Privacy policy

Your clients access portals via a private, unguessable magic link — no client account is created and no client password is stored. Anyone who holds the link can view that single portal. Treat portal links as confidential; if you believe a link has been compromised you can regenerate it from your dashboard.

We use only strictly-necessary cookies: a session cookie (managed by NextAuth) and a CSRF token. No advertising, analytics, or tracking cookies are set. Because these cookies are strictly necessary for the service to function, they do not require your consent under PECR. See our Cookie statement for full details.

We share data with the following processors only to the extent needed to run the service:

• Neon — Postgres database (data stored in the region specified during provisioning; currently [insert Neon hosting region, e.g. eu-west-1]).
• Vercel — application hosting and Blob file storage (servers in the US and globally via CDN).
• Resend — transactional email delivery.
• Stripe — payment processing and subscription management.

Each processor is contractually bound to use your data only for the purpose we specify. Where processors are US-based, transfers are protected by Standard Contractual Clauses or equivalent safeguards as required under UK GDPR Chapter V.

You can delete any project — along with all its files, comments, and approvals — from your dashboard at any time. Deletion is immediate and permanent.

Your account data is retained while your account is active and for a reasonable period thereafter to comply with legal obligations (for example, financial records). To delete your account, email hello@zrelic.com and we will action the request within 30 days. Where self-serve account deletion is available in your account settings, you may use that instead.

Under UK GDPR you have the right to: access the personal data we hold about you; correct inaccurate data; request erasure; restrict or object to processing; receive your data in a portable format; and withdraw consent where processing is based on consent.

To exercise any of these rights, email hello@zrelic.com. We will respond within one calendar month. If you are unsatisfied with our response you have the right to lodge a complaint with the Information Commissioner’s Office (ICO) at ico.org.uk.

If you are a California resident you have the right to know what personal information we collect, to request deletion, and to correct inaccurate information. You also have the right to opt out of the “sale” or “sharing” of personal information. Zrelic does not sell or share your personal information for cross-context behavioural advertising. To exercise your CCPA rights, email hello@zrelic.com.

We use TLS/HTTPS for all data in transit, bcrypt password hashing, parameterised database queries, and scoped magic-link tokens. See our Security statement for more detail.

In the event of a personal data breach that is likely to result in a risk to your rights and freedoms, we will notify the ICO without undue delay (and within 72 hours where feasible). Where the breach poses a high risk to you we will also notify you directly.

We may update this policy from time to time. Material changes will be communicated by email or by a notice in the dashboard. Continued use of Zrelic after changes take effect constitutes acceptance of the updated policy.

The data controller is [Your registered business name], [registered address].

For any privacy enquiry email hello@zrelic.com.