Privacy policy

This policy explains how Zerqano LLC, an Illinois limited liability company (“Zerqano”, “we”, “us”), handles personal information when you visit zerqano.com, ask us about the product, or use the Zerqano app.

For your visits to the site, your account, your messages to us and information about how the service is used, Zerqano decides how the information is used (the “controller”). For the business data your organization puts into its workspace, Zerqano processes it on your organization’s behalf (the “processor”), under our Terms of service and the data processing addendum.

When you create an account

Your work email address and a password. Passwords are held by our sign-in service, Supabase, which stores them in hashed form. Zerqano does not store them. If you sign in with a username rather than an email address, your password passes through our server once on its way to Supabase, and we do not keep it. If you sign in with Google or GitHub, we receive your name and email address from that provider, and your profile picture if it shares one. You can add your name, a phone number and a profile photo. We need an email address to create an account; the rest is optional. When you accept the Terms of Service we record your user ID, the version, the time and how you accepted.

Your workspace

Whatever your organization puts into Zerqano: products, sales, stock levels, suppliers, purchase orders, documents you upload, and the credentials for systems you connect. This is mostly business data, but it can include names and contact details of your colleagues and suppliers, and the names and addresses of your own customers where your sales records hold them.

When you ask us about Zerqano

The demo request and contact forms ask for your first and last name, work email, company and what you are interested in. If you use the chat assistant on the site, what you type goes to our AI provider, Google Cloud, to produce the answer, and we do not keep a record of it afterwards.

When you pay

Stripe processes payments. We receive your billing contact, plan and subscription status from Stripe; card numbers go to Stripe directly and never reach Zerqano.

Automatically

• IP address, to limit how many requests one address can make and, on some forms, for a Cloudflare Turnstile check that tells people apart from automated submissions.
• Error and performance reports, sent to Sentry when something fails, and for a small sample of page loads and requests: the error, where in the code it happened, timings, the page address and browser details. Sentry’s option to attach personal details is turned off, but an error message can occasionally contain personal information.
• Product events. Whatever you choose in the cookie banner, Zerqano records simple events on its own servers. On public pages these are counts, such as a button clicked, with no identifier attached. In the signed-in app they are tied to your user and organization. We use them to run and improve the product, based on our legitimate interests, and you can object at privacy@zerqano.com.
• Cookies and browser storage, listed in our Cookie policy. PostHog analytics runs only where it is switched on and you choose “Accept all”. It is not switched on at the moment.

If we think your business may be interested

We may collect your company’s name and website, and your name and role, from public sources such as company websites. We use this to decide whether to contact you about Zerqano, and we tell you where we got it when we first write. You can ask us to stop at privacy@zerqano.com, and we will keep only what we need to honour that.

Our own social media accounts

Zerqano publishes to its own LinkedIn and Instagram accounts and reads the statistics of those posts. We do not read your messages, followers or profile on those platforms.

Where the law (such as the EU or UK GDPR) asks for a legal basis, these are ours:

We do not sell personal information, and we do not use it for targeted advertising. We do not make decisions with legal or similarly significant effects about you solely by automated means.

When you use an AI feature, the part of your workspace data the task needs is sent to our AI provider, Google Cloud Vertex AI, and the answer comes back to your workspace. Google’s terms do not allow it to train its models on that data without permission. Google may cache requests for up to 24 hours to speed up responses. If its automated systems flag a request for possible abuse, Google may keep it for up to 90 days and its staff may review it. Some models run on Google’s global network, so a request may be processed in any Google region.

Zerqano does not use your data to train general-purpose AI models or models that serve other customers. It fits forecasting models to your own sales data, for your workspace only.

Zerqano drafts purchase orders. It does not send one to a supplier unless a person in your organization sends it. By default other actions wait for approval too; an admin can choose to let sales-order proposals confirm automatically.

The Security page says more about how AI requests are handled.

• Service providers that run parts of Zerqano for us, such as the database, AI models, email and billing. Each is listed on the Subprocessors page with what it receives.
• Systems you connect, such as your store or accounting system, on your instruction.
• People in your organization, according to their role in the workspace.
• Authorities, when the law requires it, and to protect the rights and safety of our users and of Zerqano.
• A buyer or successor, if Zerqano is sold or merged, under the same protections as this policy.

Zerqano is based in the United States. If you are in the EEA, the UK or Switzerland and give us information directly, for example by creating an account or contacting us, we collect it in the United States. When we share personal information with service providers outside your country, we use the EU Standard Contractual Clauses, the UK International Data Transfer Addendum and the Swiss amendments, or the provider’s participation in the EU-US Data Privacy Framework where it has one. Some AI requests run on Google’s global network and may be processed in any Google region. You can ask for a copy of these safeguards at privacy@zerqano.com.

• Account and workspace data: while your organization uses Zerqano, then as described in the data processing addendum.
• Files you upload for import: the working copy, and the preview made from it, are removed within 48 hours. A processed copy is kept for 30 days so a failed run can be retried.
• Documents you upload, such as invoices: while your workspace exists. Archiving a document hides it and keeps the file. To have one deleted sooner, email privacy@zerqano.com.
• The record that you accepted the Terms: as long as your account exists.
• Demo requests and messages to us: 24 months after our last contact with you.
• Sales prospects: 24 months after we last contacted them, or until they object.
• Error reports: up to 90 days.
• Billing records: as long as tax and accounting law requires, usually 7 years.
• The analytics cookie: 365 days, or until you reject analytics or clear your browser.

Depending on where you live, you can ask us to:

• tell you what personal information we hold about you and give you a copy;
• correct it;
• delete it;
• give it to you, or to another service, in a common machine-readable format;
• stop or limit using it, or object to a use based on our legitimate interests;
• withdraw a consent you gave, such as for analytics, at any time (the Cookie settings link in the site footer).

Email privacy@zerqano.com. We may ask you to confirm your identity. If your information is in a workspace that your organization controls, we will pass your request to that organization and help it answer. If we refuse a request, you can appeal by replying to our answer. We will not treat you differently for using these rights.

You can stop product tips and summaries with the unsubscribe link in any such email. Emails about your account, such as invitations, security notices and trial reminders, will still arrive.

If you are in the EEA, the UK or Switzerland, you can also complain to your data protection authority.

Sign-in, workspace isolation, encryption and how to report a vulnerability are described on the Security page. If a security incident affects personal information that Zerqano controls, we will notify the people affected and the authorities where the law requires it. If it affects information we process for a customer, we will notify that customer, which decides on any further notices.

Zerqano is a business service and is not meant for anyone under 18. We do not knowingly collect information from children.

When we change this policy, we update the date at the top of this page. If a change is significant, we will tell account owners by email before it takes effect.

Zerqano LLC, an Illinois limited liability company. Email privacy@zerqano.com.