Privacy Policy

Last updated: September 11, 2026

Zafronix builds several different products, and they handle data very differently. Our downloadable mobile games run entirely offline and collect nothing. This website and our paid products do process some data — some of it collected by us, some collected independently by third-party services we use. This policy explains, scope by scope, what is collected, why, who receives it, how long it is kept, and how to exercise your rights. Where a claim below concerns what a third party does with data, we describe it to the best of our understanding and link to their own policy, which controls.

1. Who we are (controller & contact)

The data controller is Zafronix LLC (Wyoming, USA). For any privacy question or to exercise a right, email support@zafronix.com or use our contact form. We do not currently have a dedicated EU/UK representative; EU/EEA/UK residents may still contact us directly and, if unsatisfied, lodge a complaint with their local supervisory authority.

2. The marketing website (zafronix.com)

Loading this website causes your browser to request pages and assets from our server and our font/CDN providers; like almost any web server, ours writes standard access logs (IP address, timestamp, requested URL, user agent) which are used for security, abuse mitigation and debugging and are rotated on a short cycle. Beyond that, the only optional tracking on this site is analytics and advertising, and it is off until you accept it in the cookie banner (see §3–§5). Necessary form-security processing (§6) runs on the specific pages that carry a form. There is no Stripe checkout on this website — paid checkout happens on our API site (§8).

If you accept optional cookies, we load Google Analytics (GA4, measurement ID G-QNEFX3ECZS). GA sets identifiers (a client ID and, for the session, related cookies) and reports events such as page views to Google. That is not purely aggregate data: GA processes individual-level, pseudonymous data about your visit, and Google acts as an independent processor/controller under its own terms. We use it only to understand which pages are read and how people move through the site — we do not use it to identify you by name — but we do not claim it is anonymous. If you decline, GA is never loaded. Legal basis: consent. See Google’s privacy policy.

If you accept optional cookies, we load the Meta Pixel (ID 2046773386247742). The Pixel sends event data to Meta — including the page you viewed, your IP address, browser/user-agent details, and Meta’s own cookies — on an individual, per-event basis, which Meta may combine with the profile it holds for you to measure and target advertising. This is not aggregate-only data. If you decline, the Pixel is never loaded, and the previous non-JavaScript tracking pixel has been removed entirely. Legal basis: consent. See Meta’s privacy policy.

Your accept/decline choice is stored in your browser’s localStorage (key zafronix_cookie_consent) so we can honor it on every page and re-load or suppress the optional trackers accordingly. This value stays in your browser; it is not transmitted to us. You can change your choice any time via the “Cookie preferences” link in the footer. Clearing your browser storage resets the choice, and the banner will ask again.

6. Contact & pilot-inquiry forms

Our contact form and product inquiry forms (including the QORA pilot form, §9) submit to an intake endpoint on our server. Contrary to earlier versions of this policy, these submissions are stored: we write the fields you provide — email address, your message, the selected subject/topic, an optional phone number, and the originating IP address — to a server-side queue that is processed into our internal customer-relationship records so we can reply and follow up. Cloudflare Turnstile runs on these forms to tell humans from bots; to do that, Turnstile processes your IP address and browser/interaction signals — that is personal data, used only for anti-abuse and governed by Cloudflare’s policy. We reply by email via Gmail SMTP (primary) or Resend (fallback). Legal basis: our legitimate interest in responding to your enquiry and, where you are asking about a purchase, taking steps prior to a contract. Inquiry records are retained for up to 24 months unless they become part of an active customer relationship, then per §8.

The Subscribe page and the games Premium page include an optional signup for the Wayfinders launch list and occasional Zafronix updates. If you subscribe:

We store your email address, IP address, locale, and which list(s) you opted into (in a database on our server). We keep the IP and timestamp as a record of consent and to meet anti-spam obligations (e.g. CAN-SPAM, CASL).
We send a confirmation email and send nothing else until you click its link. This is confirmed (double) opt-in. To be precise: GDPR requires consent that is freely given, specific, informed and unambiguous — it does not specifically mandate double opt-in; we use it as a best practice and as strong evidence of consent.
Every email carries a one-click unsubscribe link and the List-Unsubscribe header (RFC 8058). Unsubscribing takes effect immediately.
We never sell, rent, or share subscriber emails. Legal basis: consent.

