Privacy Policy

1. Introduction

This Privacy Policy explains how Zero Optimize Co., Ltd. ("Zero Optimize," "we," "our," or "us") — a company registered in Thailand — collects, uses, shares, and protects personal information when you use the website at zerooptimize.com and our software-as-a-service products (collectively, the "Services").

We comply with Thailand's Personal Data Protection Act B.E. 2562 (PDPA), the EU General Data Protection Regulation (GDPR), the California Consumer Privacy Act (CCPA), and other applicable privacy laws.

2. Data we collect

2.1 Information you provide directly

• Account information: name, email, password (hashed), country, organization name.
• Payment information: billing address, last 4 digits of card. Full card details are tokenized and stored exclusively by our payment processor (Xendit, PCI-DSS Level 1 · ISO 27001), never by us.
• Project data: building parameters you input (location, dimensions, materials). Stored encrypted at rest.
• Communications: emails, support tickets, survey responses.

2.2 Information collected automatically

• Usage data: features used, time spent, click events.
• Device & technical data: IP address, browser, OS, screen size.
• Cookies & similar: see our Cookies Policy.

2.3 Information from third parties

If you sign in via Google or Apple SSO, we receive your name and email. If you upgrade through our payment gateway (Xendit), Xendit shares billing information (name, email, billing country, last 4 of card) with us so we can issue invoices.

3. How we use your data

• Provide, maintain, and improve the Services.
• Process payments and manage subscriptions.
• Communicate with you (transactional emails, product updates, support).
• Analyze usage to improve UX and engineering accuracy.
• Detect, prevent, and respond to fraud, abuse, or security incidents.
• Comply with legal obligations.

Legal bases (GDPR): contract performance (subscription), legitimate interests (improvement, security), legal obligation (tax/audit), consent (marketing emails).

4. How we share data

We do not sell personal information. We share with:

• Service providers who process data on our behalf: Xendit (payment processing & tokenization), Supabase (authentication & database), AWS / Vercel (hosting), Postmark (transactional email), Cloudflare (CDN/security), Google Analytics (anonymized usage analytics).
• Legal/regulatory bodies when required by law, court order, or to protect our rights.
• Successors in case of merger, acquisition, or asset sale (with notice to affected users).

5. Data retention

• Account data: while your account is active + 12 months after closure (for compliance).
• Project data (Free tier): 12 months from last activity.
• Project data (Paid tiers): retained while subscription is active. Exportable anytime.
• Billing records: 7 years (Thai tax law).
• Marketing emails: until you unsubscribe.

6. Your rights

Depending on your jurisdiction, you may have rights to:

• Access your personal data.
• Correct inaccurate data.
• Delete your data ("right to be forgotten").
• Restrict or object to processing.
• Data portability — receive your data in JSON/CSV.
• Withdraw consent at any time.
• Lodge a complaint with a supervisory authority.

To exercise these rights, email hello@zerooptimize.com. We respond within 30 days.

7. Security

We implement industry-standard safeguards: TLS 1.3 in transit, AES-256 at rest, hashed passwords (bcrypt), least-privilege access, quarterly security audits, and a bug-bounty program. No system is 100% secure; we will notify affected users within 72 hours of any data breach as required by GDPR/PDPA.

8. International transfers

Your data may be processed in Thailand (primary), Indonesia / Singapore / Philippines (Xendit regional servers), the United States (AWS / Vercel / Supabase), and the EU. We use Standard Contractual Clauses (SCCs) and ensure adequate protection per GDPR Article 46 and Thailand PDPA Section 28.

9. Cookies

See our dedicated Cookies Policy for details on cookie types, purposes, and how to manage preferences.

10. Children's privacy

Zero Optimize is not directed at children under 16. We do not knowingly collect data from children. If you believe a child has provided us data, contact hello@zerooptimize.com — we will delete it.

11. Changes to this policy

We may update this policy. Material changes are notified via email and in-app banner at least 30 days before taking effect.

12. Contact & Data Protection Officer (DPO)

Zero Optimize Co., Ltd. (บริษัท ซีโร่ ออปติไมซ์ จำกัด)
Ratchada One Building, 8^th Floor
547 Ratchadaphisek Road, Chankasem, Chatuchak, Bangkok 10900, Thailand
Tax ID / VAT: (pending registration)
📞 +66 64-634-1384
📧 hello@zerooptimize.com (DPO & general inquiries)
📧 support@zerooptimize.com (technical support)

EU users: you may also contact your local Data Protection Authority. Thai users: you may file a complaint with the Personal Data Protection Committee (PDPC).