Legal
Privacy Policy
This policy explains what personal data ZUFI LTD collects, why we collect it, who we share it with and what control you have over it. It is written to be read rather than skimmed past, and it reflects what our apps actually do.
1. Who we are
ZUFI LTD ("ZUFI", "we", "us") is a private limited company registered in England and Wales under company number 16715914, with its registered office at Flat 7 Draycote House, Birch Hall Lane, Manchester, England, M13 0XE.
For the purposes of the UK General Data Protection Regulation (UK GDPR) and the Data Protection Act 2018, ZUFI LTD is the data controller for the personal data described in this policy. We have not appointed a Data Protection Officer, as we are not required to; data protection questions go to i@zufi.ltd.
2. What this policy covers
This policy applies to the website at zufi.ltd and to every mobile application published by ZUFI LTD on the Apple App Store and Google Play.
Individual apps differ in what they need. Where an app collects something not described here, or collects nothing at all, that is set out in the app's own store listing and in-app privacy information, which takes precedence over the general description below.
We collect the minimum an app needs to work. We do not sell personal data, we do not share it with data brokers, and we do not use it for advertising profiles. You can ask us to delete it at any time.
3. Data we collect
3.1 Data you give us
- Account details — where an app offers accounts: your email address, a display name, and an authentication identifier. If you sign in with Apple or Google, we receive an identifier and the email address you choose to share; we never receive your password for those services.
- Content you create — anything you enter into or upload to an app, where the app stores it for you.
- Correspondence — your name, email address and the contents of messages when you contact support or submit a form on this site.
3.2 Data collected automatically
- Device and technical data — device model, operating system version, app version, language and region, and a device or installation identifier.
- Diagnostics — crash reports and error logs, which may include a stack trace and the state of the app at the moment it failed.
- Usage data — which screens and features are opened and how often, in aggregate, so we can see what is worth improving.
- IP address — processed transiently by our hosting and security providers to deliver the service and to prevent abuse.
3.3 Purchase data
Purchases and subscriptions are processed by Apple or Google. We never see your card details. We receive a confirmation that a purchase or subscription is valid, together with a transaction identifier and its status, so we can unlock what you paid for.
3.4 What we do not collect
We do not collect special category data (health, biometrics, political opinions, religious beliefs, sexual orientation or similar), we do not track you across other companies' apps and websites for advertising, and we do not buy personal data from third parties.
4. How and why we use it
| Purpose | Data used | Legal basis |
|---|---|---|
| Providing the app and your account | Account details, content you create | Performance of a contract |
| Fixing crashes and defects | Device data, diagnostics | Legitimate interests — keeping our apps working |
| Understanding which features are used | Usage data, device data | Consent, where required; otherwise legitimate interests |
| Answering support requests | Correspondence, account details | Legitimate interests — responding to you |
| Processing purchases and refunds | Purchase data | Performance of a contract; legal obligation for tax records |
| Preventing fraud and abuse | Device data, IP address | Legitimate interests — protecting the service and its users |
| Meeting legal and accounting duties | Purchase data, correspondence | Legal obligation |
We do not use personal data to make decisions about you by automated means that produce legal or similarly significant effects, and we do not carry out profiling of that kind.
5. Legal bases
Where we rely on legitimate interests, we have weighed our interest against your rights and freedoms and concluded that our use is what you would reasonably expect and has a minimal privacy impact. You can object to any of it — see your rights — and we will stop unless we have compelling grounds to continue.
Where we rely on consent — for example, optional analytics on devices where that is required, or marketing email if we ever send it — you can withdraw it at any time, in the app's settings or by emailing us. Withdrawing consent does not affect processing carried out before you withdrew it.
6. Who we share data with
We share personal data only with service providers who process it on our instructions under a written contract, and only as far as is necessary. We do not sell personal data, and we do not share it for other organisations' own marketing.
| Provider | What they do for us | Their policy |
|---|---|---|
| Google LLC / Google Cloud EMEA (Firebase) | App hosting, database, authentication, crash reporting, analytics | firebase.google.com/support/privacy |
| Apple Inc. | App Store distribution, in-app purchases, Sign in with Apple | apple.com/legal/privacy |
| Google Play | Android distribution, in-app billing | policies.google.com/privacy |
| Email and form providers | Delivering and storing your correspondence with us | Named on request |
We may also disclose personal data where we are legally required to — to a court, a regulator or law enforcement acting under proper authority — or where it is necessary to establish, exercise or defend legal claims. If ZUFI LTD is sold or merged, data may transfer to the buyer, who would remain bound by this policy; we would tell you before that happened.
