This policy explains what information Zonely collects when you join our beta list, how we use it, and the rights you have over it. We keep it short and only collect what we need: your email address, plus basic analytics about how the site is used.
Zonely (“Zonely”, “we”, “us”, “our”) is a product currently in beta. Zonely is operated by POTERNA LTD, a company registered in England & Wales (company number 16852743), whose registered office is at 124 City Road, London EC1V 2NX, United Kingdom.
For anything about this policy or your data, contact us at [email protected]. We are the “data controller” for the information described here.
When you sign up or submit a form on our site, we collect:
We do not ask for your name, and we never see or store a password. Payments for Zonely Premium are handled by Stripe, our merchant of record — your card details go directly to Stripe, and we never see or store them.
We use your information to:
Where you create an account, our legal basis is performance of a contract (Article 6(1)(b) UK GDPR / EU GDPR) — we need your email address and sign-in details to give you the account you asked for, to email you a sign-in code, and to keep your test results attached to it.
For adding you to the beta list and sending you product updates, our legal basis is your consent (Article 6(1)(a) UK GDPR / EU GDPR), which you give by submitting your email to join the beta. You can withdraw your consent at any time — every email we send includes an unsubscribe link, or you can email us at [email protected]. Withdrawing consent does not affect anything we did before you withdrew it.
For emails about your own use of Zonely — a reminder about a lesson you started, or an offer on Zonely Premium after you have looked at the price — our legal basis is our legitimate interests (Article 6(1)(f) UK GDPR / EU GDPR) in telling our own users about our own product, together with the “soft opt-in” for marketing by email. We tell you about this when you create your account. You can stop these at any time: turn “Offers and tips” off in Settings inside the app, use the unsubscribe link in any of them, or email us at [email protected]. Sign-in codes and other messages you need in order to use your account are not marketing and are always sent.
We do not sell or rent your information. We share it only with the service providers that help us run the site. Most of them act as our “processors”, and some store data in the United States:
| Provider | Purpose | Location |
|---|---|---|
| Supabase | Runs your account and stores your account details and test results | Ireland (EU) |
| Resend | Delivers your one-time sign-in code, and the emails we send about your use of Zonely, including offers | United States |
| Confirms your identity if you choose “Continue with Google” | United States | |
| DigitalOcean | Hosts the Zonely website | United States |
| Stripe | Processes your subscription payments as our merchant of record | United States |
| Microsoft Azure | Powers the AI practice partner in the chat lessons and processes what you type there | Netherlands (EU) |
| Meta | Receives sign-up, in-app activity and purchase events from our servers so we can measure our ads (see section 7) | Ireland (EU) |
| TikTok | Receives sign-up, in-app activity and purchase events from our servers so we can measure our ads (see section 7) | Ireland (EU) and United States |
Your account, test results and practice conversations are stored by Supabase on servers in Ireland, and the practice conversations are processed by Microsoft Azure in the Netherlands — both inside the EEA. Resend, Google, DigitalOcean and Stripe process data in the United States, so some of your information may be transferred outside the UK/EEA. Where that happens, the transfer is protected by appropriate safeguards — Standard Contractual Clauses and/or the EU–US / UK Data Privacy Framework, as applicable. You can ask us for more detail at any time.
Meta and TikTok are a special case: neither is our processor. For ad measurement each of them processes the events we send under its own responsibility, as described in section 7. With TikTok we are joint controllers for the sending and measuring of those events, which means we and TikTok have agreed in writing who is responsible for what; we are responsible for telling you about it, which is what section 7 does. Some of the TikTok data is transferred to the United States under the safeguards described above.
We keep your email only as long as we need it for the purpose above. In practice that means until the Zonely beta ends and our launch communications are complete (and for up to 12 months afterwards), or until you ask us to delete it or unsubscribe — whichever comes first. If we decide not to proceed with Zonely, we delete the list.
If you created an account, we keep your account and its test results until you ask us to delete them, or until we shut the service down. Deleting your account deletes the test results attached to it.
Practice conversations from the chat lessons are deleted automatically 90 days after they happen. You can also delete all of them yourself at any time, without touching the rest of your account, from Settings → Chat history in the app.
