Effective date: October 25, 2026
This policy explains what zuzadoor.com and the ZUZA app collect, why, who else receives it, how long it is kept and what you can ask us to do with it.
Contact for anything about privacy: [email protected]
When you order. On the Hyp payment page you enter your name, phone number, email, shipping address and card details. Hyp sends us the order details and a confirmation of the payment. Your card details stay with Hyp: they never pass through this site and never reach us.
When you join our mailing list or waiting list. Your email address, the language of the page, where you signed up from (for example, a link on Instagram) and when.
When you email or call us. Your details and what you wrote or said.
When you use the app. Docking records, described under "The ZUZA app" below.
When you visit the site. Our measurement tools — Google Analytics, the Meta Pixel and Metricool — receive the page address, the site you came from, campaign tags in the link (utm), device type, browser language and your IP address. Cloudflare, which hosts the site, receives your IP address and browser type, as on any website.
You are not legally required to give us any of this. Without a name, phone number and address we cannot ship an order, and without an email we cannot send updates or reply. You can read the whole site without giving us anything.
We do not collect sensitive personal information (such as health data, precise location or government ID numbers).
To process and ship your order, invoice it and answer your questions — performance of our contract with you (GDPR art. 6(1)(b)).
To keep tax and accounting records — our legal obligation (art. 6(1)(c)).
To send the welcome email, updates and offers you signed up for, and, if you joined the waiting list, one email when ZUZA can be ordered in your country — your consent (art. 6(1)(a)). You can withdraw it at any time.
To run the app and count docking time — performance of our contract with you (art. 6(1)(b)).
To measure visits and our advertising with Google Analytics, the Meta Pixel and Metricool — our legitimate interest in understanding how the site is used and whether our ads work (art. 6(1)(f)). You can object at any time, and the tools do not load when your browser sends Global Privacy Control (see "Cookies and browser storage").
To protect the site from abuse, for example by limiting how often a form can be sent from one IP address — our legitimate interest (art. 6(1)(f)). That count is held briefly in server memory and never written down.
We make no decisions about you by automated means that have legal or similarly significant effects.
Google Analytics sets the cookies _ga and _ga_KGWQEGCNYH. The Meta Pixel sets the cookie _fbp. They are used to measure visits and advertising.
The site keeps a random visitor number (zuza_vid) in your browser’s local storage, and a random visit number (zuza_sid) in session storage, which is cleared when you close the tab. Both are sent to Google Analytics with on-site events and contain no name or contact details. The Meta Pixel also stores the site you arrived from (lastExternalReferrer).
Global Privacy Control: if your browser sends a GPC signal, the site does not load Google Analytics, the Meta Pixel or Metricool, and none of their cookies are set. We treat GPC as a valid request to opt out of sale and sharing.
Do Not Track: browsers do not apply the older Do Not Track signal in a consistent way, so the site does not respond to it. Use GPC instead.
You can also block or delete cookies and storage in your browser settings. The site and checkout keep working.
Since version 1.1.0 (October 2026) the app requires an account: sign in with Apple, with Google or with an email code. An email address is required; a name is optional.
The account holds: your email address, a random account id, a display name if you typed one, your docking sessions (when the phone was docked, when it was picked up and for how long), and the doors you added — the unit id, the door name and the home name exactly as you typed them. Door names are free text: if you put a person's name in one, it is stored as written.
The data is stored with Supabase in Frankfurt (European Union). A copy of docking and door records is written to a private Google Sheet of the controller, for operations. Sign-in codes are sent through Gmail.
The app does not collect location, contacts, a phone number, a device identifier or an advertising identifier, and has no third-party analytics or crash reporting. The weekly reminder is off by default and is generated on the phone itself.
Delete your account: Settings → Account → Delete account, or follow https://zuzadoor.com/delete-account. Everything is erased within 30 days.
