1. Who we are
This website is operated by Zerodayops, the company that builds IgnitePII. For the personal data described in this notice, Zerodayops is the data controller under the EU and UK GDPR and the data fiduciary under India's Digital Personal Data Protection Act, 2023 (DPDP Act).
Contact for anything in this notice: hello@zerodayops.com. Please put "Privacy" in the subject line so it reaches the right person.
2. What this notice covers
This notice covers personal data we handle when you visit this website, request a demo, or correspond with us about IgnitePII.
It does not cover the personal data that the IgnitePII product finds inside a customer's systems. That data stays in the customer's environment and under the customer's control. Section 9 explains how.
3. What we collect
When you request a demo
The demo request form collects your name, work email, company, role, the kinds of data sources you use, your environment (connected, restricted or air-gapped), the regulations that apply to you, and anything you write in the message box. Please don't put sensitive personal data, credentials or customer data in the message box.
Technical data
- IP address. We use it to limit each network to five form submissions an hour, which keeps out automated spam. It is also saved with your demo request.
- Hosting logs. Our hosting provider, Cloudflare, processes standard request data such as IP address, browser type and the page requested, to deliver and protect the site.
- Font requests. The site loads its typefaces from Google Fonts, which receives your IP address when your browser fetches them.
Cookies and browser storage
This site sets no advertising or analytics cookies and runs no tracking scripts. It stores one item in your browser's local storage: your answer to the cookie notice, so the notice isn't shown on every visit. You can change that answer at any time from Cookie settings in the site footer, or by clearing your browser's site data.
4. Why we use it, and on what basis
| Purpose | Data used | Legal basis |
|---|---|---|
| Respond to your demo request, arrange a demo or pilot, and follow up about IgnitePII | Form details | Your consent, given with the form's checkbox (GDPR Art. 6(1)(a); DPDP Act s. 6) |
| Prepare for a possible contract with you or your organisation | Form details and later correspondence | Steps taken at your request before a contract (GDPR Art. 6(1)(b)) |
| Block spam and abuse of the form | IP address | Legitimate interests in keeping the service secure (GDPR Art. 6(1)(f)); legitimate use under the DPDP Act |
| Deliver and secure the website | Hosting logs, IP address | Legitimate interests (GDPR Art. 6(1)(f)) |
| Remember your cookie notice choice | One local storage entry | Strictly necessary to honour your choice |
We don't sell your personal data, use it for advertising, or make automated decisions about you that have legal or similarly significant effects.
You can withdraw consent at any time by emailing us. Withdrawal doesn't affect anything we did before it.
5. How long we keep it
| Data | Kept for |
|---|---|
| Demo request and the IP address saved with it | 12 months from submission, then deleted automatically. Deleted sooner if you ask. |
| Spam-protection counter for your IP address | 1 hour |
| Email alert copy of your request in our sales inbox | As long as needed for the enquiry, and no longer than 24 months unless it becomes a customer relationship |
| Correspondence that leads to a contract | For the life of the contract and any period required by law afterwards |
| Cookie notice choice | In your browser until you clear it |
7. International transfers
Our providers may process data in countries other than yours, including the United States and India. Where GDPR applies, transfers rely on the European Commission's Standard Contractual Clauses or another lawful transfer mechanism offered by the provider. Transfers under the DPDP Act are made only to countries not restricted by the Government of India.
8. How we protect it
- All traffic to the site is encrypted with TLS.
- Demo requests are stored with our hosting provider, not in your browser and not in shared spreadsheets.
- The administration area is restricted to approved networks and needs an admin token. Every change made there is logged with its time and source.
- Access is limited to the people at Zerodayops who need it to respond to you.
No system is perfectly secure. If we become aware of a breach affecting your personal data, we will notify you and the relevant authorities as the law requires.
9. How the IgnitePII product handles data
IgnitePII is installed and operated by our customers inside their own networks, including fully air-gapped networks. When a customer uses it:
- The customer is the controller of the data IgnitePII scans. Zerodayops does not host, receive or have access to scan content or findings in the default deployment.
- Raw matched values are never stored. Findings keep the type of data found, its location and a masked preview, such as
•••• •••• •••• 9057. - No external AI or machine-learning service receives content. Detection and OCR run on the customer's own appliance and endpoints.
- Licensing and support terms, including any data processing agreement, are set out in the customer's contract with Zerodayops.
A Record of Processing Activities template for IgnitePII deployments is available to customers on request.
10. Your rights
If you are in the EU, UK or EEA
You can ask us to give you a copy of your data, correct it, delete it, restrict or object to how we use it, or send it to you or another organisation in a portable format. You can also withdraw consent at any time. You have the right to complain to your local data protection authority.
If you are in India
Under the DPDP Act you can ask for a summary of the personal data we process and who we share it with, ask us to correct, complete, update or erase it, withdraw consent, and nominate another person to exercise these rights on your behalf. You can raise a grievance with us first, and if it isn't resolved, with the Data Protection Board of India.
If you are in California
You can ask what personal information we hold about you, ask us to delete or correct it, and not be discriminated against for exercising these rights. We do not sell or share personal information for cross-context behavioural advertising.
How to exercise your rights
Email hello@zerodayops.com with "Privacy request" in the subject. We may ask you to confirm your identity. We will respond within 30 days, or sooner where the law requires.
11. Children
This site and IgnitePII are meant for businesses. We don't knowingly collect personal data from anyone under 18. If you believe a child has sent us their details, contact us and we will delete them.
12. Changes to this notice
We will update this notice when our practices change. The date at the top shows the latest version. If a change materially affects how we use data you have already given us, we will tell you before it takes effect.
13. Contact and grievances
For privacy questions, requests or complaints, email hello@zerodayops.com with "Privacy" in the subject line. This address also serves as our grievance contact under the DPDP Act.