Privacy
Policy

1. Who We Are

CodeByZeno ("we", "us", "our") is a digital product agency building web applications, SaaS platforms, and mobile experiences for businesses in India and the GCC region. Our principal place of business is Kuwait, and we serve clients across India, UAE, Saudi Arabia, Qatar, Bahrain, Kuwait, and Oman.

This Privacy Policy applies to the CodeByZeno website (codebyzeno.com and any subdomain thereof), our website audit tool, our contact forms, and any associated services.

2. What We Collect

We collect information in two ways: information you give us directly, and technical data collected automatically.

We do not collect payment information, government IDs, or sensitive personal data. We do not require an account to use the audit tool.

3. How We Use It

We use collected data strictly for the following purposes:

• To run your website audit and return your scores (URL, audit results)
• To contact you about your audit results or project inquiry via WhatsApp or email
• To understand the volume and type of project requests we receive (aggregate analytics only)
• To improve the audit scoring algorithms based on real-world site patterns
• To respond to your message if submitted via the contact form

4. Data Storage

All lead and contact data is stored in a Supabase PostgreSQL database hosted on AWS infrastructure (EU West region). Supabase is SOC 2 Type II certified.

Data stored includes: name, WhatsApp number, submitted URL, audit scores (JSON), and timestamp. Your email (if provided via contact form) is stored in a separate table with restricted access.

The database is protected by row-level security (RLS) policies. Anonymous users can only insert records — they cannot read other users' data. Read access requires authenticated credentials held only by CodeByZeno team members.

5. Sharing & Third Parties

We do not sell, rent, or trade your personal information. Period.

We share limited data only with the following service providers, strictly to operate our service:

• Supabase — database and edge function hosting (your submitted URL, name, WhatsApp, audit scores)
• Google PageSpeed API — your submitted URL is sent to Google's API to retrieve a mobile performance score. Google's own Privacy Policy applies to this interaction.
• Google Fonts — font files are loaded from Google's CDN. Standard browser request metadata (IP, user agent) is shared with Google per their CDN terms.

We may disclose data if required by law, court order, or to protect the rights and safety of CodeByZeno or others. We will notify you where legally permissible.

6. Cookies

Our website uses minimal cookies. We do not use advertising cookies, tracking pixels, or third-party analytics platforms (such as Google Analytics or Facebook Pixel).

• Session storage — used locally in your browser to preserve audit state between UI steps. No data is sent to a server from session storage.
• Supabase auth cookies — only set if you access the admin dashboard at /admin.html as an authenticated team member.

You can disable cookies in your browser settings without affecting the public audit tool or contact form functionality.

7. Retention

Lead records (name, WhatsApp, URL, scores) are retained for 24 months from the date of submission. After this period, records are permanently deleted from our database.

Contact form submissions are retained for 12 months unless you request earlier deletion or we are in an active project engagement with you.

Server logs (IP addresses, request metadata) are retained for 30 days on Supabase infrastructure before automatic deletion.

8. Your Rights

Depending on your country of residence, you may have the following rights regarding your personal data:

• Access — request a copy of all data we hold about you
• Correction — request correction of inaccurate data
• Deletion — request permanent deletion of your data ("right to be forgotten")
• Portability — request your data in a machine-readable format
• Objection — object to processing of your data for certain purposes

These rights apply to users in the EU/EEA (GDPR), India (DPDP Act 2023), UAE (PDPL), and other jurisdictions with applicable data protection law.

To exercise any of these rights, contact us at hello@codebyzeno.com. We will respond within 30 days.

9. Security

We implement the following technical safeguards:

• All data transmitted between your browser and our servers uses TLS 1.2+ encryption (HTTPS)
• Database access is restricted by row-level security policies — anon users cannot read other records
• Admin dashboard access requires authenticated login credentials
• API keys and secrets are stored as environment variables in Supabase's secrets manager, never in client-side code
• No payment card data is ever collected or stored by CodeByZeno

While we take reasonable precautions, no system is 100% secure. If you discover a security vulnerability, please disclose it responsibly to hello@codebyzeno.com.

10. Children

Our services are intended for business owners, decision-makers, and professionals. We do not knowingly collect personal data from individuals under the age of 16. If you believe a child has submitted data through our site, contact us immediately and we will delete it.

11. Changes to This Policy

We may update this Privacy Policy from time to time to reflect changes in our practices, technology, or legal requirements. When we make material changes, we will update the "Last Updated" date at the top of this page.

Continued use of our website after a policy update constitutes acceptance of the revised policy. If you disagree with changes, please discontinue use and contact us to request deletion of your data.

12. Contact

For any privacy-related questions, requests, or concerns, reach us through any of the channels below. We aim to respond within 2 business days.

• Email: hello@codebyzeno.com
• WhatsApp: +965 6505 4777
• Contact form: codebyzeno.com/contact