The app's full policy, including legal bases, processors and your rights: https://zuzadoor.com/app-privacy
Only service providers who work for us (processors), only as far as needed, and only on our instructions:
Cloudflare (United States): hosting the site, receiving the forms, and cookie-free visit counts.
Google (United States): our email, the spreadsheets that hold orders, sign-ups and app records, Google Analytics, and the site’s fonts.
Meta (Ireland and United States): the Meta Pixel, to measure our ads on Facebook and Instagram.
Metricool (Spain, EU): visit counts.
Resend (United States): the welcome email, and a notice to us of each sign-up.
MailerLite (Lithuania, EU): sending the newsletter, when we send one.
The shipping carrier: your name, address and phone number, to deliver the parcel. Our accountant: invoice details.
We will also disclose information when the law requires it.
We do not sell your personal information, and we do not use it for anything other than what is written here.
Some providers keep data in the United States. Where a provider is certified under the EU–US Data Privacy Framework (and its UK and Swiss extensions), the transfer relies on that framework; otherwise it relies on the European Commission’s Standard Contractual Clauses in the provider’s terms. You can ask us for details.
Mailing list: until you unsubscribe or ask us to remove you.
Waiting list: until we tell you ZUZA can be ordered in your country, or until you ask us to remove you — and no longer than two years.
Emails you send us: up to two years after our last exchange.
App records: for as long as your account exists. After you delete the account — within 30 days.
Measurement data: according to the settings of Google, Meta, Metricool and Cloudflare.
You may ask to access the personal data we hold about you, to correct it, to delete it, to restrict or object to its use, and to receive it in a portable format. Where we rely on your consent, you may withdraw it at any time; this does not affect what was done before.
Write to [email protected]. We answer within 30 days. To make sure we give data to the right person, we may ask you to confirm a detail, such as the email you ordered with.
In the last 12 months we collected these categories of personal information: identifiers (name, email, phone, postal address, IP address, the random ids described above), commercial information (what you ordered), internet activity (pages viewed and how you reached the site), and the app records described above. The sources, purposes and recipients are listed in this policy.
We do not sell personal information. The Meta Pixel and Google Analytics may count as "sharing" for targeted advertising under California law. You can opt out by turning on Global Privacy Control in your browser, or by emailing us; we will stop loading them for you.
You have the right to know what we hold, to delete it, to correct it, and to opt out of sale or sharing. You may use an authorized agent. We will not treat you differently, charge you more or give you a lower level of service for using any of these rights.
To make a request, write to [email protected]. We answer within 30 days.
We send marketing email only to people who asked for it.
Every message has an unsubscribe link. You can also reply "unsubscribe" or write to us. It takes effect within a few business days.
We write to a small number of academic researchers, and to practitioners whose work email is published on a public professional page or directory, to invite them to research collaborations or to our practitioner pilot.
Where we got your address: from a public staff page of your university, from a published paper on PubMed that lists it for correspondence, or from a public professional page or directory that lists your work email. We do not buy lists, guess addresses or use private ones.
What we keep: your name, title, institution, department, field, work email, the page where we found it, and one line about your research.
Why: our legitimate interest in inviting relevant researchers and practitioners to collaborate (art. 6(1)(f)). We do not share this list with anyone.
How long: if you do not reply, we delete your details within 12 months of our last email. If you reply "remove", we keep only your email address on a do-not-contact list, so we never write again.
Your rights are the ones described above. To use them, or to object to being contacted, write to [email protected].
Buying on this site is for adults. The site is not directed at children under 16, and we do not knowingly collect their personal information.
ZUZA is a product for the home, and children may dock a phone too. We suggest that a parent sets up the app. If you believe a child has given us personal information, write to us and we will delete it.
The whole site is served over HTTPS. Access to our spreadsheets and mailboxes is limited to people who work on ZUZA, and each provider protects the data with its own security measures.
No method is completely secure. If a security incident puts your data at risk, we will notify you and the authorities as the law requires.
When this policy changes, the date at the top changes too. We will note any material change on this page.