Privacy Policy
How Red Zircon Technologies Ltd collects, uses, shares and protects personal data across our websites, the Red Zircon console and all our products and services, and the choices and rights you have.
Summary
This is a summary of the key points. Please read the full policy below.
- We do not sell your data, show you targeted ads or track you. No behavioural advertising, no profiling for marketing, and no third-party analytics or tracking scripts in our websites, the console or our products.
- Your content is yours. We never use the content you store in our products (such as documents, files, workspaces or email) for advertising, profiling or training AI models.
- We collect as little as we can: the details you give us (such as your name, email address and organisation) and limited technical information needed to run and secure our services.
- We share personal data only with service providers who help us run our services, under contracts that protect it, or where the law genuinely requires it. We challenge requests that are unlawful or too broad.
- You are in control. You can access, correct, export or delete your data at any time.
Who we are and what this policy covers
Red Zircon Technologies Ltd (“Red Zircon”, “we”, “us” or “our”) was founded in October 2020 as NGX Web Solutions. This policy applies to:
- our websites, including redzircontech.com;
- the Red Zircon console at app.redzircontech.com;
- our products and services, including ZirconOS, ZirconSuite, ZirconMail, ZirconCloud, Axinite Intelligence, ZirconTeams, ZirconShield and ZirconBook;
- sales, support, billing and other dealings you have with us.
Product privacy notices. Some products handle particular kinds of data and have a short product notice that adds detail to this policy, for example the ZirconMail Privacy Notice. A product notice applies together with this policy; if they differ, the product notice applies to that product.
Controller and processor. For the personal data described in this policy, Red Zircon Technologies Ltd is the controller: we decide why and how the data is used. Where an organisation uses our products for its own staff, students or users, that organisation is the controller of the content and user data in its service, and we process it on its behalf as a processor, under our agreement with that organisation. If you use a Red Zircon product provided by your employer, school or another organisation, please contact that organisation about its privacy practices.
Our privacy commitments
These promises apply to every Red Zircon website, product and service, and they override anything else in this policy that might seem to say otherwise:
- We do not sell, rent or trade personal data, and we do not “share” it for cross-context behavioural advertising.
- We do not use the content you store in our products for advertising or marketing, and we do not build advertising profiles about you.
- We do not use your content to train artificial intelligence models.
- We do not put third-party trackers, analytics scripts, social media pixels or advertising cookies in our websites, the console or our products.
- We do not give any government or other third party direct or “back door” access to our systems or your data.
- Our staff do not look at the content you store in our products, except in the narrow cases set out in “Access to your content” below.
Information we collect
Information you give us
- Account details: your name, email address and password (stored only as a strong one-way hash, never in readable form), and for console accounts your organisation’s name, domain and country or region.
- Recovery and security details: if you add them, a recovery email address or a verified phone number, used only to help you get back into your account and to send security notices.
- Team information: names, email addresses and roles of colleagues that you or your organisation’s administrators invite or manage.
- Enquiries and support: the details you send through our contact form, the console or support, and our replies.
- Quotes, orders and billing: the products and quantities you request, quotes, orders, invoices, billing contact details and purchase order references. We do not store full payment card numbers.
Content you store in our products
Depending on the products you use, this can include documents, files, workspace data, messages, contacts, calendars, notes and settings. We store and process it only to provide the product to you, and it is covered by the commitments above.
Information collected automatically
- Technical and security data: IP address, browser and device type, date and time of requests, pages requested, and sign-in and security events (for example, sign-ins, failed sign-in attempts, password changes and new sessions).
- Service logs: technical records our systems create when they do their job, used to deliver the service, fix problems and detect abuse, and kept only for a short time.
- Cookies and browser storage: only what is needed for sign-in, security and your preferences. See our Cookie Policy.
Information from others
- Your organisation’s owner or administrators may add you to their team or change your role.
- If you sign in to one Red Zircon service with an account from another (for example, signing in to the console with a ZirconMail identity), that service receives confirmation of your identity.
We do not knowingly collect special category data (such as health information) other than what people choose to store in their own content. Please do not include it in enquiries or support requests.
