Privacy policy
Last updated: 4 October 2026
This policy explains what personal data ZORESET ("we", "us") collects when you visit our website or use our asset-tracking service, why we collect it, and your rights over it. If you have a question about it, contact us through the contact details on our website.
Who is responsible for what
For the account and billing details of the people who sign up, we are the data controller. For the asset records an organisation keeps in ZORESET — its items, people, notes and files — the organisation is the controller and we process that data on its behalf and on its instructions.
What we collect
- Account details: your name, email address and a hashed password, your organisation's name, and your role in it.
- Your organisation's records: the items and assets it tracks, who they are assigned to, notes, photos and attached files, and an activity trail of changes made.
- Asset scan reports: when someone scans an asset's QR label and chooses to share their location, we store the time, the latitude and longitude their device reports, an optional comment, and — if they are signed in to the same organisation — who they are. Anyone else is recorded anonymously. Location is only ever sent after the browser asks permission and the person agrees.
- Billing details: the organisation's billing name and address, the plan it is on, and its invoices and payment status. We do not collect card details; invoices are paid by bank transfer.
- Technical data: sign-in times, and standard server logs (IP address, browser type, pages requested) used to keep the service secure and working.
Why we use it
- To provide the service you or your organisation asked for — signing you in, tracking assets, sending invitations and password-reset emails.
- To issue invoices and keep the financial records the law requires.
- To keep the service secure, prevent abuse and fix faults.
- To answer your requests for support.
We do not sell personal data, and we do not use it for advertising or profiling.
Who can see it
An organisation's data is visible only to the accounts in that organisation, and each organisation's records are isolated from every other's at the database level. Within an organisation, what a person sees depends on their role. Our own staff access customer data only when needed to run the service or give support you have asked for, and any such access is recorded.
The only page that is public is an asset's scan page, which shows the item's name and the name of the organisation that owns it, so that a finder knows who to return it to.
We use service providers to host the service and send email on our behalf. They may process data only for those purposes.
How long we keep it
We keep account and organisation data while the account is active. An organisation can remove its records at any time, and may ask us to delete its organisation entirely. Invoices are kept for as long as accounting and tax rules require. Backups are overwritten on a regular cycle.
Security
Data is encrypted in transit, passwords are stored only as salted hashes, and sessions use a short-lived access token plus a protected refresh cookie. No system is perfectly secure, but we take reasonable measures to protect your data and will tell affected customers promptly if a breach affects them.
Your rights
Depending on where you live, you may have the right to access the personal data we hold about you, correct it, delete it, restrict or object to how it is used, and receive a copy in a portable format. To exercise a right, contact us through the contact details on our website. If you are a member of an organisation, we may refer your request to that organisation, since it controls its own records. You can also complain to your local data-protection authority.
Cookies
We use one essential cookie to keep you signed in and nothing for tracking or advertising. See our cookie policy for the detail.
Changes to this policy
If we change this policy in a way that matters, we will update the date above and, for signed-in customers, tell them in advance.