Security & Privacy at zigzag

1. Who is responsible for your data?

FA Partners Limited (registered in England & Wales, company number 13771216) is the data controller for all personal data processed through our website and application. This means we determine why and how your personal data is used.

Registered address:

113 Canalside, Redhill, Surrey, England, RH1 2FH

Data Protection Officer:

Sami Abou Saab

For all data protection enquiries — including subject access requests, rights requests, and complaints — please contact our DPO at:

• Email: hello@gozigzag.com
• Post: FA Partners Limited, 113 Canalside, Redhill, Surrey, England, RH1 2FH

2. Lawful bases for processing

Under the UK GDPR, we are required to have a lawful basis for every way we use your personal data. Our Privacy Policy describes what data we collect and how we use it. Below we set out the legal basis for each processing activity.

We never use your data for purposes other than those listed above and in our Privacy Policy.

3. International transfers of personal data

Some of our subprocessors are based outside the United Kingdom and the European Economic Area. The UK GDPR restricts transfers of personal data to countries that have not been assessed as providing an adequate level of data protection, unless appropriate safeguards are in place.

Where we transfer personal data to the United States or other non-adequate countries, we rely on the following safeguards:

• Transfers from the UK: We use the International Data Transfer Agreement (IDTA), incorporated into our contracts with those providers.
• Transfers from the EU: We use the European Commission's Standard Contractual Clauses (SCCs), updated June 2021.

The full list of countries and applicable safeguards for each provider is detailed in our subprocessor list, which is available on request by contacting hello@gozigzag.com.

4. How long we keep your data

We retain personal data only for as long as is necessary for the purpose for which it was collected, or as required by law. Our standard retention periods are:

At the end of each retention period, data is either permanently deleted or irreversibly anonymised. Deletion of account data propagates to our subprocessors within 30 days of account closure.

If you request deletion of your data before a retention period expires, we will honour that request unless a legal obligation requires us to retain it — for example, financial records for tax purposes. In such cases, we will tell you what we are retaining and why.

5. Your data rights (GDPR)

Under the UK GDPR and EU GDPR, you have the following rights in relation to your personal data. We have built self-service tools so you can exercise most of these without needing to email us.

All requests are handled free of charge. We will respond within 30 days as required by Article 12(3). If a request is complex, we may extend this by a further 60 days but will tell you within the initial 30 days.

6. Cookies & analytics

We use strictly necessary cookies (session authentication) that do not require consent. All other tracking is classified as optional and only runs when you click "Accept all" in our cookie banner.

What happens when you decline

• First-party analytics — no page-view or session events are sent. Your browsing is not tracked.
• Sentry Session Replay — replay recording is disabled. Error monitoring continues for service stability but without personal data (no IP address, no email, no cookies sent to Sentry).
• No third-party tracking — we do not use Google Analytics, Facebook Pixel, or any other third-party analytics or advertising cookies. We never have.

What happens when you accept

• First-party analytics — anonymised page-view and session-duration events are collected by our own API and stored in our own database. We use this data solely to improve the product. No data is shared with third parties.
• Sentry Session Replay — a small sample of sessions may be recorded with all text masked and all media blocked to help us diagnose errors.

Your consent choice is stored in your browser's localStorage. You can change it at any time from your Profile → Data & Privacy settings, where a direct cookie consent toggle is available.

7. AI & automated processing

Our platform uses large language models from OpenAI to generate business canvases, brand stories, validation frameworks, MVP requirements, and other content. When you use any AI-powered feature, the business inputs you provide in that feature are sent to OpenAI's API for processing.

What data is sent to OpenAI

• The startup idea, business description, or other inputs you type into an AI-powered form.
• We do not send your name, email address, or other personally identifiable information to OpenAI.

How OpenAI handles your data

• We use the OpenAI API with the data processing terms that confirm OpenAI does not train its models on data submitted through the API.
• API inputs are retained by OpenAI for up to 30 days for abuse monitoring, then deleted. Full details are in OpenAI's Enterprise Privacy page.

Lawful basis

AI processing is necessary to perform the contract we have with you — Article 6(1)(b). The core purpose of zigzag is to generate AI-powered business content, and you use the platform specifically for that purpose.

No automated decision-making

We do not make any decisions that have legal or similarly significant effects on you based solely on automated processing. All AI outputs are tools to assist your own decision-making.

8. How we protect your data

Our Privacy Policy summarises our security practices. Below we provide additional technical detail in accordance with Article 32 of the UK GDPR.

Encryption

All data transmitted between your browser and our servers is encrypted using TLS 1.2 or higher. Data at rest — including databases, backups, and file storage — is encrypted using AES-256.

Access controls

Access to production systems containing personal data is restricted to a small number of authorised engineers. All administrative access requires multi-factor authentication (MFA). We apply the principle of least privilege: no team member has broader access than their role requires.

Password security

User passwords are managed by our authentication provider, Auth0 (Okta). We never store your password in plain text. Auth0 hashes passwords using bcrypt with an appropriate cost factor before storage.

Infrastructure

Our application is hosted on Vercel with database infrastructure on DigitalOcean Managed PostgreSQL. Both providers maintain SOC 2 Type II certifications. We conduct automated vulnerability scanning on each deployment.

Security monitoring

We maintain audit logs of authentication events and access to personal data. Error and performance monitoring is provided by Sentry. Infrastructure metrics are monitored continuously via Grafana Cloud with automated alerting for security events.

Vulnerability disclosure

If you discover a security vulnerability in our service, please report it responsibly to hello@gozigzag.com. We commit to acknowledging your report within 48 hours and keeping you informed of our progress.

9. What happens if there is a data breach?

Despite our security measures, no system is entirely immune to incidents. In the event of a personal data breach that is likely to result in a risk to your rights and freedoms, we will:

• Notify the relevant data protection authority within 72 hours of becoming aware of the breach, where legally required.
• Notify affected users directly and without undue delay where the breach is likely to result in a high risk to their rights and freedoms. We will tell you what happened, which data was involved, the likely consequences, and the steps we are taking.

We maintain a formal incident response procedure and conduct post-incident reviews to prevent recurrence. All breaches, whether or not legally notifiable, are logged in our internal breach register.

If you believe your account or data has been compromised, please contact hello@gozigzag.com immediately.

10. Our approach to data protection compliance

We take a privacy-by-design approach, meaning privacy considerations are embedded into how we build and operate our product — not treated as an afterthought.

Record of Processing Activities

We maintain an internal Record of Processing Activities (RoPA) documenting every way we process personal data, as required by Article 30 of the UK GDPR.

Data Protection Impact Assessments (DPIAs)

In accordance with Article 35 of the UK GDPR, we have conducted Data Protection Impact Assessments for processing activities that may pose a high risk to data subjects. In particular, a DPIA has been completed for our use of AI (OpenAI) to process user business data. The assessment concluded that the residual risk is low after mitigations — including data minimisation (no personal identifiers sent to OpenAI), encryption in transit and at rest, and contractual safeguards under our Data Processing Agreement. The DPIA is reviewed annually or whenever our processing activities change materially.

Automated retention enforcement

The retention periods listed in section 4 are enforced automatically by a daily scheduled job that purges expired analytics events, error logs, API metrics, and LLM metrics. This ensures our stated retention schedule is not just aspirational but actively enforced in production.

Our commitment

We review this trust page and our underlying compliance programme at least every 12 months, and whenever we make material changes to how we process personal data. The "last reviewed" date at the top of this page reflects the most recent review.