Privacy Policy
What personal data Zeroko processes, why, for how long, and your rights.
Last updated 2026-10-24
Who we are
[the operator's name] ([the operator's tax id]), [the operator's address], is the controller of the personal data described here. Write to [email protected] about anything in this policy.
For the personal data your own services process, you're the controller and we're your processor: see section 6 of the Terms.
What we process, and why
| Data | Why | Legal basis |
|---|---|---|
| The accounts you sign in with, from GitHub or Google: their ids, name, email and picture (and your GitHub username) | To sign you in and show who you are to your teams | Contract |
| Sessions: the IP address and browser of each sign-in, and when | To keep you signed in, and to show and end your sessions | Contract, and our legitimate interest in security |
| Your workspaces: their names, plans, members, roles and invite links | To run the Service | Contract |
| Billing: the plan, its status, and Polar's customer and subscription ids | To bill paid plans and apply them | Contract, and legal obligations |
| Usage: each workspace's requests a month, its number of services and its storage | To hold each workspace to its plan | Contract |
| Messages you send us | To answer them | Our legitimate interest, or contract |
We don't receive your card details: Polar and its payment processors handle them. We don't sell personal data, and we don't use it for advertising.
No tracking in your services
There is no analytics or telemetry in the runner, the panel or your services, beyond the usage above, which only counts. What your services receive (requests, their contents, their visitors' addresses) is yours: it stays on your workspace's runner, and we look at it only to keep the Service running, to investigate abuse, or when you ask us to.
Your runner keeps what your services print (their logs) for 7 days and their request metrics (counts, statuses and timings, without addresses) for 30 days, so you can see them in the panel. The runner's own log records which token called its API, and from which address, for security.
On this website
zeroko.space counts visits with analytics we host ourselves, without cookies and without personal data: no address is stored, and visitors can't be followed from page to page or from one day to the next.
The site and the panel set only the cookies they need to work: your theme, and your session in the panel while you're signed in. None track you or serve advertising.
Who else processes it
Our subprocessors, each only for its purpose: GitHub and Google for signing in, Polar for payments, and the provider our machines run on. Some of them are outside the European Economic Area; transfers rely on the European Commission's adequacy decisions (such as the EU-US Data Privacy Framework) or its standard contractual clauses. We share data with authorities only when the law requires it.
How long we keep it
- Your account, sessions and workspaces: while your account exists. Ended sessions go when they expire; deleting a workspace deletes it at once; deleting your account deletes the rest, apart from what follows.
- Billing records: as long as tax and accounting law requires (in Spain, generally six years), mostly kept by Polar as merchant of record.
- Messages: as long as needed to answer them, and no more than two years.
Your rights
You can ask us to access, correct, delete, restrict or move your personal data, and object to how we process it, by writing to [email protected]. Most of it you can see and change in the panel, and deleting your account in Account deletes it. We answer within a month.
You can also complain to a data protection authority: in Spain, the Agencia Española de Protección de Datos (aepd.es), or the one where you live.
Security
Each workspace runs on its own runner, in its own sandbox (gVisor), on its own volume. Tokens are kept only as hashes, nodes' tokens are encrypted, and everything between you and Zeroko travels over TLS.
Children
Zeroko Cloud isn't for anyone under 16, and we don't knowingly process their data.
Changes
We'll tell you of changes that matter, in the panel or by email, before they apply. The date at the top says when this policy last changed.