Privacy Policy

1. Who we are and when this policy applies

ZyroByte Corp. ("ZyroByte," "we," "us," or "our") operates from Toronto, Ontario, Canada. This Privacy Policy describes how we handle personal information through zyrobyte.co and our accounts, communications, software, and related services that link to it (the "Services"). It covers visitors, prospective clients, customers, account users, and people who contact us. Personal information is information about an identifiable individual.

We are responsible for information we handle for our own business purposes. When a client engages us to develop or operate a system using personal information on its behalf, the client generally determines the purposes of that processing and we act under the applicable service and data-processing agreement. Contact that client first for requests about its system; we will assist as required. A product-specific notice explains additional practices where applicable. Independent third-party sites and services have their own policies.

This policy is a notice, not blanket permission for every use of your information. We obtain consent where required and do not treat merely reading this policy as consent to optional marketing or sensitive processing.

2. Information we collect and its sources

The information we handle depends on the features you use:

• Contact and project inquiries: name, email, telephone number, company details, project requirements, budgets, attachments, and correspondence you submit through forms, email, project requests, or live chat.
• Accounts and security: profile and contact details, address if supplied, password hashes, verification and recovery records, two-factor authentication details, sign-in sessions, device/browser information, IP addresses, and audit events. Please do not send passwords or recovery codes to support.
• Billing: purchases, invoices, subscriptions, transaction status, billing details, and payment-provider identifiers. Stripe handles card payment details through its payment interfaces; our account systems use payment references and limited payment-method information rather than storing full card numbers or card security codes.
• Project and support content: files, messages, access permissions, screenshots, technical logs, and other information you or your organization's authorized users supply. File metadata can include filenames, sizes, and upload times.
• Website and device activity: IP address, browser and device information, pages and referring URLs, interactions, timestamps, approximate location inferred from IP address, and information from cookies or similar storage, logs, analytics, and anti-abuse tools.
• Communications: preferences, consent and unsubscribe records, email delivery information, SMS delivery and verification records, and support conversations.
• Public features: if you submit a Zyro Run leaderboard entry, we receive the display name, score, run identifier, and submission time. Display names and qualifying scores are public. Use a nickname instead of personal contact details.
• Applications and business contacts: professional and contact information you send in a job application or business proposal.

Sources include you, your device, your organization's administrators and collaborators, and providers that return information necessary for a service, such as payment status or message delivery. If you provide someone else's information, ensure you have authority to do so and give them appropriate notice.

3. How and why we use information

• Respond to inquiries, prepare proposals, deliver projects, administer accounts, and provide support.
• Process payments, manage subscriptions, maintain business records, and resolve billing issues.
• Authenticate users, deliver verification codes, manage permissions, detect abuse, investigate incidents, and protect our systems and legal rights.
• Operate chat, file sharing, public features, and other functions you request.
• Understand website use, diagnose errors, evaluate performance, and improve Services.
• Send service notices and, with the consent or other permission required by applicable law, our marketing communications.
• Evaluate applications or proposals you send, fulfill legal obligations, and establish, exercise, or defend legal claims.

Under Canadian privacy law, we obtain meaningful consent where required and rely on statutory exceptions only where they apply. You may withdraw consent, subject to legal or contractual restrictions and reasonable notice; we will explain if doing so prevents us from providing a requested feature.

Where the EEA or UK GDPR applies to our processing, our legal bases are performance of a contract with you or steps you request before entering one (accounts, orders, and service delivery); legitimate interests, balanced against your rights (business inquiries, support, service improvement, and fraud prevention); legal obligations (required records and disclosures); and consent where required (including relevant optional tracking or marketing). For contacts acting for an organization, contract-related processing may instead rely on our legitimate interest in managing that business relationship. Sensitive information requires an additional lawful condition where applicable. You may request details or object to processing based on legitimate interests.

4. Cookies, analytics, and browser storage

The website uses a session cookie for signed-in access and browser storage for features such as theme preferences, live-chat continuity, and local game scores. For example, the chat widget stores a conversation identifier and access token in your browser so it can reconnect you to your conversation. Clearing storage can reset these features or end access to an existing chat.

