Privacy Policy
Page updated .
The short version
We keep a brief or email you send so we can answer you; a recording for a brief you never send is deleted within 24 hours. The site also counts visits with three analytics tools, so we can see what to improve; the notice bar tells you once, on your first visit. To see, correct or delete what we hold about you, email hi@zaions.com from the address you used. We don’t sell your data. The only promotions you’ll see are for the Zaions team’s own products, chosen by us, with no ad network and no ad tracking.
Who’s responsible for your data?
Zaions, a privately held software agency based in Lahore, Pakistan. Write to hi@zaions.com or call +92 304 6619706 with any question about this policy.
What does this policy cover?
zaions.com and the Zaions Android app, plus the accounts people created by signing in with Google on the earlier zaions.com. The app and those accounts have their own section below, because the earlier site and the app’s earlier versions worked differently from zaions.com today.
Our docs site, docs.zaions.com, links here too, and GitHub hosts it on GitHub Pages and receives your IP address to deliver its pages. It runs none of the analytics tools, error reports or spam check described below, and it keeps your light or dark choice in your browser.
A few apps we built keep their own privacy policies on this site, at their own addresses. Each of those covers its own app, not zaions.com.
What do we collect, and why?
Your brief, any recording or description you make to draft it, the emails and calls that follow it, and a payment record if you become a client. The site also collects visit data through three analytics tools. Each one is set out below.
The brief you send
The start-a-project form needs two things. Your name and email. Everything else is optional: your company, the services you need, a package, a budget range, a target date, and a description of what you need. We use it to understand your project, reply to you and write your estimate.
The brief is stored in our database and emailed to the two team inboxes that handle new briefs. We also email a copy of your brief to the address you typed. As the conversation moves on, our team adds notes and a status to it. We don’t store your IP address, or anything made from it, with the brief.
While you fill in the form, your answers stay in this browser tab’s session storage, so a reload doesn’t empty it. They’re cleared when you send, when you start another brief, or when you close the tab.
AI drafts and recordings
AI drafts text for a person to check: your brief from words you type or record, and, for our team, a summary of a sent brief, a reply and tidied notes of a call. A person reads every draft before anything is sent or saved.
On the start-a-project form, you can describe your project in your own words instead of filling in each field: type it in the “Tell us the idea” box, or record yourself with the mic. The draft fills in only the fields you’ve left empty. You check it. You change what you like. Nothing reaches our team until you press Send the brief.
First the spam check runs. Only your words go to Anthropic: the text you typed in the “Tell us the idea” box. The fields you’ve already filled in aren’t sent. If you record, Groq turns the recording into text, and your browser’s own speech recognition, where it has one, also turns what you say into text: Google’s in Chrome, Apple’s in Safari, Microsoft’s in Edge. Both texts go to Anthropic, which drafts the brief’s empty fields from them, or from the one there is. If Anthropic can’t take the request, OpenAI drafts it from the same text instead. In the Android app, only Groq’s text is used.
Your typed words aren’t stored. We log only how much text each draft used. Before your first recording, the mic says how long we keep it. A recording is stored with its transcripts and the AI’s draft: if you send the brief, they’re kept with the brief, and if you don’t send it, they’re deleted within 24 hours.
After a call with you, a team member can record notes. Groq and the browser’s own speech recognition, where it has one, turn them into text, and Anthropic tidies them (OpenAI, when Anthropic can’t). The audio is deleted as soon as the notes are drafted, and within 2 days at most; only the notes our team saves are kept.
To count each visitor’s AI drafts and recordings for the day, our server keeps a scrambled (hashed) form of your IP address. It’s never stored with your brief. It’s deleted within 2 days.
Emails and calls
When you email or call us, we keep the messages and our notes of the call, so we can carry on the conversation and, if you become a client, run your project.
Payment records
When you pay an invoice, we keep the record of it: who paid, the amount, the date and the reference. Payments aren’t refunded. The Terms of Service say how payments, cancellation and the Team package work.
During a project
To build your product, we work inside the accounts, data and files you give us access to, and only for that project. At handover, the code repository, the design files, the store and hosting accounts and every credential move into your name.