Under UK and EU data protection law you have the right to:
To exercise any of these, email [email protected] and we’ll respond within one month. If you’re unhappy with how we’ve handled your data, you can complain to the UK Information Commissioner’s Office at ico.org.uk/make-a-complaint, or to your local data protection authority if you’re in the EU.
If you have an account and want it removed, say so and we’ll delete the account together with everything attached to it, including your test results.
We use our own analytics, loaded from tracker.poterna.com, to understand how people find and use this site — for example which pages are viewed, the site or link that referred you, and general information about your browser, device, and approximate location (derived from your IP address). We use this in aggregate to measure interest in Zonely and improve the site; we don’t use it to personally identify you, and we don’t sell it.
This analytics is privacy-friendly: it does not use cookies, and it does not store or read any identifier on your device or track you across other websites. Because nothing is stored on or read from your device, it does not require a cookie banner. We rely on our legitimate interest in understanding and improving Zonely as the basis for this limited analytics, and you can object at any time by emailing us at [email protected].
There is one thing we do store on your device, and only if you sign in: a sign-in token kept in your browser’s local storage so that you stay signed in between visits. It is not analytics, it is not shared with anyone, and it is not used to track you. It exists only to keep you logged in — something you asked us to do by signing in — so it is strictly necessary for a service you requested and does not require a cookie banner. Signing out, or clearing your browser’s storage, removes it.
On the sign-up page only, we load Google’s sign-in library from accounts.google.com so that the “Continue with Google” button can be shown. This is Google’s own code, and it may read or set cookies belonging to Google in order to recognise that you are signed in to a Google account. We use it solely to offer Google as a way of signing in — we don’t use it for analytics or advertising, and it isn’t loaded anywhere else on the site. If you never use Google to sign in, no Google account information reaches us. You can avoid it entirely by signing up with your email address instead.
We also advertise Zonely on Facebook and Instagram. To measure whether those ads work, our servers send four events to Meta Platforms Ireland: one when you create an account, one when you first open the subscription screen, one when you finish your fifth lesson in a course, and one when you pay for a subscription. Each event contains your email address and account id in hashed form (a one-way code, not the readable text), your IP address, your browser type, the amount paid (for a purchase), the course name (for a lesson event) and, if your visit started from one of our ads, the click id that Meta added to the link. In that case we keep the click id in the tab’s temporary memory while you sign up (it disappears when the tab closes), and once your account is created we also store it with your account on our servers, so a later purchase can be matched to the ad. It is deleted together with your account. No Meta code runs in your browser on our site, and Meta sets no cookies here. We rely on our legitimate interest in measuring our advertising, and you can object at any time by emailing [email protected].
We advertise Zonely on TikTok in the same way. Our servers send the same four events — one when you create an account, one when you first open the subscription screen, one when you finish your fifth lesson in a course, and one when you pay for a subscription — to TikTok Technology Limited (Ireland) and TikTok Information Technologies UK Limited, using TikTok’s Events API. Each event contains your email address and account id in hashed form (a one-way code, not the readable text), your IP address, your browser type, the amount paid (for a purchase), the course name (for a lesson event) and, if your visit started from one of our TikTok ads, the click id that TikTok added to the link. As with Meta, that click id is kept in the tab’s temporary memory while you sign up and then stored with your account so a later purchase can be matched to the ad, and it is deleted together with your account. No TikTok code runs in your browser on our site, and TikTok sets no cookies here.
For the sending and measuring of those events, we and TikTok are joint controllers. TikTok also uses the events afterwards for its own purposes, including ad targeting and improving its advertising — for those it acts as an independent controller, and its own privacy notice explains what it does and the legal basis it relies on: tiktok.com/legal/page/eea/privacy-policy. We and TikTok have agreed terms setting out our respective responsibilities under the GDPR for the part we do jointly; under those terms it is our job to give you the information on this page, and you can exercise your data protection rights against either of us. We rely on our legitimate interest in measuring our advertising, and you can object at any time by emailing [email protected].
Zonely is intended for adults and is not directed to children under 16. We don’t knowingly collect personal information from anyone under 16. If you believe a child has given us their email, contact us at [email protected] and we’ll delete it.
As Zonely moves from beta to a full product, we may update this policy. When we do, we’ll change the “last updated” date at the top, and for significant changes we’ll let you know by email.
Questions about your privacy? Email us any time at [email protected].