. Information you provide directly to a customer’s site is controlled by that customer, not by us. See Section 15, “Sites Built by Our Customers.”

By accessing or using the Service, you acknowledge that you have read and understood this Privacy Policy. If you do not agree with it, please do not use the Service.

2. The Two Roles We Play

Depending on the information involved, we act in one of two roles under data protection law.

As a controller.For personal information about our own account holders, billing contacts, and visitors to our marketing website, Zinkosoft is the “controller.” This means we decide why and how that information is processed, and this Privacy Policy describes those practices.

As a processor (service provider).When our customers use zblocks to collect information from visitors to the sites they build (for example, through a contact form or a newsletter sign-up), Zinkosoft acts as a “processor” or “service provider.” We handle that information only to provide the Service, acting on the customer’s instructions. In that situation, the customer is the controller of the information and is responsible for its own privacy practices. See Section 15.

3. Information We Collect

3.1 Information you provide to us

• Account information. Your name, email address, password (stored only in hashed form), and your account and profile settings.
• Billing information. Your billing name, billing address, subscription plan, and limited card details such as the card type and the last four digits. Full payment card numbers are collected and processed directly by our payment processor, Stripe, through its secure payment interface; they are not transmitted to or stored on our own systems.
• Content. The text, images, and other materials you upload, create, or store while building and managing a site.
• Communications. The messages, survey responses, and feedback you send when you contact us or interact with our support channels.
• Authentication details. If you sign in using a third-party login (for example, Google) or a passkey, we receive the limited information needed to authenticate you, such as your email address and a unique identifier.
• Connected calendar data. If you choose to connect a Google Calendar, we access a read-only view of your calendar events to display them on your site. This is described in detail in Section 6.

3.2 Information we collect automatically

• Usage information. Pages and features viewed, actions taken, and timestamps, collected through our own first-party analytics.
• Device and connection information. Your IP address, browser type, operating system, device identifiers, language settings, and the page that referred you.
• Log data. Records generated automatically when you access the Service, which we use for security, troubleshooting, and abuse prevention.

We use only first-party analytics that we operate ourselves. We do not use third-party advertising networks, and we do not use third-party tracking technologies to follow your activity across other websites or services.

3.3 Information we receive from third parties

• Payment processor. Confirmation of payment, subscription status, and limited billing metadata.
• Authentication providers. Where you choose to sign in with a third-party account, the limited profile and verification information needed to complete sign-in.
• No data brokers. We do not purchase personal information from data brokers or acquire it from advertising networks or similar third-party sources.

4. Cookies and Similar Technologies

• Strictly necessary. To operate the Service, keep you signed in, protect the security of your session, and guard against automated abuse. This includes bot-protection technology that runs on our sign-in and form pages to confirm that a visitor is a human; it may store a limited token in your browser solely for that purpose. These technologies cannot be turned off through the Service, and we do not use them for advertising or to track you across other sites.
• First-party analytics. To understand how the Service is used so we can maintain and improve it.

We do not place third-party advertising cookies or cross-site tracking technologies on our marketing website or within the application.

Where required by law, we request your consent before placing non-essential cookies, and you can manage your preferences through your browser settings or through any cookie controls we provide. Note that customers may add their own cookies or tracking to the sites they build; those are governed by the customer’s own privacy notice. See Section 15.

5. How We Use Your Information

• Provide, operate, and maintain the Service and your account.
• Process payments, manage subscriptions, and send billing-related messages.
• Authenticate users and protect accounts, including through multi-factor authentication.
• Respond to your support requests and communicate with you about the Service.
• Send transactional and service messages, such as account, security, and billing notices.
• Send product updates and marketing messages where permitted, which you can opt out of at any time.
• Measure performance, understand usage, and improve and develop features.
• Detect, prevent, and respond to fraud, abuse, security incidents, and technical problems.
• Comply with our legal obligations and enforce our terms and agreements.

6. Google Calendar Integration and Google User Data

zblocks offers an optional feature that lets you display your calendar events on your site. If you choose to connect a Google Calendar, we access your Google Calendar data through Google’s APIs using the read-only scope https://www.googleapis.com/auth/calendar.events.readonly.

• What we access. Only your calendar event details (such as event titles, dates, times, locations, and descriptions), and only for the calendar you authorize. We request read-only access.
• Why we access it. Solely to display your events on the parts of your zblocks site where you have chosen to show them, such as a members-only page.
• What we do not do. We do not create, edit, or delete your calendar events. We do not use Google user data for advertising or any other purpose beyond displaying your events. We do not sell it, and we do not share it with third parties except as strictly necessary to provide this feature to you.
• Storage and control. We store the access credentials needed to keep your displayed events up to date, in encrypted form. You can disconnect the integration at any time from your zblocks dashboard, or revoke our access directly in your Google Account security settings, which immediately ends our access.

7. Legal Bases for Processing (EEA and UK)

If you are located in the European Economic Area or the United Kingdom, we rely on the following legal bases to process your personal information:

• Performance of a contract. To provide the Service you have requested and to administer your account.
• Legitimate interests. To operate, secure, analyze, and improve the Service, where those interests are not overridden by your rights and freedoms.
• Consent. Where we rely on your consent (for example, for certain cookies, marketing, or connecting a calendar). You may withdraw your consent at any time.
• Legal obligation. To comply with applicable laws and lawful requests.

8. How We Share Information

We do not sell your personal information. We share it only in the limited circumstances described below.