Access to your content
The content you store in our products is private. Red Zircon staff will only access it:
- with your permission, for example when you ask support to look at a specific item to fix a problem, and only for as long as needed;
- where the law requires it, in response to a valid and legally binding order (see “Requests from authorities”); or
- to investigate a serious threat, such as a compromised account, malware, spam or fraud, or to protect someone from serious harm, and then only to the minimum extent necessary.
Access to production systems is limited to a small number of authorised staff who use multi-factor authentication, and we keep a record of when customer content is accessed and why. Automated systems may check content for malware, spam and security threats; this is done by software and is never used for advertising or profiling.
The Red Zircon Assistant
Our websites include an optional AI assistant that answers questions about Red Zircon. It does not have access to your account or the content you store in our products.
- When you send a message, the text of your conversation is sent to the AI provider we use for the assistant (currently one of Anthropic, OpenAI, OpenRouter or a server we operate ourselves) so that it can generate a reply. Each provider processes messages under its own business terms and privacy policy.
- We do not send your name, email address or account details with assistant messages, and we do not use your conversations to profile you.
- Your conversation is kept in your browser for the current tab only and is cleared when you close it. We do not keep transcripts on our servers. We keep short-lived technical records, such as request counts per IP address, to prevent abuse.
- Please do not share passwords, payment details or other sensitive information with the assistant. Its answers can be wrong; for anything important, contact our team.
How we use information and our lawful bases
We use personal data only where the law allows. Where the UK GDPR, the EU GDPR or similar laws apply, the purposes and lawful bases we rely on are:
- Providing our services: creating and running your account, providing the products you request, storing your content and letting your team work together. Basis: performance of a contract with you or your organisation.
- Keeping services and users secure: authenticating users, detecting malware, spam, fraud and abuse, rate-limiting, investigating incidents and keeping security logs. Basis: our legitimate interests in protecting our users and services, and legal obligations.
- Account recovery: using your recovery details to help you regain access. Basis: contract and legitimate interests.
- Support and enquiries: answering your questions and requests. Basis: contract, or our legitimate interest in responding to people who contact us.
- Quotes, orders and billing: preparing quotes, processing orders, issuing invoices and keeping accounting records. Basis: contract and legal obligations.
- Service communications: sending essential messages such as welcome messages, verification links, password resets, security notices and changes to our terms. Basis: contract and legitimate interests.
- Keeping services working well: monitoring capacity, performance and errors in aggregate. This never involves looking at the content you store. Basis: legitimate interests.
- Marketing: sending news about our products, only where you have agreed or where the law otherwise allows, and never based on the content you store. Basis: consent or legitimate interests; you can opt out at any time.
- Legal compliance: meeting tax, accounting and other legal requirements, responding to valid legal requests, and establishing or defending legal claims. Basis: legal obligation and legitimate interests.
Where we rely on legitimate interests, we have balanced them against your rights and expectations and concluded that they do not override them. You can object at any time (see “Your rights”).
Emails we send
We send essential service emails, such as verification links, password reset links, welcome messages, security alerts, invoices and important changes to our services. These are part of the service and you cannot opt out of them while you have an account.
We only send marketing emails if you have agreed to receive them or where the law otherwise allows, and every marketing email includes a way to unsubscribe. Our automated emails come from addresses such as noreply@redzircontech.com and, for ZirconMail, noreply@zirconmail.com. We will never ask you for your password by email. If you receive a message claiming to be from us that asks for your password, do not reply and report it to us.
Where your data is stored and international transfers
Our services are hosted in data centres operated by our infrastructure providers. Where a product stores your content in a particular region, its product notice says so (for example, ZirconMail mailboxes are stored in the European Union). Some service providers, such as AI providers for the website assistant, may process data in other countries, including the United States.
Where data protection law requires it, we make sure transfers outside the UK or European Economic Area are protected by appropriate safeguards, such as adequacy regulations or decisions, or standard contractual clauses (including the UK International Data Transfer Addendum), together with any additional measures needed. You can ask us for more information about these safeguards.
How long we keep information
We keep personal data only for as long as we need it for the purposes in this policy:
- Content you store in our products: for as long as you keep it in your account, or as your organisation’s settings decide for business services.
