Privacy policy

The short version

If you fill in a form here, we collect the information you provide and use it to assess your application, respond to you and, where applicable, help operate Zykon and its pilot.

We don’t sell or rent your personal data. We’ll delete or anonymise personal data when we no longer need it, subject to legal, accounting, fraud-prevention and other legitimate retention requirements.

If you want to ask us what data we hold about you, correct it or request deletion, email officialzykon@gmail.com.

The rest of this page explains the details.

1. What we collect

From a founding brand application

We collect:

the shop/brand name;
a mobile number;
an Instagram handle, if you provide one; and
anything you write in the free-text field.

From a founding creator application

We collect:

your name;
a mobile number;
an Instagram handle, if you provide one; and
anything you write in the free-text field.

From the waitlist form

We collect your email address.

Automatically

We collect the timestamp of your submission and, through our hosting provider’s standard request logs, your IP address and browser user agent.

We use this information to keep the site secure, operate it properly and help prevent automated spam or abuse.

From pilot transactions

When someone pays through a Zykon code, our payment partner may pass us:

the phone number entered at checkout;
the transaction amount;
the participating shop; and
the creator code used.

The phone number is used to identify and maintain a customer’s Zykoin balance. There is no separate consumer login at this stage.

We do not receive or store card numbers, UPI PINs or bank credentials. Those are handled by our payment partner.

A participating shop and the creator whose code was used may see transaction information relevant to them, including the amount, date and applicable code. They do not receive the customer’s full phone number or personal details through Zykon.

2. Why we collect it

We use personal data to:

assess applications and respond to applicants;
contact you by WhatsApp, phone or email where appropriate;
create and operate creator accounts, codes and dashboards where an application is accepted;
operate the Zykon platform and pilot;
attribute transactions to the correct shop and creator;
calculate and credit applicable Zykoin balances and creator commissions;
provide brands and creators with relevant transaction and performance information;
send one launch email to people who joined the waitlist;
prevent fraud, abuse and unauthorised activity; and
meet applicable tax, accounting, legal and regulatory obligations.

We do not sell or rent personal data.

We do not use application details for advertising unrelated to Zykon’s services.

If our use of personal data materially changes, we will update this policy and, where required, provide appropriate notice or obtain consent.

3. Where it’s stored

Form submissions are stored in our Supabase database (PostgreSQL, with row-level security) and, depending on configuration, may also be delivered to an internal notification endpoint.

Access is limited to Zykon’s operating team and authorised service providers.

Data is encrypted in transit over HTTPS and protected at rest by our relevant service providers.

Some of our infrastructure providers may process or store data outside India. Where this occurs, we use appropriate contractual and technical safeguards and require our service providers to handle personal data appropriately.

We share the minimum information necessary with service providers that help us operate Zykon, including:

Payment partner — payment processing, transaction handling and settlement. The specific payment partner will be identified here before public launch, together with a link to its applicable privacy policy.
Supabase — database and authentication hosting.
Vercel — website hosting, request logs, and cookieless aggregate web analytics (see Section 5).
Email/communications provider — to send emails or communications to you.

We may also disclose personal data where required or authorised by applicable law, court order or a lawful request from a government or regulatory authority.

A participating shop may see transaction information relating to transactions made at that shop.

A creator may see transaction information relating to transactions made using their code.

We do not provide either party with a customer’s full phone number or unrelated personal information.

5. Cookies and analytics

This site currently sets no cookies at all — no advertising cookies, no third-party tracking cookies, and no cookies of our own.

It uses sessionStorage once to remember that you have already seen the introduction animation so that it does not replay. This information remains in your browser and is not sent to us.

We use Vercel Web Analytics to understand how people use the site — which pages are opened, and which sites people arrive from. It is aggregate and cookieless: it sets nothing in your browser, it does not follow you between websites, and it does not build a profile of you. We see counts, not people.

If we later introduce cookies or other technologies that track individuals, we will update this policy and ask for your consent before setting them. Cookies that are strictly necessary — for example, the session cookie that would keep a brand or creator signed in to a dashboard — are disclosed here rather than consented to, because the service cannot work without them.

6. How long we keep it

We keep personal data only for as long as reasonably necessary for the purposes described in this policy, unless a longer period is required or permitted by law.

Applications we decline: normally deleted within 3 months, unless we need to retain limited information for a legitimate business, legal or fraud-prevention purpose.
Waitlist emails: until the launch communication has been sent or until you ask us to remove your email address.
Active creators and brands: for as long as necessary to operate the relationship and, afterwards, for as long as required for legal, accounting, tax, dispute-resolution or fraud-prevention purposes.
Customer transaction records: retained for as long as necessary to maintain applicable Zykoin balances, process disputes and meet applicable legal, tax, accounting and fraud-prevention requirements.
Server logs: retained according to our hosting provider’s retention settings, typically around 30 days.

When personal data is no longer required, we will delete or anonymise it where reasonably possible.

7. Your rights and how to contact us about your data

Depending on the applicable law and the status of the relevant provisions, you may have rights relating to your personal data, including requesting access to, correction of or deletion of your personal data and withdrawing consent where consent is the basis for processing.

You can contact us at officialzykon@gmail.com. Please use “Data Request” in the subject line.

We may ask for reasonable information to verify your identity before responding to a request.

We aim to acknowledge requests within 7 days and generally respond within 30 days, subject to the nature and complexity of the request and any applicable legal requirements.

There is no charge for a normal data request.

We may retain limited information where we are legally required or permitted to do so, including transaction, tax, accounting, fraud-prevention or dispute-related records.

Where we retain information after a deletion request, we will explain the reason where appropriate.

If you have a complaint about how we handle your personal data, please contact us first so we can try to resolve it.

8. Children

Zykon creator and brand accounts are available only to people aged 18 or above.

Earning or redeeming Zykoins through a Zykon account also requires the user to be at least 18.

A normal purchase at a participating business is different from creating a Zykon account. We do not knowingly create Zykon accounts for children.

If you believe we have collected personal data from a child in circumstances where we should not have, please contact us at officialzykon@gmail.com and we will review and take appropriate action.

9. Changes to this policy

Zykon is currently pre-launch and this policy may be updated as our products, services and data practices develop.

The “Last updated” date at the top of this page will always reflect the latest version.

If we make a material change to how we use personal data that you have already provided, we will provide appropriate notice and, where required, obtain consent.

10. Contact and Grievance Officer

Zykon, Surat, Gujarat, India.

For questions about your personal data, including access, correction, deletion or complaints:

Grievance Officer: Laksh Salecha
Email: officialzykon@gmail.com
Address: Zykon, R Tower 112, Citylight, Surat, Gujarat 395007, India

We aim to acknowledge complaints promptly and will handle them within the applicable legal or regulatory timeframe.

For data requests, please follow the process described in Section 7.