Legal
Privacy Policy
What we store, why we store it, who else sees it and how to get it deleted. This describes what the site actually does — nothing more.
Last updated 26 August 2026
What we store
| Data | Why |
|---|---|
| Email address | Identifies your account, lets you sign in and reset your password, and is how order confirmations reach you. |
| Username | Shown on your dashboard and used for your affiliate link. |
| Sign-in method | Whether you use email or Google, so we show you the right options. We never see your password — sign-in is handled by Supabase. |
| Licence and plan | Which plan you own, when it started and when it expires. |
| Order records | Plan, amount, payment method, the reference you gave us and your review status, so a purchase can be traced and supported. |
| paysafecard PIN | Only while an order is open, because it is what we redeem. It is deleted the moment the order is approved or rejected, and an admin viewing one is written to the audit log. |
| Discord name | Optional. Only so we can reach you if there is a problem with a payment, or to link your Discord account. |
| Hardware fingerprint | Stored as a one-way hash, never the raw value, so one purchase runs on one machine. |
| Security log | Blocked and unusual requests: the kind of event, the account involved, your browser string and a hashed IP address. The hash lets us count attempts from one source without keeping the address itself. |
| Admin audit log | Every administrative action on an account, so changes to your access can always be explained. |
We do not store card numbers, bank details or your password. We do not run advertising or analytics trackers, and we do not sell or share data for marketing.
Why we are allowed to
- To perform our contract with you — your account, your purchase and delivering access.
- Our legitimate interest in a working, non-abused service — rate limiting, fraud prevention and the security log.
- Legal obligation — keeping the records of a sale that tax law requires.
Who else processes it
- Supabase — accounts and sign-in.
- Cloudflare — hosting and the database. Your IP address passes through Cloudflare to reach us; we only ever store it hashed.
- Our payment provider — card, PayPal and cryptocurrency payments. They take the payment data; we receive only the confirmation and a reference.
- paysafecard — when you pay with a prepaid PIN.
- Our email provider — to send order confirmations and password resets.
- Discord — only if you choose to link your Discord account.
Storage in your browser
We do not use tracking cookies. Your browser keeps two things locally: your sign-in session, so you stay logged in, and your dashboard light or dark preference. Both stay on your device and are cleared when you sign out or clear site data.
How long we keep it
- Account and licence data — until you ask us to delete the account.
- paysafecard PINs — until the order is reviewed, then deleted.
- Order and payment records — for as long as tax law requires us to keep proof of a sale.
- Security and audit logs — kept as a rolling record so abuse can be investigated.
- After deletion — we keep a one-way hash of the deleted account’s identity and email. It cannot be turned back into your address; it exists so a removed account cannot immediately be recreated.
Your rights
You can ask for a copy of your data, have it corrected, have it deleted, or object to how we use it. Email [email protected] from the address on your account and we will answer within 30 days. If you are in the EU or UK and you are not satisfied, you can complain to your national data protection authority.
Deleting your account removes your Zerio data and ends your access. It cannot be undone and it does not refund an active plan.
Age
Zerio is not intended for children under 16. If you believe a child has created an account, contact us and we will remove it.
Contact
Email [email protected] or reach us on Discord. We answer support within one working day.