Privacy Policy

1. What this covers

This policy explains what zeroatom ("we", "us") collects when you use zeroatom.link (the chat interface, your workspace, and the public page we host for you) and how that data is used, stored, and shared.

zeroatom is operated by Neeraj, a sole proprietor based in India, who is the data controller for the data described here.

2. Data we collect

• Account data: name, email, and password hash for the workspace owner and any invited members. New passwords are checked against known-breach corpora via k-anonymity (Have I Been Pwned) before they're accepted; we never see the plain password ourselves.
• Workspace content: the links, bio text, theme, and layout you build through chat, plus the chat messages you send while building your page.
• Page traffic: visits to your published zeroatom.link/[handle] page and any custom domain you connect, including link-click and QR-scan counts, used to power your analytics.
• Billing data: plan, billing address, and subscription status. Card details are collected and stored directly by our payment processor, Dodo Payments, so we never receive or store full card numbers.
• Device and log data: IP address, user agent, and timestamps, used for session security, rate limiting, and abuse prevention.

3. How we use it

We do not sell your data. We do not use your page content to train models ourselves. Chat messages are sent to third-party model providers (see section 4), whose own terms govern how they handle that data.

4. Who we share it with

We share data only with the processors that run the service on our behalf:

• Amazon Web Services: hosts the application (Amplify), sends transactional email such as verification, password-reset, and billing emails (SES), and holds cached data (DynamoDB).
• Postgres on AWS Lightsail: stores account, workspace, and session data.
• Kilo gateway and the model providers it routes to: process the chat messages you send to the page-builder. The gateway forwards requests to third-party AI model providers, and we do not control their retention or training practices.
• Dodo Payments: merchant of record for billing. It processes checkout, subscriptions, and invoicing.
• Cloudflare: provides DNS for zeroatom.link.
• Google: provides OAuth sign-in if you choose to sign in with Google.

We disclose data if required by law, or to protect the security of zeroatom and its users.

5. Cookies and sessions

We use a session cookie to keep you signed in. Published pages do not set any cookie. Page analytics are recorded with a request sent when a page loads or a link is clicked, and your IP address is used only to rate limit those requests. We don't use third-party ad-tracking cookies.

6. Data retention

We retain workspace and account data for as long as your account is active. When you delete your account or workspace, deletion takes effect immediately: you are signed out, your pages are unpublished, your links and QR codes are disabled, and your subscription is cancelled. The data itself is permanently purged after 30 days. Billing records are retained as required for tax and accounting purposes.

7. Your rights

You can export your data and delete your account or workspace at any time from settings. To restore a deleted account or workspace within the 30 days before it is purged, email hello@zeroatom.link. If you're in the EU/UK or India, you have the rights available to you under GDPR or the DPDP Act respectively, including access, correction, and erasure.

8. Changes to this policy

We'll update the "last updated" date above and, for material changes, notify workspace owners by email.

9. Contact

Questions about this policy, and grievances under Indian law: hello@zeroatom.link. This policy is governed by the laws of India.