8. API accounts, keys, usage logs & billing (api.zafronix.com)

The Zafronix Sports APIs are a paid service billed on one shared key. Checkout and billing happen on api.zafronix.com, not this website. If you hold an account:

What we store: your email address, a hashed copy of your API key (the plaintext key exists only in your possession and Stripe’s billing records), your plan, and request logs (timestamp, endpoint, response code, originating IP) for the most recent ~90 days.
Why: account management, billing, fraud/abuse detection, rate-limit enforcement, and support you request.
Retention: account data for the life of the account plus 30 days after cancellation (to reverse mistaken cancellations and issue final invoices); request logs roll off after ~90 days; aggregate, anonymized usage statistics may be kept for capacity planning.
Payments — Stripe: card numbers, CVVs and billing addresses are entered directly into Stripe-hosted fields and never reach Zafronix servers. We retain only the Stripe customer ID, the card’s last four digits, and the billing email. Stripe processes payments as an independent controller and retains transaction records to meet financial-record, tax and anti-fraud obligations; those retention periods are set by Stripe and by law and vary by jurisdiction (commonly several years) — we cannot shorten or override them. See stripe.com/privacy.
Legal basis: performance of your contract for the service, plus legal obligation for billing/tax records.

On this website, “QORA” means the QORA product page and its pilot-inquiry form, which is handled exactly as described in §6 (email, phone, message, IP → our intake queue and CRM, so our team can discuss a pilot). The QORA product itself — the AI that runs against a customer’s own cameras — processes operational data (such as video-derived events and incident records) under the separate agreement with that business customer and its own product documentation, not under this website policy. See our Trust & Security page for how QORA handles that data.

10. Mobile games

Our downloadable games are designed to run entirely on your device. They store preferences, scores and progress locally (e.g. via the platform’s built-in storage), make no network calls, contain no ads, and integrate no analytics, advertising or social SDKs, so no personal data leaves your device to us. Because there is no collection, there is nothing for us to sell or share, and uninstalling removes the local data. We do not claim this by itself proves compliance with COPPA or every children’s-privacy law worldwide (see §12); it means these specific apps collect no data from anyone, including children.

11. Externally hosted Zafronix products

Several Zafronix products run on their own domains and have their own terms and privacy practices, which govern data you provide there: VenueFuze (venuefuze.com), ZKickoff (zkickoff.com), Siono (siono.app), Next-Gen Chess (ngchess.com), CrisisGraph (crisisgraph.com), the games portal (games.zafronix.com), and the QORA console (qoraguard.com). Links from this site to those products do not transfer your data to them until you interact with them there.

12. Children’s information

This website and our paid products are intended for adults / business users and are not directed to children under 13 (or the applicable age in your region), and we do not knowingly collect personal data from children through them. Our offline games collect no data from any user. We do not hold, and do not here claim, a formal COPPA certification or verified compliance with every children’s-privacy regime worldwide; if you believe a child has provided us personal data, contact support@zafronix.com and we will delete it.

13. Recipients / processors

We share data only with the service providers needed to run the above, each acting under its own terms:

Google (Analytics) — consent-gated website analytics (§3).
Meta (Pixel) — consent-gated advertising attribution (§4).
Cloudflare (Turnstile) — form anti-abuse (§6).
Google (Gmail SMTP) and Resend — transactional/notification email delivery.
Stripe — payments and billing for API accounts (§8).
Our own hosting/infrastructure providers, which store the data described above on our behalf.

We do not sell personal information as that term is used under the CCPA/CPRA.

14. International transfers

Zafronix is US-based, and the processors above are largely US-based. If you access our site or services from the EU, EEA, UK or elsewhere, data described here may be transferred to and processed in the United States. Where those transfers require a safeguard, our processors make Standard Contractual Clauses (or equivalent mechanisms) available under their own data-processing terms, linked in §13.

15. Legal bases (EU/UK)

Analytics and advertising (§3–§4): consent. Necessary form security and responding to enquiries (§6): legitimate interests and pre-contract steps. Newsletter (§7): consent. API accounts and billing (§8): performance of a contract and legal obligation. Server security logs (§2): legitimate interests in operating a secure service.

16. Your rights & deletion requests

Depending on where you live (EU/EEA/UK GDPR, California CCPA/CPRA, and similar laws), you have rights over data we hold about you. We aim to honor these for everyone regardless of location:

Access / portability — email support@zafronix.com and we will provide a copy of your records (as JSON where practical).
Rectification — ask us to correct inaccurate data.
Withdraw consent — change analytics/advertising via Cookie preferences in the footer; unsubscribe from email via the link in any message or at /unsubscribe (immediate).
Erasure — use /delete-my-data and submit your email; we send a confirmation link, and clicking it triggers deletion of the records we control. We require this confirmation so that someone cannot request deletion of another person’s data. For API accounts this also revokes your key, anonymizes request logs, and closes your Stripe customer record.
Non-discrimination — exercising a right does not reduce any service you are entitled to.

Some processors keep records on their own schedules that we cannot override: email providers (Gmail, Resend) retain delivery logs on their own cycle; Stripe retains transaction records for the periods described in §8. When you exercise erasure, we delete what we control and trigger Stripe’s close-customer flow, but legally required transaction history remains with the processor for its required period.

17. Changes to this policy

We may update this policy as our products or processors change. When we make a material change we will update the “Last updated” date above and, where appropriate, note it on this page. Please review it periodically.

18. Contact

Questions about this Privacy Policy: support@zafronix.com or our contact form.