Privacy policy.

Information we collect

We collect information you give us directly: when you fill in our discovery form, book or join a call, email us, or work with us on an engagement. Specifically:

• Contact and business details: Your name, work email, company and website, plus a phone number and billing details once we start working together.
• Project context: The problem you describe, the areas you think are relevant, where you are today, your timeline and rough budget, plus the workflow details, technical constraints and requirements you share during discovery and delivery.
• Access credentials: API tokens, repository access and cloud connection details needed to build and deploy your system. These are stored encrypted, never shown back in plain text, and revoked at the end of the engagement.
• Data processed by systems we build: Training data, documents, images and operational records that the software we build handles on your behalf.
• Operational data: Application logs, model performance metrics and monitoring data from systems we build and maintain for you.
• Communications: Emails, support messages, and notes from discovery and project calls.

How we use your information

We use the data we collect to:

• Reply to your enquiry and prepare for your discovery call.
• Scope, design, build, deploy and maintain the systems you engage us to deliver.
• Produce progress reports, technical documentation and recommendations.
• Send project-related communications (progress updates, briefings, billing notices).
• Process payments via our payment processor.
• Diagnose technical issues and improve reliability.
• Comply with applicable legal and tax obligations.

We do not use your data to train third-party AI models, build advertising profiles, or share with brokers.

If you're in the UK or EU, the law asks us to name our reasons for using your data. We use it to answer the enquiry you sent and to deliver the work we've agreed with you (a contract, or steps towards one), to run our business sensibly (our legitimate interests), and to keep the records the law requires, such as invoices.

Your data and your customers' data

Building and operating a system on your behalf usually means handling data about your customers: records, documents, images or messages that pass through it. Here's how we treat that data:

• You remain the data controller. We act as a processor, handling your data only on your instructions and only for the agreed engagement.
• Minimum necessary access. We request the narrowest access that lets us do the work, and we hand back or revoke every credential when the engagement ends.

Third parties we work with

We use a small set of reputable providers to run Zovrel and to deliver your project:

• Cloud infrastructure: AWS / Google Cloud (SOC 2 Type II certified).
• AI model providers: Anthropic and OpenAI, through their business APIs, whose terms don't allow your data to be used to train their models.
• Payments: Stripe. We never see or store your full card number.
• Google: discovery form submissions are delivered to us through Google Apps Script and stored in a Google Sheet. When a project needs to connect to your own Google accounts, it uses only the access you explicitly grant.
• Scheduling: Calendly, for discovery and strategy calls. When you book, you're using Calendly's site, and its own privacy policy applies.
• Support: Email and Slack for client communications.

Each provider receives only the minimum data needed to deliver its specific function.

Data storage, security & retention

Your data is encrypted with AES-256 at rest and TLS 1.2+ in transit. Access is gated by role-based controls and audited internally. Integration credentials are stored in a hardware-backed secrets vault and never logged in plain text.

Retention: we keep your data for the length of the engagement and for up to 90 days after it ends, in case you need a handover or an export. After 90 days, it is permanently deleted from our systems, and encrypted backups are rotated out within a further 30 days. If you contact us but we don't end up working together, we delete your enquiry within 90 days unless you ask us to keep in touch. Records we must keep by law, such as invoices, are kept only as long as the law requires.

Your rights

Depending on where you live (GDPR for the UK/EU, CCPA for California, and similar in Canada and Australia), you have the right to:

• Access the personal data we hold about you.
• Correct inaccurate or incomplete data.
• Delete the personal data we hold about you.
• Export a portable copy of your data.
• Restrict or object to certain processing.
• Withdraw consent at any time, where processing is based on consent.
• Complain to your local data protection authority.

To exercise any of these rights, email contact@zovrel.com and we respond within 30 days.

Cookies & tracking

This website doesn't set cookies. We don't use advertising cookies or cross-site trackers, and we don't run Facebook or Google ad pixels.

We don't currently run visitor analytics. To display the site, your browser loads fonts from Google Fonts, which means Google receives your IP address, and our web host keeps standard server logs such as IP address, browser type and the pages requested. If we ever add analytics, we'll choose a privacy-friendly tool and update this page first.

International transfers

Zovrel is based in Lahore, Pakistan, and serves clients in the US, UK, Canada and Australia. Our team works on your data from Pakistan, and our providers may store it in the US or elsewhere, depending on where they operate. For data leaving the UK or EU, we rely on Standard Contractual Clauses approved by the European Commission and the UK Information Commissioner's Office.

Children's privacy

Zovrel is a B2B service for businesses and business owners. We do not knowingly collect personal information from children under 16. If you believe a child has provided us with personal data, please contact us and we will delete it promptly.

Updates to this policy

We may update this policy from time to time as the way we work evolves. The "Last updated" date at the top reflects the most recent revision. For material changes, we'll notify active clients by email at least 14 days before the changes take effect.

Contact us

Zovrel is responsible for the personal data described in this policy. Questions about this policy or about your data? Email contact@zovrel.com and we'll respond within 30 days. Zovrel is based in Lahore, Pakistan.