Privacy Policy

1. Who we are

Zortal is operated by Bhadala Capital Private Limited ("Zortal", "we", "us" or "our"), a company registered in India. Zortal is an AI website builder: you describe what you do, and we build, host and help you run a website for it.

This policy explains how we handle personal information when you use our website (zortal.io), the Zortal web app and our Android app (together, the "Service"). It also explains how we handle information about visitors to the websites our customers build with Zortal — see section 3. Your use of the Service is also governed by our Terms of Service.

2. Personal information we collect

Information you give us

• Account details — your name, email address, password (stored only as a one-way hash) and, if you add them, a profile photo.
• Your sites' content — what you tell us about your business or project, the pages, text, images, files, blog posts and settings of your sites, and the domains you connect or buy.
• AI conversations — the messages you send when you build or edit with AI, and the replies.
• Communications — what you send us when you email us or ask for support.
• Billing records — your plan, purchases and invoices. Card details go directly to our payment provider and never reach us (see section 6).

Information from other sources

• Google sign-in — if you sign in with Google, we receive your name, email address and profile picture. We never receive your Google password.
• Public information you point us to — when you give us an existing website address or a business name, we read publicly available pages and business listings to help build your site.

Information collected automatically

• Device and connection data — IP address, browser and device type, operating system, app version and approximate location derived from the IP address.
• Sign-in sessions — when you signed in and from which browser or device.
• Usage data — the pages you view and how you use them (clicks, scrolls, time on page). See section 4.
• Push notification tokens — if you allow notifications in our mobile app.

Mobile app permissions

• Camera and photos — used only when you take or choose a photo to add to your site or to the Photo Stamp tool.
• Location — used only when you use the Photo Stamp tool to add your current location to a photo. We never track your location in the background.

You can turn these permissions off at any time in your device settings.

3. Your website visitors' information

When someone fills in a form or uses the chat on a website built with Zortal, we receive what they send — typically their name, email address, phone number and message. We store it for the site's owner in Messages and email form submissions to the owner.

For this information, the site owner decides what to collect and why, and we process it on their behalf. If you are a visitor with a question about your information, please contact the owner of the website you used; you can also contact us at hello@zortal.io.

• We keep a visitor's IP address only as a keyed one-way hash, used to limit spam. We never store the address itself.
• If a site uses chat, the visitor's browser stores a chat token so the conversation can continue.
• Websites built with Zortal include no analytics or advertising trackers. They load fonts from a web font service, which receives the visitor's IP address as any font service does.

4. Cookies, analytics and AI

• Essential cookies keep you signed in and secure your session. The Service doesn't work without them.
• Analytics — on Zortal's own website and app we use an analytics service that records how pages are used, including clicks, scrolls and page views, and sets its own cookies. When you are signed in, it links this to your account so we can help you when something goes wrong. In the signed-in app, the text on screen is masked, so these recordings don't contain your sites' content or your Messages. You can block these cookies in your browser settings.
• No advertising. We don't use advertising cookies or trackers, and we don't sell or share personal information for targeted advertising.
• AI. When you build or edit with AI, your messages and the site content needed to answer them are sent to our AI providers to produce the result. Zortal doesn't train AI models on your information. Our providers process it under their own data terms.

Some browsers send "Do Not Track" signals. The Service does not currently respond to them.

5. How we use personal information

• To provide the Service — create and manage your account, build, host and publish your sites, connect domains, deliver your visitors' messages, and give you support.
• To communicate with you — sign-in and verification emails, billing and service messages, and replies to your requests. We don't currently send marketing emails; if we ever do, each one will have an unsubscribe link.
• To improve the Service — understand how it is used and fix what doesn't work.
• For security and to prevent abuse — protect accounts, limit spam, and detect fraud or attacks.
• To meet legal obligations — keep tax and billing records, and respond to lawful requests.
• Aggregated statistics — we may combine information into statistics that don't identify you, and we won't try to re-identify them.

