Legal
Privacy Policy
This policy explains which personal data Zero Employees B.V. collects when you visit our websites or use AureliusOS, why, who we share it with, how long we keep it, and the rights you have. It applies together with our Terms and Conditions.
1. Who is responsible
The controller is Zero Employees B.V., a private limited company (besloten vennootschap) incorporated under the laws of the Netherlands. For anything about privacy, including requests to exercise your rights, use our contact form. We have not appointed a data protection officer, as the law does not require one for our processing; the form reaches the people responsible.
Content your organisation puts into AureliusOS is processed on behalf of that organisation, which is the controller of it; we act as its processor under our Data Processing Agreement. If your question concerns such content, please contact your organisation first. Everything else in this policy, such as account, billing, security and website data, we process as controller.
2. The data we collect
- Account data: your name, email address, password (stored only as a one-way hash), language, and, if you sign in with Google or Microsoft, the account identifier and verified email address that provider shares with us. If you set up two-step sign-in, a record that you use an authenticator app.
- Organisation data: the organisations you belong to, your role, the apps and seats assigned to you, and invitations you send or receive (including the invitee’s email address).
- Billing data: the billing contact, company name, address and VAT number, subscriptions and invoices. Card and bank details are entered at Stripe and stay there; we receive only details such as the card brand, last four digits and expiry date.
- Customer content: what you and your colleagues enter, upload or generate in the apps, including any calendar or email data you choose to connect.
- Usage, device and security data: IP address, browser and device information, the pages and functions you use, timestamps and request identifiers, and an audit trail of significant actions such as role, seat, invitation and billing changes. Error reports, which can contain such technical data.
- Communications: your messages to us, such as support requests and feedback.
- Website analytics: page views measured with a self-hosted, privacy-friendly analytics tool that uses no cookies and builds no profiles of individual visitors.
We receive data from others when a colleague invites you (your email address and the role offered), when you sign in with Google or Microsoft, and when Stripe confirms a payment. Some research features let users look up publicly available information about companies and people; the organisation that runs such a search decides what is searched and is responsible for having a lawful basis.
3. Why we use it, and our legal bases
- To create and run your account and organisation, provide the apps you use, and send service emails such as confirmations, invitations, password resets and billing notices: performance of our contract with you or your organisation.
- To take payments, keep accounting records and meet tax and other legal duties: performance of the contract and compliance with legal obligations.
- To keep the Service secure, prevent abuse and fraud, keep audit trails, fix errors and keep backups: our legitimate interest in a secure and reliable service.
- To understand, in aggregate, how the websites and the Service are used and to improve them: our legitimate interest in improving our products.
- To answer your questions and support requests: performance of the contract, or our legitimate interest in answering you.
- To send product news by email, if we do: your consent, or for existing customers our legitimate interest, always with an easy way to unsubscribe.
- To establish, exercise or defend legal claims and comply with lawful requests from authorities: legal obligation or legitimate interest.
Where we rely on legitimate interests, we have weighed them against your interests and rights; you may object at any time (see section 9). We do not use personal data for automated decisions that have legal or similarly significant effects on you.
4. AI processing
When you use an AI feature, the content needed to answer the request is sent to an AI model: one we run on infrastructure we control, or one offered by an AI provider listed in section 5, which processes it under its business API terms to answer that request. We do not use your content to train AI models, and we use providers whose API terms do not let them train on it by default.
6. International transfers
Our main data stores are in the EU. Some providers process data outside the European Economic Area. Transfers to the United Kingdom rely on the European Commission’s adequacy decision. Transfers to the United States rely on the EU-U.S. Data Privacy Framework where the provider is certified, and otherwise on the European Commission’s Standard Contractual Clauses. Transfers to other countries, such as China, rely on Standard Contractual Clauses with supplementary measures. You can ask us for a copy of the relevant safeguards.
7. How long we keep data
- Account and organisation data: for as long as the account or organisation exists. After an account is closed or an organisation’s subscriptions end, we delete or anonymise it within 90 days, unless we must keep it longer by law.
- Sign-ups that were never confirmed: deleted after 7 days.
- Invitations: valid for at most 14 days; afterwards they are kept with the organisation’s records.
- Billing and accounting records: 7 years, as Dutch tax law requires.
- Audit trails of role, seat, invitation and billing changes: for as long as the organisation exists, so its records stay accountable.
- Security logs and error reports: for a limited period, normally no longer than 12 months, unless needed to investigate an incident.
- Backups: overwritten on a rolling schedule.
8. Security
We protect data with encryption in transit, access controls enforced in the database, two-step sign-in for privileged roles, hashed passwords and tokens, the principle of least privilege, and logged administrative changes. No system is completely secure; if a breach affects your personal data, we will inform you and the authorities as the law requires.
9. Your rights (EU, EEA and UK)
You have the right to access your personal data, have it corrected, have it erased, restrict its processing, receive it in a portable format, and object to processing based on legitimate interests. Where we rely on consent, you can withdraw it at any time without affecting earlier processing.
To exercise a right, use our contact form. We may ask you to confirm your identity, and we answer within one month, which the law allows us to extend by two months for complex requests. You may also complain to a supervisory authority: in the Netherlands, the Autoriteit Persoonsgegevens, or the authority where you live or work.
10. Your rights in the United States
If you live in California or another US state with a consumer privacy law, this section applies to you in addition to the rest of this policy.
- Categories we collected in the past 12 months: identifiers (such as name, email and IP address), customer records and commercial information (such as billing details and subscriptions), internet or other electronic network activity, professional information (such as organisation and role), and account login credentials, a category of sensitive personal information that we use only to provide and secure your account.
- Sources, purposes and recipients: as described in sections 2, 3 and 5. We disclose personal information to service providers and contractors for business purposes only.
- We do not sell personal information or share it for cross-context behavioural advertising, and we have not done so in the past 12 months. We do not use or disclose sensitive personal information for purposes that would give you a right to limit it.
- Your rights: to know and access the personal information we hold about you, to have it deleted, to have it corrected, and to receive a portable copy. We will not discriminate against you for exercising them.
- To make a request, use our contact form. We verify requests by confirming control of the email address on the account, and we answer within 45 days. An authorised agent may make a request for you with your signed permission.
- If we decline your request, you may appeal by replying to our answer; if you remain dissatisfied, you may contact your state attorney general.
- We honour Global Privacy Control signals as an opt-out of sale and sharing, though we do neither. There is no common standard for “Do Not Track” signals, and our websites do not respond to them.
12. Children
The Service is for businesses and is not directed at children. We do not knowingly collect personal data from anyone under 16. If you believe a child has given us personal data, contact us and we will delete it.
13. Changes to this policy
We may update this policy. The date at the top shows when it last changed. We announce material changes by email or in the Service before they take effect.
14. Contact
Questions about privacy go to Zero Employees B.V. through our contact form.