Privacy policy

Who we are

Zulu is run by [Your full name], a sole trader based in Ireland, at [Your business address], Ireland. For your account data, we're the data controller under the GDPR.

For anything about your data, email support@zulu.ie.

What we collect

What	Examples	Where it comes from
Your account	Name, email address, and your password, stored only as a secure hash	You, when you sign up
If you use Google to log in	Your Google account's name, email address, whether Google has verified it, and an account id that tells your Google account apart. Never your Google password, and no access to your Google account, contacts or files.	Google, when you choose "Continue with Google"
Your business	Business name, VAT number, addresses, emails, phone numbers, logo and bank details	You, in Settings
What you add	Customers, items, invoices and credit notes	You and your team
Emails we send for you	Who each invoice was sent to, and whether it was delivered	Our email provider
Security records	Your IP address and browser for each login, and failed login attempts	Your browser
Support requests	What you wrote, and the business it was about	You

Your customers' data

The details of your customers that you add to Zulu, such as names, emails and addresses, are yours. For that data, you're the controller and we're your processor: we only use it to run Zulu for you, as you instruct. If you need a data processing agreement, email support@zulu.ie.

Why we use it

Purpose	Legal basis
Running your account and the service you signed up for, including sending your invoices	Performing our contract with you
Emails about your account, such as confirming your address, password resets, invites and trial reminders	Performing our contract with you
Keeping accounts secure and preventing abuse, such as limiting login attempts	Our legitimate interest in a safe service
Keeping records the law requires, such as issued invoices	Legal obligation
Answering support requests	Performing our contract, or our legitimate interest in helping you

We don't use your data for advertising, and we don't make automated decisions about you.

We only share data with the companies that help us run Zulu, under contracts that protect it:

[Hosting provider], which hosts the app and database in the European Union.
Resend, which sends our emails, including the invoices you send. Resend is based in the United States; transfers are protected by the EU Standard Contractual Clauses.
Google, only if you choose "Continue with Google". Google's sign-in button and window come from Google, which then knows you've signed in to Zulu; that's covered by Google's privacy policy. We don't send Google any of your Zulu data.

If we add online payment, card details will be handled by the payment provider, never stored by us. We'll update this policy first.

We may also share data if the law requires it. We never sell personal data.

Cookies

Zulu uses two cookies, both needed for it to work, and no tracking or advertising cookies:

Cookie	What it does	How long
`zulu_refresh`	Keeps you logged in. It can't be read by scripts on the page.	Up to 90 days
`zulu_signed_in`	Lets the home page show "Open Zulu" instead of "Log in". It holds no personal data.	90 days

Any visitor statistics we collect are counted without cookies and without identifying you.

How long we keep it

Data	Kept for
Your account	Until you delete it. Your name and email are then removed.
Customers, items and drafts	Until deleted, then erased after 30 days
Issued invoices and credit notes	Six years, as Irish law requires, even if you delete your account
Login sessions	Until they end, then 90 days
Failed login attempts	One day
Counts of requests from each IP address, to limit abuse	One day at most
Invites	90 days after they're used, declined or withdrawn
Support requests	Kept, with your name and email removed if you delete your account

Your rights

You can ask us to:

give you a copy of your data
correct it
delete it, unless the law requires us to keep it, as for issued invoices
restrict or object to how we use it
give it to you in a format you can take elsewhere

Email support@zulu.ie. We'll reply within one month. Much of this you can also do yourself in Settings: for example, Settings → Export downloads a business's invoices and customers as CSV files, and its invoices as PDFs.

If you're unhappy with how we've handled your data, you can complain to the Data Protection Commission at dataprotection.ie. We'd appreciate the chance to put it right first.

Security

Passwords are stored only as secure hashes. Data is encrypted between your browser and Zulu. Login sessions can be ended on every device at once from Settings, and access to each business is limited to the people its owners invite.

Children

Zulu is for businesses, and isn't meant for anyone under 18.

Changes to this policy

If we change this policy in a way that matters, we'll email account owners before it takes effect. The date at the top shows when it last changed.