Privacy Policy

1. Data controller

Zeno Life Plan (“Zeno Life Plan”, “we”, “us”) is the controller of the personal data described in this policy, except where we act as a processor on behalf of an organisation that has deployed the platform to its people. For data-protection matters you can reach us through our secure contact form, as set out in section 15.

2. Data we collect

We collect: (a) account data such as name, work email and organisation; (b) Life Plan content you create — reflections, objectives and related entries; (c) usage data such as pages viewed and progress; and (d) technical data such as device type and, subject to consent, cookie identifiers. We practise data minimisation and collect only what the methodology requires.

When you submit a form on this website, such as a demo request or a privacy enquiry, your enquiry is stored on our behalf by Supabase (database infrastructure) and the resulting notification email is delivered by Resend (email delivery). The forms are protected against spam and automated abuse by hCaptcha. These providers process what you submit only to receive, store and deliver your enquiry and to prevent abuse. Enquiries are kept for up to 24 months and then deleted. To limit abuse we briefly keep a salted, one-way hash of your IP address — never the raw address — which is removed within 24 hours.

3. Purposes of processing

We process personal data to: provide and secure the platform and your Life Plan; deliver the individual and enterprise programmes; produce aggregated cohort insight for organisations, protected by a minimum group size; respond to enquiries; comply with legal obligations; and, with consent, send communications. We apply purpose limitation — we do not repurpose your data for unrelated uses.

4. Legal bases

Under the GDPR we rely on: contract (to provide the service you or your organisation signed up for); legitimate interests (to secure, maintain and improve the platform, balanced against your rights); consent (where we rely on it — for example before using any optional technology such as analytics — which you can withdraw at any time); and legal obligation (to meet regulatory duties).

5. Controller and processor roles

Where an organisation deploys Zeno Life Plan, the content of an individual’s Life Plan is private to that individual and is never disclosed to the employer. The organisation receives only aggregated insight, protected by a minimum group size, and cannot access personal plan content or identify individuals.

The specific data-protection roles depend on the processing activity and the contractual arrangement. For direct individual users, Zeno Life Plan generally acts as controller. In an employer-sponsored deployment, the organisation and Zeno Life Plan each act as controller or processor for different activities, as documented in the applicable data-processing terms and enterprise contract. In all cases the individual is the data subject and retains the rights described in section 10; the employer never receives access to private Life Plan content.

6. Cookies

This website uses only strictly necessary cookies and similar technologies — those needed to run the site and to secure the enquiry forms (for example hCaptcha). There are no analytics, advertising or tracking cookies. See our Cookies Policy for the full list. If we ever introduce an optional technology, we will ask for your consent before it loads, and you will be able to change or withdraw that consent at any time.

7. Analytics

This marketing website does not use analytics, performance-measurement or advertising technologies, and sets no analytics cookies. We do not build advertising profiles and do not sell personal data. If we introduce privacy-respecting, aggregate measurement in future, we will update the Cookies Policy and request your consent before it is used.

8. Retention

We keep personal data only as long as necessary for the purposes above or as required by law. Life Plan content you create is held in your own workspace and can be deleted by you at any time. We may retain statistical information only where it has been irreversibly anonymised and can no longer identify anyone.

9. International transfers

We operate internationally and may process data outside your country. Where personal data is transferred out of the EEA or UK, we use appropriate safeguards and assess the destination’s protections.

10. Your rights

Subject to law, you have the rights of access, rectification, erasure, restriction, objection, portability, and to withdraw consent. To exercise them, submit a request through our secure contact form. We will respond within the timeframes required by the GDPR (generally one month).

11. Security

We protect personal data with encryption in transit and at rest, internal access controls on a need-to-know basis, and regular review of our controls. No system is perfectly secure, but we design for privacy and hold ourselves to a high standard.

12. Children

The commercial platform is intended for adults in a workplace or individual context and is not directed at children. Any youth programmes are delivered separately, with schools and guardians, under specific safeguards and age-appropriate consent arrangements.

13. Complaints

If you have a concern, please contact us first so we can help. You also have the right to lodge a complaint with your local data protection supervisory authority.

14. Updates

We may update this policy to reflect changes in law or our practices. We will post the new version here with an updated effective date and, where appropriate, notify you.

15. Contact

For data-protection matters, submit a privacy request through our secure contact form; for general matters, use our contact form. We do not publish email addresses, to protect against spam and data harvesting.