Privacy Policy

Who we are

Zephlo provides a sponsorship CRM for organisations that sell sponsorship, and is the controller of the personal data described in this policy. This policy explains what personal data we collect through this website, why we collect it, and the rights you have over it. You can contact us about anything in this policy at hello@zephlo.co.

What we collect and why

There are three ways to give us your details on this site, and we only collect what each one needs. Requesting early access collects your name, email address, organisation name and role. The contact form collects your name, email address, an optional company or organisation, and whatever you write in the message. The short sign-up box on some pages collects your email address only.

We use it for one purpose: to reply to you and talk to you about the product, as you consented to when you ticked the box. We record which form you used so we can tell an enquiry from an access request.

We do not sell this data, share it with third parties for marketing, or use it for anything beyond that conversation without asking you first.

Legal basis

We process your data on the basis of consent (GDPR Article 6(1)(a)), which you give explicitly via the checkbox on the early-access form. You can withdraw consent at any time by emailing us, and we will delete your data.

Where your data is stored

What you submit is stored in our database in Ireland, hosted with Supabase, and encrypted in transit and at rest. The forms themselves are processed by servers in Dublin, so your details stay within the European Union from the moment you press send.

Transfers outside the EU

We keep this simple: your data stays in the EU. The one exception is our booking page, which embeds Calendly, a company based in the United States. If you use it to schedule a call, Calendly receives your booking details directly. You can avoid that entirely by emailing us to arrange a time instead.

Our infrastructure providers are US-headquartered companies operating European data centres. We have chosen European regions wherever the option exists, and we will update this section if that ever changes.

How long we keep it

We keep waitlist data until you're onboarded as a customer, you ask us to delete it, or the early-access programme ends, whichever comes first.

Your rights

Under the GDPR you have the right to access, correct, export, and erase your personal data, and to object to or restrict its processing. To exercise any of these rights, email us and we will respond within 30 days.

If you believe we have mishandled your data, you have the right to lodge a complaint with your local supervisory authority. In Spain that is the Agencia Española de Protección de Datos (aepd.es).

Changes to this policy

If we change how we handle your data, we update this page and change the date at the top before the change takes effect. If a change materially affects data you have already given us, we will email you rather than rely on you noticing.

Cookies

This website sets no cookies. None for analytics, none for advertising, none at all, which is why you have not been asked to accept anything. We also do not use local storage or similar techniques to follow you between pages or visits.

That is a deliberate choice. We would rather know less about you than make you dismiss a consent banner before you can read about our product. If we ever add analytics, we will use a privacy-respecting tool that counts visits in aggregate without cookies and cannot identify you individually, and we will update this policy before switching it on.

There is one exception, on our booking page. It embeds Calendly so you can schedule a call without leaving the site. When that page loads, Calendly receives your IP address and may set its own cookies, and any details you enter when booking (your name, email and answers) are processed by Calendly as well as by us. Calendly is a separate company with its own privacy policy at calendly.com/privacy. If you would rather not use it, email us and we will arrange a time by hand.

Signing in to the Zephlo product itself is a separate matter: the application uses a strictly necessary cookie to keep you logged in, and a further one to remember your display preferences. Neither is used for tracking or advertising. Use of the product is covered by the agreement your organisation enters into when it is onboarded.