The website includes Google Analytics and Google Tag Manager for measurement and tag delivery. Analytics can process device and browser information, online identifiers, page activity, and approximate location. Google Tag Manager loads configured tags; the information each tag handles depends on its configuration. This information is not necessarily anonymous. Some forms use Google reCAPTCHA to help distinguish people from automated abuse, which can send device and interaction information to Google.

You can block or delete cookies and site storage through your browser and use Google's Analytics opt-out browser add-on for supported browsers. These controls may affect functionality and do not erase information already received. Google's handling of information is described in its Privacy Policy. Browser settings and the add-on do not control every form of tracking or constitute consent to tracking. Where applicable law requires prior consent for non-essential technologies, that consent is required separately from this policy.

5. Who receives information

We disclose information where needed for the purposes above to the following categories of recipients:

• Infrastructure and service providers: hosting, databases, file storage, network security, and operational support. Our website integrations include Cloudflare services and R2 file storage.
• Payments and communications: Stripe for payment processing, SendGrid for email delivery, and Twilio for SMS features, as relevant to the Service you use.
• Measurement and anti-abuse providers: Google for the Analytics, Tag Manager, and reCAPTCHA features described above.
• Authorized people: staff and contractors working on your request; your organization's administrators and collaborators; and recipients you choose through sharing features. Anyone with an authorized sharing link may be able to access its contents, so share links carefully.
• Professional advisers and authorities: advisers assisting with business, accounting, insurance, or legal matters, and recipients where disclosure is required or permitted by applicable law to comply with valid process, prevent harm, investigate misuse, or protect legal rights.
• Business transaction parties: potential or actual parties and advisers to a financing, merger, acquisition, reorganization, or sale, subject to appropriate confidentiality and applicable restrictions on use and disclosure.

Providers acting on our instructions receive information for the relevant services and are subject to applicable safeguards and contractual obligations. Some providers, including payment processors, also handle information as independent organizations for their own legal, security, and other disclosed purposes. Their own privacy notices apply to that processing. Contact us for information about providers relevant to your engagement.

We do not sell personal information for money. Disclosure to analytics or advertising services can have a broader legal meaning under some privacy laws; the analytics disclosures above apply and this statement is not a representation that every disclosure falls outside those definitions. Public content you submit is visible to other visitors.

6. Email, mobile information, and SMS choices

You can unsubscribe from marketing emails using their unsubscribe link or by contacting us. We may still send necessary account, transaction, security, and service messages. Marketing permissions are separate from acceptance of our Terms, and purchasing a Service does not require marketing consent.

Mobile information, including telephone numbers and SMS opt-in consent, is not sold or shared with third parties or affiliates for their own marketing or promotional purposes. We disclose it to providers supporting delivery, authentication, and security as needed, or where required by law. SMS authentication and service notifications use the number you provide. Reply STOP to stop the applicable SMS program, or contact support; use HELP where supported. If you stop authentication texts, you may need an alternative available method or help accessing your account.

7. Client systems, AI features, and sensitive information

Client projects may involve personal information different from ordinary website activity. For example, a commissioned camera, tracking, communications, or AI system may process images, audio, location, identifiers, or other sensitive data. Describing those services on our website does not mean we collect those categories from every visitor. The project's actual data flows, roles, purposes, providers, permissions, retention, and safeguards must be addressed in the relevant project documentation and notices before processing begins.

If an agreed feature sends prompts, files, or other information to an AI provider, that processing is subject to the feature's disclosures and applicable agreement. Do not put confidential or sensitive information into a public demo or general chat without an agreed basis for doing so. A general licence to process customer content is not permission to use it to train a general-purpose AI model.

Do not assume that ordinary web forms, email, support chat, file uploads, or every ZyroByte product use end-to-end encryption. Where a product specifically provides that feature, its product notice explains what is encrypted, who can access keys and content, and any metadata, backup, or recovery limitations. This policy does not promise that all content is inaccessible to ZyroByte.

8. Where information is processed

ZyroByte is based in Canada. Our providers and authorized personnel may process or access information in Canada, the United States, and other countries in which they operate. This website does not provide a general guarantee of Canadian-only storage. Information processed abroad may be subject to lawful access by courts, law enforcement, or government agencies there.

Where required, we use appropriate contractual or other lawful safeguards for transfers and remain accountable for information entrusted to providers acting for us. Where EEA or UK transfer restrictions apply, the relevant transfer must use an applicable adequacy decision, approved contractual safeguards, or another lawful mechanism. Contact us for details about the locations and safeguards applicable to your Service; these vary by provider and project.