Analytics (always on)
Google Analytics 4, Amplitude and Microsoft Clarity show us which pages people read, what they click, and where a page confuses them. They receive the pages you visit, your clicks and scrolling, your browser and device type, an approximate location worked out from your IP address, and the site that sent you. Clarity also records how each page moved during your visit, so we can replay it; it doesn’t record what you type into the brief form.
We don’t send your name, email or brief to any of them. No account ties visits to you.
They run on every visit, because they’re how we find out what to improve, and there’s no switch for them. The Cookie Policy lists the cookies they set.
Error reports (always on)
When a page breaks, Sentry gets a report: the error, the page it happened on, your browser and device type, and an approximate location worked out from your IP address. We set it not to store your IP address and to leave out names, email addresses and form contents.
The spam check on the brief (always on)
Cloudflare Turnstile checks that a brief isn’t being sent by a bot; to do that, Cloudflare reads signals from your browser, such as your IP address and browser details.
Promotions for our own products
Some pages show cards for other products the Zaions team makes, under Our own products. We choose them. No ad network is involved, and nothing about you is sent to those products. A card opens that product’s own site in a new tab, under its own policy; analytics count the click like any other link on the page.
Delivering the pages
Our hosting provider receives your IP address and browser details to deliver each page, as every web host does. Today that’s Cloudflare Pages.
Stored in your browser
Your Appearance settings and the fact that the notice bar has shown stay in your browser, not on our servers. The Cookie Policy lists each one.
Who else handles it?
These services work for us. Each one handles only what its job needs.
| Service | What it does for us | What it handles | Its policy |
|---|---|---|---|
| Supabase | stores briefs, a recording’s transcripts and its AI draft, and the daily count of AI drafts and recordings, in our database | the brief, a recording’s transcripts and its AI draft; for up to 2 days, a scrambled form of your IP address | supabase.com/privacy (opens in a new tab) |
| FilesHub, our own email and file service | emails each brief to our team, sending through Hostinger mailboxes, and stores brief recordings | the brief, recordings | this policy |
| Google (Gmail) | hosts the two team inboxes briefs are emailed to | the brief, emails | policies.google.com/privacy (opens in a new tab) |
| Hostinger | hosts the hi@zaions.com mailbox and the mailboxes FilesHub sends from | emails you send us, the brief | hostinger.com/legal/privacy-policy (opens in a new tab) |
| Cloudflare Turnstile | the spam check on the brief form | browser signals, IP address | Turnstile privacy addendum (opens in a new tab) |
| Anthropic | drafts briefs from the words you type or record; for our team, summarizes a sent brief, drafts a reply and tidies notes of a call | the text you type, a recording’s transcripts, the brief and our team’s notes on it, our notes of a call with you | anthropic.com/legal/privacy (opens in a new tab) |
| OpenAI | does the same drafting and tidying when Anthropic can’t take the request | the same text Anthropic would get | openai.com/policies/privacy-policy (opens in a new tab) |
| Groq | turns recordings into text | your recording, and a recording our team makes of its own notes after a call with you | groq.com/privacy-policy (opens in a new tab) |
| Your browser’s maker, through its speech recognition: Google in Chrome, Apple in Safari, Microsoft in Edge | turns what’s said into text while a recording is made | your recording, and our team’s recorded notes of a call with you | Google (opens in a new tab) · Apple (opens in a new tab) · Microsoft (opens in a new tab) |
| Native Update, our own app update service | checks for and delivers page updates to the Android app, signed so the app can check they came from us | app and page versions, release channel, platform, the app’s signing-certificate fingerprints, a random install ID, IP address | this policy |
| Google Analytics 4 | visit counts and sources | visit data | policies.google.com/privacy (opens in a new tab) |
| Amplitude | which pages and clicks lead where | visit data | amplitude.com/privacy (opens in a new tab) |
| Microsoft Clarity | visit replays and heatmaps | visit data, page replays | Microsoft privacy statement (opens in a new tab) |
| Sentry | error reports | error reports, approximate location | sentry.io/privacy (opens in a new tab) |
| Cloudflare (Pages) | delivers the pages | IP address, browser details | Cloudflare privacy (opens in a new tab) |
| GitHub (GitHub Pages) | delivers docs.zaions.com | IP address, browser details | GitHub privacy statement (opens in a new tab) |
We don’t sell your data, and we don’t share it with anyone outside this list unless a law requires us to.
