Privacy Policy

Last updated 5 October 2026

The short version. We collect what we need to run your account and take payment, and nothing more. We don't sell your data, show ads or use tracking cookies; page views are counted anonymously. Payments go through Stripe, accounts through Supabase, and hosting through Vercel. You can ask to see or delete your data at any time.

1. Who is responsible for your data

Logan Holdsworth, trading as Zanshin Flow is the data controller for personal data collected through zanshinflow.com and the Zanshin Flow app. Contact us about privacy at zanshinframework@gmail.com. This policy is written to meet the UK GDPR, the Data Protection Act 2018 and, for EU users, the EU GDPR.

2. What we collect

Account details you give us at sign-up: name, username, email address and password, plus optionally what you trade. Passwords are handled by our authentication provider and stored only as secure hashes. We never see them in plain text.
Billing details. Stripe collects your card details directly. We receive and store your Stripe customer and subscription identifiers, subscription status and billing dates, never your full card number.
Preferences you save in the app, such as layouts, colours and window settings.
Technical data our hosting and authentication providers log when you use the Service: IP address, browser type, pages and API requests, and timestamps.
Messages you send us, such as support emails.

We don't collect special category data, and we don't buy data about you from third parties.

3. How we use it, and our lawful basis

To provide the Service: creating and securing your account, signing you in, saving your preferences, password resets and service emails. Lawful basis: performance of our contract with you.
To take payment and manage your subscription. Contract, and our legal obligation to keep financial records.
To keep the Service secure and working: preventing fraud and abuse, debugging and capacity planning. Legitimate interests.
To improve the Service, using aggregate usage information. Legitimate interests.

We don't send marketing emails without your consent. We don't sell or rent your personal data, and we don't use it for advertising or automated decisions with legal or similarly significant effects.

We use these service providers (processors), who handle data only on our instructions:

Supabase: authentication and database (account details, preferences, subscription status).
Stripe: payment processing and the billing portal. Stripe is also a controller for some payment data under its own privacy policy.
Vercel: website and API hosting (technical logs), and Vercel Web Analytics, which counts page views without cookies and without identifying you.
Google Fonts: the site loads fonts from Google's servers, which receive your IP address.

We may also disclose data where the law requires it, to protect our rights or users' safety, or to a buyer if the business is sold. No personal data is sent to market data providers.

5. International transfers

Some of our providers process data in the United States. Where data leaves the UK or EEA, it is protected by an approved safeguard: the UK-US data bridge or EU-US Data Privacy Framework where the provider is certified, or the UK International Data Transfer Addendum or EU Standard Contractual Clauses.

6. How long we keep it

Account data and preferences: while your account is open. When you ask us to delete your account, we delete them within 30 days.
Billing records: 6 years after the transaction, as UK tax law requires.
Technical logs: kept for the providers' standard retention periods, usually no more than 30 days.
Support emails: up to 2 years after the conversation ends.

7. Cookies and local storage

We only use what's strictly necessary to run the Service, so there's no cookie banner:

zs_access: keeps you signed in. HttpOnly, expires after 1 hour.
zs_refresh: renews your sign-in without asking for your password again. HttpOnly, only sent to our API, expires after 30 days.
Browser local storage for app settings such as drawing colours and layout. It stays in your browser.

We don't use advertising or third-party tracking cookies. We count page views with Vercel Web Analytics, which sets no cookies and doesn't identify individual visitors.

8. Your rights

You can ask us to give you a copy of your data, correct it, delete it, restrict or object to how we use it, or send it to you or another service in a portable format. Email zanshinframework@gmail.com and we'll respond within one month. If you're unhappy with how we've handled your data, you can complain to the UK Information Commissioner's Office (ico.org.uk) or your local data protection authority. We'd appreciate the chance to sort it out first.

9. Security

Traffic is encrypted with HTTPS. Sign-in cookies are HttpOnly so page scripts can't read them. Passwords are hashed, and access to production data is restricted. No system is perfectly secure. If a breach affects your data, we'll tell you and the regulator as the law requires.

10. Children

The Service is for adults aged 18 and over. We don't knowingly collect data from anyone younger.

11. Changes

If we change this policy in a way that matters, we'll update the date above and email account holders before the change takes effect.