Privacy Policy

Zupral LLC, located in Puerto Rico, is responsible for the personal data described here. You can reach us at privacy@zupral.com.

• Account data: your name, email address, and — if you sign in with a password — a hashed version of it. We never store passwords in readable form.
• Google data: if you sign in with Google, we receive your name, email address, profile picture, and Google account identifier.
• API tokens: the name, scopes, and a hashed form of any token issued to you, plus when it was last used.
• Operational records: the sites, environments, deployments, databases, backups, and DNS records you manage, and an audit trail of who did what and when.
• Technical data: IP address, request metadata, and application logs.
• Form submissions: messages sent through contact forms on websites Zupral hosts, including the name, email address, and message content a visitor chooses to provide.
• Email delivery events: the status of transactional messages we send, such as delivery, bounce, and complaint.

We use the information to:

• Authenticate you and keep your session secure;
• Perform the hosting operations you request, and enforce the scopes attached to your account or token;
• Maintain an audit trail, which exists so an operation on production can be reconstructed afterwards;
• Deliver contact-form submissions to the client whose website received them;
• Notify operators about failed jobs, deployments, and uptime incidents;
• Detect, investigate, and prevent abuse, fraud, and security incidents.

We do not sell personal information or use it for third-party advertising.

When you sign in with Google, Log requests only basic identity scopes: openid, email, and profile. We do not request access to Gmail, Drive, Calendar, or any other Google service data.

Log’s use of information received from Google APIs adheres to the Google API Services User Data Policy, including its Limited Use requirements. Specifically:

• We use that data only to provide and improve user-facing features within Log, principally identifying you at sign-in;
• We do not transfer that data to others except as necessary to provide the Service, for security purposes, or to comply with applicable law;
• We do not use that data for advertising, and we do not sell it;
• We do not allow humans to read that data unless we have your affirmative consent, it is necessary for security or to comply with applicable law, or the data is aggregated and anonymized.

Log uses strictly necessary cookies to keep you signed in and to protect forms against cross-site request forgery. We do not use advertising or cross-site tracking cookies. Blocking these cookies prevents sign-in from working.

We do not sell personal data. We share it only with:

• Providers that operate the Service on our behalf: Google Cloud for compute, storage, and databases, Cloudflare for DNS and proxying, and a transactional email provider;
• The client whose website received a contact-form submission;
• Authorized Zupral personnel, for operations, support, and security;
• Authorities, where required by law or to protect rights, safety, or the integrity of the Service;
• A successor, in a merger, acquisition, or sale of assets, subject to this Policy.

We keep account data while your access is active. Audit records and deployment history are retained longer, because their purpose is to explain what happened to production after the fact. Contact-form submissions are retained only as long as needed to deliver and support them. You may ask us to delete data we hold about you, subject to what we must keep by law or for legitimate operational reasons.

We encrypt traffic in transit, hash passwords and API tokens, keep secrets in a managed secret store rather than in code, restrict production access to authorized personnel, and reach virtual machines through an identity-aware proxy rather than open SSH. No system is immune; if an incident affects your personal data, we will notify you as required by applicable law.

Log runs on infrastructure located in the United States. If you contact us from another jurisdiction, your information will be processed there.

Log is a business tool and is not directed to anyone under 18. We do not knowingly collect data from children, and we will delete it if we learn we have.

You may ask us to access, correct, delete, or provide a copy of your personal data, and to object to certain processing. Write to privacy@zupral.com and we will respond within the period applicable law requires. We may ask you to verify your identity first.

We may update this Policy. We will change the date above and, where the change is significant, give notice by reasonable means.

Zupral LLC
Email: privacy@zupral.com