Privacy,
in plain language.

Who we are and when this policy applies

Zanzarra is a Drupal and software development agency based in Lviv, Ukraine. For personal data collected through zanzarra.com, Zanzarra acts as the data controller: we decide why and how that data is processed.

This policy applies to this website and the forms and interactive services available through it. A third-party website linked from our pages is governed by its own privacy terms.

Personal data we collect

Information you provide

Depending on the service you use, we may collect your name, work email, phone number, company or organisation, role, project description, budget expectations, referral source, uploaded files, estimate answers, contact preferences, and the content of messages you send.

If you request delivery of a project estimate, we also store the calculated result, the version of the pricing model, delivery status, and a record of your permission to send and retain the brief.

If an AI assistant is available and you choose to use it, we may process your messages, the assistant’s responses, session data, consent record, and—only if you provide it—an email address for a transcript or follow-up. Do not send passwords, access keys, payment-card details, health information, or other sensitive data through our forms or chat.

Information collected automatically

Our servers and security tools may record technical information such as your IP address, request time, requested page, referrer, browser and device details, language, error information, and security or anti-spam signals. We use this limited information to deliver and protect the website and diagnose faults.

Why we use personal data

We use personal data to:

• answer questions and discuss a possible project;
• prepare, calculate, send, and retain a requested project brief;
• provide a requested interactive or AI-assisted conversation;
• operate, secure, troubleshoot, and improve the website;
• prevent spam, abuse, duplicate submissions, and fraud;
• keep appropriate business records and establish, exercise, or defend legal claims; and
• comply with legal obligations.

Depending on the context, our legal basis is taking steps at your request before a contract, performing a contract, your consent, our legitimate interests in running and protecting our business, or compliance with law. When processing relies on consent, you may withdraw it for future processing at any time. We do not sell personal data or use contact-form details to enrol you in marketing without a separate choice.

Who receives data

Access is limited to Zanzarra personnel who need the information for their work. We may also use carefully selected service providers for hosting and infrastructure, email delivery, security and anti-spam protection, file storage, and technical support. They may process data only to provide those services or meet their own legal duties.

If you use an AI assistant, the relevant conversation content is sent to OpenAI to generate a response. The integration requests that response objects are not stored for later API retrieval, but this does not mean that no provider-side retention or security processing occurs. Review OpenAI’s Privacy Policy before using the assistant.

We may disclose information when required by law, to protect rights and safety, or in connection with a merger, restructuring, or transfer of the business. We do not disclose personal data for independent third-party advertising.

International transfers

Our team and service providers may process data in Ukraine and other countries. Where data protection law requires it, we use an available lawful transfer mechanism and appropriate contractual, technical, or organisational safeguards. You may contact us for information about safeguards relevant to your data.

Cookies and similar storage

Cookies are small text files stored by your browser. Similar technologies include local browser storage and short-lived session identifiers. The public website can be read without an account. Zanzarra uses necessary storage for security, forms, sessions and your consent choice. Google Analytics is optional and is not loaded until you allow analytics through the cookie controls. We do not use advertising cookies.

You can choose “Necessary only” without losing public site functionality, and you can reopen “Cookie settings” in the footer at any time. You can also remove or block cookies in your browser settings. Blocking strictly necessary storage may stop forms, security checks, or other interactive features from working correctly.

How long we keep data

We keep personal data only for as long as it is needed for the purpose described in this policy. We decide the period by considering whether a conversation or project remains active, whether follow-up is reasonably expected, security and dispute-prevention needs, contractual requirements, limitation periods, and legal record-keeping duties.

Contact submissions, project briefs, and related mailbox copies are removed or anonymised when they are no longer needed under those criteria. Technical logs are normally retained for a shorter operational period unless a security incident requires investigation. If you ask us to delete data, we will do so unless a lawful reason requires or permits us to keep some of it.

How we protect data

We use proportionate technical and organisational safeguards, including access controls, restricted administration, transport encryption, request validation, and service-provider controls. No internet service can guarantee absolute security, so please use the website only for information appropriate to an initial business conversation.

The project estimator uses its result only to provide a planning range. Zanzarra does not use website data to make solely automated decisions that produce legal or similarly significant effects.

Your privacy rights

Subject to applicable law, you may ask us to confirm whether we process your data and request access, correction, deletion, restriction, or a portable copy. You may object to certain processing, withdraw consent for future processing, and complain to a competent supervisory authority or court.

Ukraine’s Law on Personal Data Protection and, where it applies, the EU General Data Protection Regulation provide further information about these rights. We may ask for enough information to verify your identity before acting on a request.

Children’s data

This business website is not directed to children, and we do not knowingly request personal data from them. If you believe a child has submitted information, contact us so we can review and remove it where appropriate.