We don't sell personal information.

6. How we share personal information

We share personal information only with:

• Service providers who run parts of the Service for us, and only for that purpose: hosting and databases, file storage, building sites, AI, email delivery, analytics, address lookup and web research, and domain registration.
• Our payment provider, which handles checkout, subscriptions and invoices as the merchant of record. It collects your payment details directly.
• People you choose — editors you invite to a site, and anyone you hand a site over to.
• The public — your published site, and its preview address, can be seen by anyone, including search engines.
• Professional advisers such as lawyers and auditors, when they work for us.
• Authorities, when we believe in good faith that the law requires it, or to protect the rights, safety or property of our users, the public or us.
• A buyer or successor, if our business or its assets are sold, merged or reorganised. This policy will continue to apply to your information.

For a list of the service providers we use, contact us at hello@zortal.io.

7. How long we keep it

• We keep your account information and your sites for as long as your account is open.
• Your visitors' messages and form submissions stay until you delete them or the site is deleted.
• When you ask us to delete your account, we delete your account, sites and files within 30 days. Copies in our backups are removed as those backups expire.
• We keep billing records for as long as tax and accounting law requires, and information needed to resolve disputes or enforce our agreements.

Signed-in sessions end after 7 days without use. See how account deletion works.

8. Your choices and rights

Wherever you are, you can:

• see and update your account details in the Service;
• ask for a copy of your personal information and your sites' data;
• ask us to correct information that is wrong;
• ask us to delete your account and data;
• turn off the camera, location and notification permissions in your device settings;
• block analytics cookies in your browser.

To make a request, email hello@zortal.io from your account's email address. We may need to confirm your identity first, and we'll reply within 30 days. We won't treat you differently for using your rights.

United States

Depending on your state, you may have rights to know what we collect and why, to access, correct and delete it, and to appeal a decision about your request — email us at hello@zortal.io to appeal. We don't sell personal information or share it for targeted advertising, and we don't use it for profiling that has legal or similarly significant effects. We use precise location only when you use the Photo Stamp tool, and never to infer characteristics about you. We don't knowingly collect personal information from anyone under 16.

European Economic Area and United Kingdom

We process your information to provide the Service you asked for (performance of a contract), for our legitimate interests in securing and improving the Service, to meet legal obligations, and with your consent where we ask for it (such as location access) — you can withdraw consent at any time. You can also object to or ask us to restrict processing, and ask to receive your data in a portable format. If you are unhappy with how we handle your information, you can complain to your local data protection authority.

India

Under the Digital Personal Data Protection Act, 2023, you can access, correct, complete and erase your personal data, nominate someone to exercise your rights, and raise a grievance. Contact us at hello@zortal.io; if your grievance isn't resolved, you may approach the Data Protection Board of India.

9. Security

We use technical and organisational safeguards to protect your information, including encryption in transit and at rest and access limited to the people you invite. No system is perfectly secure, so we can't guarantee absolute security. Read more on our Security page.

10. International transfers

We operate from India and use service providers in other countries, including Singapore and the United States. Your information may be processed in countries whose privacy laws differ from those where you live. We share only what each provider needs to do its job.

11. Other websites

The Service and the sites built with it may link to websites and services run by others. We don't control them, and their own privacy policies apply.

12. Children

Zortal is not intended for anyone under 18, and we don't knowingly collect personal information from children. If you believe a child has given us personal information, contact us and we will delete it.

13. Changes to this policy

We may update this policy. When we do, we'll change the "Last updated" date above, and where the change is significant we'll also tell you by email or in the Service.

14. Contact us

For questions about this policy, to make a privacy request or to raise a grievance, contact:

• Bhadala Capital Private Limited
• 1204B, Anand Prima, Haldighati Gate, Pratap Nagar, Jaipur, Rajasthan 302020, India
• Email: hello@zortal.io