Privacy Policy

Last updated: 2026-10-26

This Policy explains what personal data Zanix ERP collects, why, who sees it and your rights over it. "We", "our" and "Zanix" mean Zanix Technologies, registered in the Kurdistan Region of Iraq at {{address}}, reachable at info@zanixtechnologies.com.

1. Who processes what

For your account on Zanix (your name, email, phone, company, billing): Zanix is the controller.
For the business data you put into your workspace (your customers', suppliers', staff' data): you are the controller and Zanix is the processor. You decide what to collect and how long to keep it; we process it to run the Service for you, as instructed by you.

2. What we collect

Account data: full name, email, phone, company name, company address, chosen Zanix address (subdomain), locale, chart of accounts choice, plan.
Payment data: payment references and amounts; we don't store card numbers.
Sign-in and security data: hashed passwords, two-factor settings, device fingerprint and session information, recent sign-in events.
Usage and diagnostic data: IP addresses, browser, times of requests, error reports.
Communications: emails and messages you send us.
Business data in your workspace: whatever you put in (customers, suppliers, invoices, items, employees, etc.). We only process this to run the Service for you.

3. Why we process it (legal bases)

To run the Service and perform our contract with you (sign-in, your workspace, backups, updates, support, billing).
To keep the Service safe (abuse prevention, logs, rate limiting, security events).
To meet legal and tax obligations (keeping invoices and records for the periods required).
With your consent (optional marketing emails; you can withdraw it at any time).

4. How long we keep it

Active accounts: as long as the account is open.
Cancelled accounts: workspace data is kept 30 days then deleted; a final backup is kept 90 days (needed for recovery and billing checks), then deleted.
Sign-in and security logs: 12 months.
Billing and tax records: as long as the law requires.

5. Who sees it

People in your company: whoever you give access to in your workspace.
Zanix staff: only those who need access to run the Service, under confidentiality.
Our hosting provider: Hostinger, where your workspace runs. We use Cloudflare as a reverse proxy for the website and sign-in.
Authorities: if we must by law.
We don't sell your personal data, ever. We don't use your business data to train AI.

6. Where it is stored

Our servers are hosted in the European Union. Backups are kept with the same provider in the same region. Cloudflare caches public pages worldwide.

7. How we protect it

HTTPS everywhere, with a modern cipher suite.
Passwords stored hashed (never in clear).
Two-factor authentication required for administrators by default.
Daily backups kept 90 days; a backup is taken before every update.
Each customer's data lives in its own database, separate from every other customer.
Access to the production server is limited to named staff with SSH keys and logged.

8. Your rights

You have the right to access your personal data, correct it, get a copy or ask us to delete it. For data in your workspace, do this yourself in Zanix (export, edit, delete). For account data, write to info@zanixtechnologies.com. We answer within 30 days.

9. Cookies and similar

We use cookies to keep you signed in, remember your language, and keep the Service safe. We do not use advertising or tracking cookies.

10. Children

Zanix is for businesses. We don't knowingly collect data from children under 16.

11. Changes to this Policy

We may update this Policy. We'll let you know in the app for material changes. The date at the top shows when it last changed.

12. Contact

Questions about this Policy or your data: write to info@zanixtechnologies.com.