- Account and team data: while your account is open.
- Closed accounts: when you close your account, we delete your account data and content within 30 days. Copies in our backups are overwritten in the normal backup cycle, within a further 35 days. We keep only what the law requires us to keep, such as billing records.
- Service logs: no longer than needed for their purpose, and in any case no more than 90 days unless needed for a specific investigation.
- Security logs (such as sign-in events): up to 12 months, unless we need them longer to investigate a specific incident.
- Billing records: for as long as tax and accounting law requires, usually six years after the end of the financial year they relate to.
- Enquiries and support requests: up to 24 months after the request is closed.
- Verification, sign-in and password reset links and codes: they expire within 30 minutes and can only be used once.
Product notices may set out additional retention details for a specific product. When data is no longer needed, we delete it or anonymise it so it can no longer identify you.
How we protect information
We use technical and organisational measures appropriate to the risk, including:
- encrypted connections (HTTPS/TLS) for our websites, the console and our products;
- passwords stored only as strong, salted one-way hashes, never in readable form;
- encryption of sensitive settings and secrets, such as server and API credentials;
- multi-factor authentication for all Red Zircon staff, and access limited to the people who need it for their job;
- secure, short-lived session cookies, protection against cross-site request forgery, strict content security policies, and limits on repeated sign-in attempts;
- separation of services, regular security updates and monitoring;
- audit records of sensitive administrative actions.
No online service can be completely secure. If a security incident is likely to put your rights at risk, we will tell you without undue delay, and notify the relevant data protection authority (where the law requires, within 72 hours of becoming aware of it), with what happened and what you can do.
Your rights
Depending on where you live, you have rights over your personal data, including the right to:
- access a copy of the personal data we hold about you;
- correct data that is inaccurate or incomplete;
- delete your data (“right to be forgotten”);
- restrict how we use your data;
- receive your data in a portable format, and have it sent to another provider (“data portability”);
- object to our use of your data based on legitimate interests, and to direct marketing at any time;
- withdraw consent at any time, where we rely on consent;
- not be subject to decisions based solely on automated processing that have legal or similarly significant effects. We do not make such decisions.
How to exercise your rights. If you have a console account, go to Settings → Privacy & data to request a copy of your data or close your account. You can also use our contact form and choose “Privacy and data protection”. We may need to verify your identity before acting, so that we never give your data to someone else. We respond within one month, and tell you if we need longer (up to two further months for complex requests). There is normally no charge.
If you are unhappy with how we have handled your data, please contact us first so we can try to put it right. You also have the right to complain to a data protection authority, for example the Information Commissioner’s Office (ICO) in the UK, or the authority in the country where you live or work.
Additional information for people in the United States
We do not sell personal information and we do not share it for cross-context behavioural advertising, as those terms are defined in the California Consumer Privacy Act (CCPA) and similar state laws, and we have not done so in the past 12 months. We do not use or disclose sensitive personal information for purposes that would give you a right to limit its use.
Depending on your state, you may have the right to know what personal information we collect, use and disclose, to access, correct and delete it, and to not be discriminated against for exercising these rights. You or an authorised agent can make a request as described in “Your rights”. We honour Global Privacy Control signals, although because we do not sell or share personal information there is nothing further to opt out of.
Children
Our websites and business services are intended for adults, and you must be at least 18 to create a Red Zircon console account. Some products, such as ZirconMail, may be used from the age of 16, as set out in their product notice. We do not knowingly collect personal data from children below these ages. If you believe a child has given us personal data, please contact us and we will delete it.
Changes to this policy
We may update this policy from time to time, for example when we add new services or when the law changes. The “Last updated” date at the top shows when it last changed, and previous versions are available on request. If we make significant changes, we will tell you by email or in the product before they take effect. We will never weaken the commitments in “Our privacy commitments” for data we already hold without your consent.
Contact us
If you have a question about this page, or want to exercise your rights, contact Red Zircon Technologies Ltd through our contact form and choose “Privacy and data protection”. If you have a console account, you can also send a request from Support in the console.