Where is it handled?
These services run servers in several countries, so your data may be handled outside Pakistan and outside the country you live in.
How long do we keep it?
| What | How long |
|---|---|
| A brief, and emails, from someone who doesn’t become a client | 2 years after your last message |
| A client’s brief, emails and project notes | 2 years after the project ends |
| A recording, its transcripts and the AI’s draft, from a brief you send | as long as the brief |
| A recording, its transcripts and the AI’s draft, from a brief you don’t send | deleted within 24 hours |
| A scrambled (hashed) form of your IP address, to count the day’s AI drafts and recordings | up to 2 days |
| Update checks from the Android app (Native Update): a scrambled form of the app’s random install ID, the app and page versions, the platform | up to 14 months |
| Invoices and payment records | 6 years after the invoice date |
| Analytics data (Google Analytics 4, Amplitude) | 14 months |
| Clarity replays | 30 days |
| Clarity’s page statistics | 9 months |
| Error reports (Sentry) | 30 days |
| Settings in your browser | until you clear them |
We don’t label or favorite Clarity recordings, so none is kept past its 30 days.
How do we protect it?
Every page loads over HTTPS. Only the Zaions admins on our admin list can sign in to the admin panel, with Google. Visitors can’t read the briefs: a new brief reaches the database only through one server function, after the spam check passes.
What are your rights?
You can ask us to show you what we hold about you, correct it, delete it, or stop using it. Email hi@zaions.com from the address you used, and we’ll reply within 30 days.
You can also block or delete cookies in your browser’s settings; the Cookie Policy says what that changes.
Depending on where you live, your local law may give you more rights, and you can complain to your data protection authority if there is one.
Is the site for children?
No. zaions.com is for people commissioning software. It isn’t meant for children, and we don’t knowingly keep a brief from anyone under 16. If you think a child has sent us one, email hi@zaions.com and we’ll delete it.
The Zaions Android app and the earlier site
The Zaions Android app is on Google Play (package com.zaions.app, developer Zaions), listed as “Zaions: Software Agency” from version 2.6.0. From version 2.6.0, it’s zaions.com packaged for Android:
- No visitor sign-in, comments or notifications. Version 2.6.0 has no visitor sign-in, no comments and no push notifications, and it doesn’t ask for permission to send notifications.
- Analytics and crash reports. The same tools as the website, Google Analytics 4, Amplitude and Microsoft Clarity, measure how the app is used, so we can see what to improve. Sentry receives crash reports.
- Advertising ID. The app may read your device’s advertising ID for analytics, never for ads; you can reset or limit it in your Android settings.
- Microphone. The app asks for microphone access only when you press the mic on the brief form. Everything else works without it, and you can type in the box instead.
- Updates. Our own update service, Native Update, checks for and delivers page updates, signed so the app can check they came from us. Each check sends the app’s version and the version of its pages, the release channel, your platform, the app’s package name, its key for the service and its signing-certificate fingerprints. It also sends a random install ID the app creates for itself (not a hardware ID) and your IP address. The IP address is used only to answer the check and isn’t kept with it.
Earlier versions packaged the earlier site. They also sent push notifications through OneSignal, using a device push token; turning notifications off or uninstalling stops them, and the token record is deleted with your account when you ask us to. Their sign-in and comments are described below.
The app shows the same promotions as the website: cards for the Zaions team’s own products, chosen by us. No ad network runs in it, and nothing in it tracks you for ads.
Accounts from earlier versions. Earlier versions of the app, and the earlier zaions.com, let you sign in with Google. That created an account with your email address, name, profile picture, a user ID and your saved appearance settings, held in Google’s Firebase, plus any comments you posted. We delete these accounts and their comments once version 2.6.0 is on Google Play, and this section gives the date when it’s done. Until then, you can ask us to delete yours: see Account deletion.
What happens when this policy changes?
The date at the top changes. A change doesn’t bring the notice bar back, so check that date when you return.
Contact
hi@zaions.com · +92 304 6619706 · Zaions, Lahore, Pakistan.
Or use the contact page.