7. International transfers
Our providers may process data outside the United Kingdom, including in the European Economic Area and the United States. Where data leaves the UK, it is protected by one of the safeguards UK law recognises: an adequacy decision made by the UK government, the UK International Data Transfer Agreement, or the UK Addendum to the European Commission's Standard Contractual Clauses. You can ask us for a copy of the safeguard used for a particular transfer.
8. How long we keep data
| Data | Kept for |
|---|---|
| Account details and your content | While your account is open, then deleted within 30 days of closure |
| Crash reports and diagnostics | Up to 90 days |
| Usage and analytics data | Up to 14 months, then deleted or aggregated beyond recognition |
| Support correspondence | 24 months from the last message |
| Purchase and tax records | 6 years from the end of the relevant accounting period, as required by UK tax law |
| Backups | Cycled out within 90 days |
9. Your rights
Under UK GDPR you have the right to:
- Be informed about how we use your data — this policy.
- Access a copy of the personal data we hold about you.
- Rectification of data that is inaccurate or incomplete.
- Erasure of your data, where there is no overriding reason for us to keep it.
- Restrict our processing while a dispute about accuracy or legitimacy is resolved.
- Data portability — a copy in a structured, commonly used, machine-readable format.
- Object to processing based on legitimate interests, and to direct marketing at any time.
- Withdraw consent where consent is the basis we rely on.
- Not be subject to solely automated decisions with legal or similarly significant effects.
To exercise any of these, email i@zufi.ltd, or use the account deletion page for erasure. We respond within one month. Exercising your rights is free; we may charge a reasonable fee or refuse only where a request is manifestly unfounded or excessive, and we will explain if that happens. We may need to verify your identity first.
10. Children
Our apps are not directed at children under 13, and we do not knowingly collect personal data from them. Where an app is rated for a younger audience, it is built to collect nothing beyond what it needs to function and carries no advertising. If you believe a child has given us personal data, email i@zufi.ltd and we will delete it promptly.
In the UK, children aged 13 or over can consent to online services on their own behalf; below that age we require the consent of a person with parental responsibility.
11. Security
We take appropriate technical and organisational measures to protect personal data: encryption in transit (HTTPS/TLS) and at rest on our providers' infrastructure, access limited to those who need it, multi-factor authentication on our administrative accounts, and regular dependency updates.
No system is perfectly secure. If a personal data breach occurs that is likely to result in a risk to your rights and freedoms, we will report it to the Information Commissioner's Office within 72 hours and tell you directly where the risk is high.
12. This website
The site at zufi.ltd sets no advertising or tracking cookies. It stores a single preference in your browser — your light or dark theme choice — which never leaves your device and which we cannot read. Our host keeps standard server logs, including IP addresses, for security and reliability. See the Cookie Notice for the detail.
If you submit a form on this site, the details you enter are sent to us by email and handled as support correspondence.
13. App stores
Apple and Google operate the stores our apps are distributed through, and they collect data about downloads, purchases and reviews under their own privacy policies, as independent controllers. We receive only aggregated reporting from them, not the identity of individual customers. Their handling of your data is outside our control and is governed by the policies linked in section 6.
14. Changes
We update this policy when what we do changes. The effective date at the top always tells you which version is current, and material changes will be announced in the app or by email before they take effect. Continuing to use our apps after a change takes effect means you accept the updated policy.
15. Contact and complaints
For anything in this policy, write to:
ZUFI LTD
Flat 7 Draycote House, Birch Hall Lane
Manchester, England, M13 0XE, United Kingdom
i@zufi.ltd
If you are unhappy with how we have handled your personal data, please tell us first so we can put it right. You also have the right to complain to the UK supervisory authority at any time:
Information Commissioner's Office
Wycliffe House, Water Lane, Wilmslow, Cheshire, SK9 5AF
Helpline 0303 123 1113 ·
ico.org.uk/make-a-complaint