Service providers and subprocessors. We rely on a limited set of trusted third parties to operate the Service. As of the date of this Policy, our subprocessors are:

• Stripe for payment processing, subscription billing, and related fraud prevention.
• Railway for application hosting and origin infrastructure.
• Cloudflare for content delivery, DNS, custom-domain hosting, object storage, edge security, and bot and spam protection.
• Resend for delivery of account, security, and transactional email.
• Upstash for managed Redis used for rate limiting and caching.

These providers may access personal information only as needed to perform their functions for us, and they are bound by confidentiality and data protection obligations.

Legal and safety. We may disclose information when we believe it is reasonably necessary to comply with applicable law or a lawful request, to enforce our agreements, or to protect the rights, property, or safety of Zinkosoft, our users, or others.

Business transfers. If we are involved in a merger, acquisition, financing, reorganization, bankruptcy, or sale of all or part of our assets, personal information may be transferred as part of that transaction. We will take reasonable steps to notify you of any change in ownership or in how your personal information is used.

With your direction or consent. We share information when you ask us to or otherwise give your consent.

9. Your Choices and Controls

• Marketing emails. You can opt out of marketing messages by using the unsubscribe link in those messages or by contacting us. We will still send necessary transactional and service messages.
• Cookie preferences. You can manage cookies through your browser settings or through any consent controls we provide.
• Connected calendars. You can disconnect any connected calendar at any time from your dashboard, or revoke access in your Google Account settings.
• Account information. You can review and update much of your account information directly through your account settings.

10. Data Retention

We retain personal information for as long as your account is active and for as long as we need it to provide the Service. After your account is closed, we retain certain information for a limited period to comply with legal, tax, accounting, and dispute-resolution obligations, after which we delete or anonymize it. Backup copies may persist for a limited time before they are overwritten in the ordinary course. Credentials for a connected calendar are deleted promptly when you disconnect the integration or close your account.

11. Data Security

We use technical and organizational measures designed to protect personal information, including encryption of data in transit, encryption of sensitive credentials at rest, access controls, and authentication safeguards (such as multi-factor authentication, which is available on all accounts and required on certain plans).

No method of transmission over the internet or method of electronic storage is completely secure, and we cannot guarantee absolute security. If we become aware of a security incident that affects your personal information, we will notify you and the relevant authorities as required by applicable law.

12. International Data Transfers

We are based in the United States, and your personal information may be processed and stored in the United States or in other countries where we or our service providers operate. These countries may have data protection laws that differ from those in your country. Where required, we use appropriate safeguards for cross-border transfers, such as Standard Contractual Clauses.

13. Your Privacy Rights

13.1 European Economic Area and United Kingdom

If you are located in the EEA or the UK, you have the right to: access your personal information; correct inaccurate information; delete your information; restrict or object to certain processing; obtain a portable copy of your information; and withdraw consent where processing is based on consent. You also have the right to lodge a complaint with your local supervisory authority.

13.2 California

If you are a California resident, you have the right to: know and access the categories and specific pieces of personal information we have collected; delete personal information; correct inaccurate personal information; and not be discriminated against for exercising your rights. We do not sell your personal information, and we do not share it for cross-context behavioral advertising, as those terms are defined under California law.

13.3 Other United States states

Residents of other United States states that have comprehensive privacy laws may have similar rights to access, correct, delete, and obtain a copy of their personal information, and to opt out of certain processing, to the extent those laws apply to us.

13.4 How to exercise your rights

To exercise your rights, contact us at privacy@zblocks.app. We will verify your request and respond within the time required by applicable law. You may also manage certain information directly through your account settings. You may use an authorized agent to submit a request on your behalf, subject to verification.

14. Do Not Track and Global Privacy Control

Some browsers offer a “Do Not Track” signal. Because there is no common industry standard for how to respond to these signals, our marketing website does not currently respond to them. Since we do not engage in cross-site tracking, this has limited practical effect on your information. Where required by applicable law, we honor recognized opt-out preference signals, such as Global Privacy Control.

15. Sites Built by Our Customers

Our customers use zblocks to create and publish their own websites. When you visit a site built with zblocks, any information you provide to that site (for example, through a contact form, a newsletter sign-up, or any other feature on that site) is collected by, and under the control of, the customer who operates the site, not by Zinkosoft.

For that information, Zinkosoft acts only as a service provider or processor on the customer’s behalf, handling it solely to deliver the Service under our agreement with the customer.

Customers are responsible for their own privacy practices, notices, and legal compliance, including any cookies, integrations, or tracking they choose to add to their sites.

If you are a visitor to a customer’s site and wish to exercise privacy rights regarding information you provided there, please contact the operator of that site directly. We will support our customers in responding to such requests as required by applicable law.

16. Children’s Privacy

The Service is not directed to children, and we do not knowingly collect personal information from children under the age of 16. If you are under 16, please do not use the Service or provide any personal information to us. If you believe a child has provided us with personal information, please contact us and we will take appropriate steps to delete it.

17. Third-Party Links

The Service, and sites built by our customers, may contain links to third-party websites or services that we do not operate or control. This Privacy Policy does not apply to those third parties, and we are not responsible for their content or privacy practices. We encourage you to review the privacy policies of any third-party sites you visit.

18. Changes to This Privacy Policy

We may update this Privacy Policy from time to time. When we do, we will post the updated version with a new “Last updated” date and, where required by law, provide additional notice. Your continued use of the Service after the changes take effect constitutes your acceptance of the updated Privacy Policy.

19. Contact Us

If you have questions about this Privacy Policy or our privacy practices, or if you would like to exercise your rights, please contact us:

Zinkosoft LLC
St. Petersburg, Florida, United States
Email: privacy@zblocks.app