Privacy policy

The controller is Kirlu (CVR 46499573), which owns and operates Zytet. Questions about this policy or about the processing of your information can be sent to hello@zytet.com.

We store only what is needed to deliver the service:

• Account details: the email address you sign up with.
• Check data: the URLs you check, and the results of each check (score, findings and fix manual).
• IP addresses: never stored in clear text, only as a SHA-256 hash with salt for abuse protection. The hash cannot be traced back to you.
• Other personal data: processed only if you actively consent (explicit opt-in). We collect nothing in the background.

We process account and check data to run the service you bought. Under GDPR that is Article 6(1)(b) for the contract, Article 6(1)(f) for the IP hash (abuse prevention), and Article 6(1)(a) for opt-in information; you can revoke consent at any time.

We use no tracking cookies, so you do not see a cookie banner. Web analytics run on Plausible, which is cookie-free and does not track you across sites or devices. If you log in, a technically necessary session cookie is set, used only to keep you logged in. That session cookie is disclosed here because it is the only cookie the product sets.

Your data sits with the vendors that run the product: Supabase (database and login), Vercel (website hosting), Stripe (payments), Plausible (analytics), Simply.com (email on zytet.com), and the AI APIs we call for a visibility check (OpenAI, Anthropic, Google Gemini, xAI Grok, and Perplexity). Each vendor processes that data under its own terms and data processing agreement.

Payment is handled by Stripe. Card details are entered directly with Stripe and never touch our servers. We never see or store card numbers. Stripe processes payment data under its own data-protection obligations, and payment history is kept for the period bookkeeping law requires.

Check data is kept for 24 months by default and then deleted automatically. Account details are kept for as long as the account is active. You can always delete earlier:

• The public free check does not require an email. In the portal you can attach an email to a score check. A delete link with a unique token is then shown once on screen (never by email), so you can delete that check without writing to us.
• If you want the account and all related data deleted, write to hello@zytet.com. We delete within 30 days.

You can request access, correction, or deletion by writing to hello@zytet.com. We do not sell personal information. California residents use the same email to request access or deletion. Kirlu's supervisory authority is Datatilsynet (the Danish data protection authority); that is not the first place a US customer should write.

We never sell your data, and we do not share it with third parties for marketing. You receive no outbound marketing from us unless you have explicitly opted in, and consent can always be revoked in one click.

We use the following sub-processors to run the service. The check calls ChatGPT, Claude, Gemini, Grok and Perplexity.

If we change the policy, we update the date at the top of this page.