Privacy Policy

Two roles, and why it matters

ZevAuth sits between a developer and the people who sign in to their app, so who is responsible for which data depends on whose data it is.

For your own account with us — the workspace you create, your team, your billing — we are the data controller. For the end-users who sign in through your application, we are a processor: we hold and process their identity data on your instructions, and you are the controller of it. That split runs through everything below.

What we collect

• Account data: your name, email, workspace and project names, and team membership.
• End-user identity data, processed on behalf of developers: email address, name, hashed credentials, the social or ZevID accounts a user links, and the metadata a developer sets.
• Session and security data: sessions, device and browser information, IP address, and authentication events such as sign-ins, failures and lockouts.
• Usage and technical data: logs and diagnostics needed to run and secure the service.
• Billing data: handled by ZevPay. We store which plan you are on, not your card number.

How we use it

• To provide the service: authenticate users, issue and verify sessions, and run the features you switch on.
• To secure it: detect and block attacks, rate-limit abuse, and reject breached passwords.
• To support you: answer questions and investigate issues you report.
• To bill you, if and when a paid plan applies to your account.
• To meet legal obligations, and to enforce our terms.

Legal bases

Where the GDPR or a similar law applies, we rely on: performance of our contract with you; our legitimate interest in running and securing the service; your consent, where we ask for it; and compliance with legal obligations. For end-user data we process as a processor, the lawful basis is the developer’s to establish and document.

Who we share it with

We do not sell personal data, and we do not use it for advertising. We share it only with the providers that make the service work, under contracts that hold them to this policy:

• Infrastructure and database hosting, to run the service.
• ZevPay, for billing and invoices.
• ZevID, when a user chooses to sign in with their ZevID account.
• Email delivery, to send verification, magic-link and notification emails.
• Authorities, only where the law requires it and after we have checked the request.

How we protect it

Data is encrypted in transit and at rest. Passwords are hashed, never stored in the clear. Each tenant’s data is isolated at the database level with row-level security, so one project cannot read another’s. Access inside the company is least-privilege and logged.

How long we keep it

We keep your account data while your account is open, and for a short period afterwards to meet legal and accounting obligations. End-user data is kept for as long as the developer’s configuration and instructions require; when a developer deletes a user or closes a project, the associated data is deleted or anonymised. Every user record is exportable and deletable through the same REST API you manage it with.

International transfers

Running the service may involve transferring data to countries other than your own. Where we do, we use recognised safeguards such as standard contractual clauses to keep the protection with the data.

Your rights

Depending on where you live, you may have the right to access, correct, delete, or export your personal data, and to object to some processing. For your own account, contact us and we will act on it. If you are an end-user of an app built on ZevAuth, the developer of that app is the controller of your data — contact them first, and we will help them respond.

Cookies

The marketing site uses only what it needs: a preference for your colour theme, and the essentials of a session where you are signed in. We do not run advertising or cross-site tracking cookies.

Children

ZevAuth is a tool for developers and is not directed to children. We do not knowingly collect data from children through our own site.

Changes

If we change this policy in a way that matters, we will say so by email or on the site before it takes effect. The date below is when this version took effect.

Contact

Privacy questions: privacy@zevauth.com. Security reports: security@zevauth.com. Anything else: hello@zevauth.com.