The short version
If you fill in a form here, we get your name, email, and what you typed into the fields. We use it to contact you about the pilot and nothing else. We don't sell it, we don't rent it, and we'll delete it on request — email officialzykon@gmail.com and it's gone within 30 days. The rest of this page is the detail behind that.
1. What we collect
From a founding brand application: the shop name, a mobile number, an Instagram handle if you give one, and anything you write in the free-text field. Four fields, two of them optional.
From a founding creator application: your name, a mobile number, your Instagram handle if you give one, and anything you write in the free-text field.
From the waitlist form: your email address. That's it.
Automatically: the timestamp of your submission and, via our hosting provider's standard request logs, your IP address and browser user agent. We use those to keep the site up and to stop automated spam.
From pilot transactions (not from this site): when someone pays through a Zykon code, our payment partner passes us the phone number entered at checkout, the amount, the shop, and the creator code used. That phone number is how a Zykoin balance is identified — there is no consumer login, so it is the only identifier we hold for a customer. We never receive or store card numbers, UPI PINs, or bank credentials. Those stay with our payment partner.
A participating shop and the creator whose code was used each see the amount, the date, and the code — never the customer's name, and never more than the last four digits of a phone number.
2. Why we collect it
- To assess your application and reply to it — by WhatsApp message or a phone call, on the number you gave us.
- To generate a creator's personal code and dashboard login if the application is accepted.
- To send one email at public launch, if you joined the waitlist.
- To attribute a payment to the right shop and creator, credit the right Zykoin balance, and show each party their own numbers.
- To meet tax, accounting, and anti-fraud obligations on transactions that actually happened.
We do not use your details for advertising, we do not build profiles on you, and we do not sell or rent personal data to anyone. Ever. If that changes, it will not change quietly — we will ask you first.
3. Where it's stored
Form submissions are stored in our Supabase database (PostgreSQL, with row-level security) and, depending on configuration, may also be delivered to an internal notification endpoint. Access is limited to Zykon's operating team. Data is encrypted in transit over HTTPS and at rest by the provider.
Our infrastructure providers may process or store data outside India. Where that happens we rely on the provider's contractual data protection commitments.
4. Who else sees it
We share the minimum necessary with service providers who process data on our behalf:
- Our payment partner — payment processing and settlement. They are the controller of payment data in their own right and have their own privacy policy. We will name them here once onboarding is complete.
- Supabase — database and authentication hosting.
- Vercel — website hosting and request logs.
- Our email provider — to send you a reply.
A participating shop sees the transactions made at that shop. A creator sees the transactions made with their own code. Neither sees a customer's full phone number or the other party's figures. We will also disclose data where a law, court, or regulator in India properly requires it.
5. Cookies and analytics
This site sets no advertising cookies and no third-party tracking cookies. It uses sessionStorage once, to remember that you've already seen the intro animation so it doesn't replay — that value never leaves your browser and identifies nothing.
We may add privacy-respecting, aggregate analytics (page counts, no cross-site tracking, no personal identifiers) before launch. If we add anything that tracks individuals, we will say so here first and ask for consent where the law requires it.
6. How long we keep it
- Applications we decline: deleted within 3 months, sooner if you ask.
- Waitlist emails: until we send the launch email, or until you ask us to remove you.
- Active participants: for as long as you're on the platform, and then as long as tax and accounting law requires for transaction records — currently up to eight years for financial records under Indian law.
- Customer transaction records: the phone number and transaction details, for as long as the Zykoin balance is live and then as long as tax and accounting law requires.
- Server logs: as long as our hosting provider retains them, typically 30 days.
7. Your rights and how to delete your data
Under India's Digital Personal Data Protection Act 2023 you can ask us to show you the personal data we hold about you, correct anything wrong or incomplete, delete it, or withdraw consent you previously gave. You can also nominate someone to exercise these rights if you die or become incapacitated.
Email officialzykon@gmail.com with “data request” in the subject. We'll confirm within 7 days and complete it within 30. There is no charge. The one thing we may keep after a deletion request is the minimum transaction record the law requires us to keep — we'll tell you exactly what that is if it applies to you.
If we've handled this badly, tell us first and we'll try to fix it. You also have the right to complain to the Data Protection Board of India.
8. Children
Holding a Zykon account, earning or redeeming Zykoins, and joining as a brand or creator all require you to be at least 18. We don't knowingly create accounts for anyone under 18.
Paying a bill through a Zykon code is a purchase like any other, and anyone old enough to lawfully make that purchase can do so. Where the phone number given at checkout belongs to someone under 18, we hold only the transaction record and do not create an account, do not build a profile, and do not use that data for any form of tracking or targeting.
If you believe we hold a child's data that we shouldn't, email us and we'll delete it.
9. Changes to this policy
Zykon is pre-launch and this policy will be rewritten before public release. The “last updated” date at the top always reflects the current version. If a change materially affects how we use data you already gave us, we'll email you rather than quietly editing this page.
10. Contact and Grievance Officer
Zykon, Surat, Gujarat, India.
For anything about your data — a copy of what we hold, a correction, a deletion, or a complaint about how we've handled it:
- Grievance Officer: Laksh Salecha
- Email: officialzykon@gmail.com
- Address: Zykon, R Tower 112, Citylight, Surat, Gujarat 395007, India
We will acknowledge any complaint within 48 hours and resolve it within 15 days. If we can't resolve it in that time, we'll tell you why and when we expect to.
Data requests are handled under the timelines in section 7. See also our terms of use.