Last updated: 2026-06-15 · Applies to users in the EEA, UK, and Switzerland
Zenbrox is committed to protecting and respecting your privacy in accordance with the General Data Protection Regulation (EU) 2016/679 ("GDPR"), the UK GDPR, and the Swiss Federal Act on Data Protection (nFADP). This page describes your rights under these laws, how to exercise them, and how we handle your personal data.
For the purposes of the GDPR, the data controller responsible for your personal data is:
We do not have a statutory obligation to appoint a Data Protection Officer (DPO) at this time, but all data-related enquiries are handled with priority. We will respond to all verified data subject requests within 30 days.
We process your personal data only where we have a lawful basis to do so. The lawful bases we rely on are:
When you register an account or purchase a Pro subscription, processing your email address and account data is necessary to perform the contract between us. Without this processing, we cannot create your account, authenticate you, or deliver the services you have paid for.
We process certain data on the basis of our legitimate interests, which include:
We have conducted a Legitimate Interests Assessment (LIA) for each of these processing activities and have concluded that our interests are not overridden by your rights and freedoms. You have the right to object to processing based on legitimate interests — see section 4.6 below.
We rely on your consent for:
You may withdraw consent at any time. Withdrawal does not affect the lawfulness of processing before withdrawal. To withdraw consent, use the "Reset cookie preference" button on the Cookie Policy page.
We may be required to process your data to comply with legal obligations — for example, retaining payment records for tax and accounting purposes (typically 7 years under EU financial regulations).
| Category | Examples | Purpose | Legal Basis |
|---|---|---|---|
| Identity data | Email address, username | Account creation and authentication | Contract performance |
| Authentication data | Hashed password, session tokens | Secure login, session management | Contract performance, legitimate interests |
| Usage data | Focus session durations, modes, dates | Dashboard, progress tracking | Contract performance, legitimate interests |
| Payment data | Subscription status, payment confirmation (via Stripe) | Subscription management, revenue records | Contract performance, legal obligation |
| Analytics data | Anonymised page views, session counts (via Google Analytics) | Product improvement | Consent |
| Advertising data | Cookie-based interest profiles (via Google AdSense) | Personalised advertising | Consent (EEA/UK/CH) |
| Communication data | Contact form messages, support emails | Responding to enquiries | Legitimate interests, consent |
Under the GDPR, you have the following rights regarding your personal data. These rights are not absolute and may be subject to conditions and exceptions under applicable law.
You have the right to request a copy of the personal data we hold about you, along with information about how we process it — including the purposes of processing, the categories of data, the recipients with whom it is shared, and the retention period. We will provide this information free of charge within 30 days.
How to exercise: Contact us via the Contact page with the subject "Data Access Request" and verify your identity.
You have the right to have inaccurate personal data corrected or incomplete data completed. You can update your email address directly from your account settings. For other corrections, contact us.
How to exercise: Update via account settings, or contact us directly for data we hold that you cannot access through the interface.
You have the right to request deletion of your personal data where:
Deleting your account will erase your email address, hashed password, session history, and any notes or content you have submitted. Some data (e.g. payment records required by law) may be retained for the legally required period even after account deletion.
How to exercise: Contact us via the Contact page with "Account Deletion Request" in the subject line.
You have the right to request that we restrict the processing of your data — meaning we may store it but not use it — where:
How to exercise: Contact us with a description of the processing you wish restricted.
Where processing is based on consent or contract and carried out by automated means, you have the right to receive your personal data in a structured, commonly used, machine-readable format (JSON or CSV), and to transmit that data to another controller. This applies to data you have actively provided — your account data and session history.
How to exercise: Contact us with "Data Portability Request" in the subject line.
You have the right to object at any time to processing of your personal data where the legal basis is legitimate interests or a task carried out in the public interest. We will cease processing unless we can demonstrate compelling legitimate grounds that override your interests, rights, and freedoms, or where processing is for the establishment, exercise, or defence of legal claims.
You have an absolute right to object to processing for direct marketing purposes. We do not currently send marketing emails, but if we introduce this in future, you will have the right to opt out at any time.
How to exercise: Contact us with "Data Processing Objection" in the subject line.
You have the right not to be subject to decisions based solely on automated processing — including profiling — that produce legal or similarly significant effects concerning you. Zenbrox does not currently make any automated decisions that produce legal or similarly significant effects. If we introduce such processing in future, we will update this page and provide appropriate safeguards.
Where processing is based on your consent, you have the right to withdraw that consent at any time without affecting the lawfulness of processing before withdrawal. To withdraw consent for analytics or advertising cookies, use the Cookie Policy page.
Some of our third-party service providers are located outside the EEA. Where we transfer personal data to countries that do not provide an equivalent level of data protection to the EEA, we ensure appropriate safeguards are in place:
You may request a copy of the safeguards in place for any specific transfer by contacting us.
| Data Type | Retention Period | Reason |
|---|---|---|
| Account data (email, password hash) | Until account deletion + 30 days | Contract performance; brief buffer for accidental deletion |
| Focus session history | Until account deletion | Core feature provision |
| Payment records | 7 years from payment date | Tax and financial regulation compliance |
| Contact form messages | 3 years from last interaction | Legitimate interests (dispute resolution) |
| Analytics data (Google Analytics) | 26 months (Google default) | Product improvement (anonymised) |
| Server access logs | 90 days | Security and debugging |
Our Cookie Policy provides full information on the cookies we use, their purpose, duration, and how to manage your preferences. See our Cookie Policy for details.
For users in the EEA, UK, and Switzerland, non-essential cookies (analytics and advertising) are not placed without your prior consent. You can change your cookie preferences at any time via the cookie banner or the Cookie Policy page.
We implement appropriate technical and organisational measures to protect your personal data against accidental loss, destruction, damage, alteration, or unauthorised disclosure or access. These measures include:
Despite these measures, no method of transmission over the internet or electronic storage is 100% secure. We cannot guarantee absolute security, but we are committed to promptly addressing any security incidents and notifying affected users within the legally required timeframes.
In the event of a personal data breach that is likely to result in a risk to your rights and freedoms, we will notify the relevant supervisory authority within 72 hours of becoming aware of the breach (as required by Article 33 GDPR). Where the breach is likely to result in a high risk to your rights and freedoms, we will also notify you directly without undue delay (Article 34 GDPR), unless an exception applies.
If you believe we have not complied with our obligations under the GDPR, you have the right to lodge a complaint with a supervisory authority. In the UK, this is the Information Commissioner's Office (ICO). In EU member states, contact your national data protection authority.
We ask that you contact us first before lodging a complaint — we will do our best to resolve your concern directly and quickly.
To exercise any of the rights described above:
All requests are processed free of charge. However, if requests are manifestly unfounded or excessive (particularly if repetitive), we may charge a reasonable administrative fee or decline to act on the request.
We may update this GDPR information page from time to time to reflect changes in our processing activities or applicable law. Material changes will be announced on the website. Continued use of the Service after changes constitutes acknowledgement of the updated information.
Last updated: 2026-06-15.