9. Retention and deletion

We retain personal information for as long as reasonably necessary for the purposes described here, including providing Services, maintaining required records, preventing abuse, resolving disputes, and meeting legal obligations. The period depends on the category, sensitivity, relationship, applicable agreement, and legal requirements:

• Account and project information is needed during the relationship and for applicable closeout, support, legal, or contractual obligations afterward.
• Invoices, transaction records, and related correspondence are retained for applicable tax, accounting, and legal recordkeeping requirements.
• Security, diagnostic, and communication records are retained according to their operational purpose and investigation or legal needs.
• Marketing preferences and limited suppression records may be retained to honor opt-outs.
• Public submissions remain subject to the feature's operation and moderation; you may contact us to request removal of personal information.

When information is no longer needed, it should be deleted or irreversibly anonymized. Deletion from active systems does not necessarily remove protected backups immediately; retained copies remain subject to safeguards and applicable retention requirements. We may retain information subject to a legal hold or another lawful exception. Pseudonymizing an identifier does not by itself make information anonymous. Contact us to request deletion or the retention criteria applicable to your information.

10. Security and incidents

We use safeguards appropriate to the nature of the information and the Services. Website account controls include hashed passwords, access controls, and authentication and audit features. No system, transmission method, or storage service can be guaranteed completely secure. Protect your devices and account credentials, and notify [email protected] promptly of suspected account misuse.

We assess security incidents and provide notices to affected individuals, customers, and regulators where required by applicable law or contract. Under PIPEDA, reporting and individual notification are required as soon as feasible after determining that a breach meeting the real-risk-of-significant-harm threshold has occurred. Other applicable laws may impose different thresholds and deadlines. This policy does not assert an independent security certification or promise a single notification deadline for every incident.

11. Privacy rights, requests, and complaints

Contact [email protected] to ask about our practices or request access to or correction of your personal information, withdrawal of consent, deletion where applicable, or details about disclosures. You can also use our contact page. Explain the request and the Service involved; do not send government identification or sensitive documents in your first message. We may request proportionate information to verify identity or authority where needed, without collecting more than necessary.

Rights, exceptions, and response deadlines depend on the law that applies. Under PIPEDA, access requests generally receive a response within 30 days, subject to permitted extensions with notice. Where EEA or UK GDPR applies, you may also have rights to erasure, restriction, portability, objection (including to direct marketing), and protections concerning solely automated decisions with legal or similarly significant effects. GDPR requests are generally answered within one month, with lawful extensions where necessary. Withdrawing consent does not affect earlier lawful processing.

Where California or another US state privacy law applies to our business and your information, you may have rights to know/access, correct, delete, obtain a portable copy, opt out of sale, sharing for cross-context behavioral advertising or targeted advertising, and limit certain uses of sensitive information. You may use an authorized agent where the law permits, and appeal a denied request where that right applies. We will explain applicable exceptions, verification requirements, and appeal options in our response. We will not unlawfully discriminate against you for exercising privacy rights. Email us with the subject "Privacy request" or "Privacy appeal" as appropriate.

You may complain directly to the Office of the Privacy Commissioner of Canada, an applicable provincial regulator, your EEA or UK supervisory authority, or your applicable state regulator. You do not have to contact us first. We welcome the opportunity to address concerns, but do not restrict your right to seek regulatory help.

12. Children

Our account and paid Services are intended for adults who are at least 18 and have reached the age of majority where they live. They are not directed to children, and we do not knowingly collect children's personal information through them. If you believe a child has supplied personal information, contact us so we can assess the circumstances and take appropriate steps, including deletion where required. Any specifically designed service for younger users requires separate age-appropriate notices and permissions.

13. Changes to this policy

We may update this policy to reflect changes in Services, practices, or legal requirements. We will update the date and provide additional notice of material changes where required. If a new purpose requires consent, we will request it before proceeding; continued use alone does not replace that consent.

14. Contact ZyroByte

ZyroByte Corp. — Privacy inquiries
Toronto, Ontario, Canada
[email protected]
Alternative contact: [email protected]

Please identify the relevant website, product, or client project so your request can be directed appropriately. For contractual terms, see our Terms & Conditions.