Privacy from the
first request.

How we use it

What we do with the data we collect.

The complete list:

• Respond to inquiries. Contact-form submissions go to our inbox so a human can reply. That is the entire purpose.
• Operate Piper. Messages you send to Piper are processed by the Anthropic API to generate a response, which is returned to your browser. Then the message is gone from our servers.
• Site security. IP, user-agent, and request path are used by Cloudflare and our own functions for rate limiting, bot mitigation, and intrusion detection.
• Aggregate analytics. Cloudflare Web Analytics gives us page-view counts and page-load performance in aggregate. We use it to see which pages are read and whether the site is fast. We never use it to identify individual visitors.

That is the full list. We do not use your data for any other purpose.

How long we keep it

Retention.

We keep the minimum amount of data for the minimum amount of time required to operate the site.

Contact-form submissions

Retained for up to 24 months from the date of submission, or until you ask us to delete it — whichever comes first. After 24 months, the record is removed from our KV namespace as part of normal cleanup.

Piper conversations

Never stored on our servers. History lives only in your browser's sessionStorage and is cleared when you close the tab. The per-IP rate-limit counter expires after one hour.

Web analytics (Cloudflare)

Aggregate page-view data is retained by Cloudflare under its standard Web Analytics retention. It contains no cookies or identifiers that link it to you.

Edge server logs (Cloudflare)

Retained by Cloudflare per their standard log retention (typically days, not months). We do not export, archive, or mirror these logs.

Notification emails (Resend)

Resend retains email delivery records under its own policy. The notification itself lands in our Proton Mail inbox and is kept as ordinary business correspondence. If you ask us to delete your data, we delete the email along with the KV record.

For California residents

California privacy rights.

The California Consumer Privacy Act ("CCPA"), as amended by the California Privacy Rights Act ("CPRA"), gives California residents additional rights. Zeblade is a small business and may not meet the thresholds that make the CCPA apply to us. We honor these rights for California residents anyway — and, in practice, for anyone who asks.

Categories of personal information we collect

Mapped to the CCPA's defined categories. We collect only what is listed below, only when you take the action described, and only for the purposes described in "How we use it" above.

Sources, purposes, and disclosures

• Sources. Directly from you (contact form, Piper messages) or as a byproduct of your visit (Cloudflare edge logs).
• Purposes. As described in "How we use it" — to respond to your inquiry, operate the site, and secure it. No advertising, marketing, or profiling purposes.
• Disclosed to. Only the sub-processors named above (Cloudflare, Resend, Proton, Anthropic). We do not "sell" personal information as defined by the CCPA, and we do not "share" it for cross-context behavioral advertising.

Your CCPA/CPRA rights

• Right to know — request a copy of the personal information we hold about you, plus categories, sources, purposes, and third parties we disclosed it to.
• Right to correct — ask us to fix inaccurate personal information.
• Right to delete — ask us to delete your personal information, subject only to limited exceptions (such as completing a transaction or complying with a legal obligation).
• Right to opt out of sale or sharing — we do not sell or share for cross-context behavioral advertising, so there is nothing to opt out of. You may submit a request anyway and we will confirm in writing.
• Right to limit use of sensitive personal information — we do not collect sensitive personal information, so this is moot. We will confirm in writing if you ask.
• Right to non-discrimination — we will not deny services, charge different prices, or provide a different level of service because you exercised any CCPA right.

How to exercise these rights

Email contact@zeblade.com with "California privacy request" in the subject line. We will respond within 45 days, the CCPA's standard window, though we typically respond within 7 business days. The CCPA allows us to extend the response window by an additional 45 days when reasonably necessary; if we need that extension, we will tell you why before the original window closes.

Authorized agents

You may designate an authorized agent to make a CCPA request on your behalf. We will require verification that the agent is in fact authorized to act for you (typically a signed permission), and we may contact you directly to confirm before we action the request.

One more thing

Client services are governed separately.

This Privacy Notice covers zeblade.com — the marketing site. It does not cover the services we deliver to clients, including the Security Awareness Training platform at training.zeblade.io and advisory engagements.

Data we handle for clients — such as employee names, email addresses, and training records in the training platform — is governed by the agreement we sign with that client, including any data processing or business associate terms. In that relationship, the client decides what data is used and why, and we process it on their behalf.

If your employer enrolled you in Zeblade training and you have a question about your data, start with your employer, or contact us directly.