Cemzlah Privacy Policy

Last updated: July 15, 2026

1. Information We Collect

When you use Cemzlah's services, we may collect the following types of information:

Account Information: Name, email address, and password when you create an account.
Business Information: Business name, type, website URL, and project requirements submitted through our order form.
Contact Information: Phone number and email address for project communication.
Payment Information: Payment details are processed securely through a PCI-compliant payment processor. We do not store your credit card information on our servers. We do store the billing country (the two-letter country code) associated with your purchase, which we use for order records and aggregated sales analytics.
Usage Data: Information about how you interact with our website, including pages visited and features used.
Approximate Location: We derive your approximate country from your IP address to display pricing that is relevant to your region. This processing happens on our own servers and your IP address is not shared with third parties for this purpose.
Advertising & Measurement Data: If you accept advertising cookies via our cookie banner, the Meta (Facebook) Pixel collects your IP address, browser information, and the pages you view on our site, and shares them with Meta so we can measure and improve our advertising. When you complete a conversion after consenting — such as submitting our booking form or placing an order — we also send Meta a matching event through Meta's Conversions API, including a one-way hashed (irreversible) form of the contact details you entered and, for orders, the purchase amount, used only to measure that conversion. All of this happens only with your consent — see the Cookies section below.

2. How We Use Your Information

We use your information to:

Provide, maintain, and improve our web development services
Process orders and payments
Communicate with you about your projects, account, and our services
Send you updates about your order status
Comply with legal obligations

We do not sell, trade, or rent your personal information. We may share your information with:

Service Providers: Third-party services that assist us in operating our business (e.g., payment processing, authentication, SMS delivery via Twilio).
Advertising Partners: If you consent to advertising cookies, Meta Platforms, Inc. receives the website activity described above — through the Meta Pixel in your browser and, for conversions such as bookings and orders, through Meta's server-side Conversions API (with contact details hashed before they are sent) — to help us measure and target our advertising. You can withdraw this consent at any time via the Cookie Settings link in our footer.
Referral Partners: If you purchase after following a referral partner's link, that partner can see aggregated, non-identifying statistics about their referrals — counts of clicks and purchases, commission amounts, and the billing country of purchases — alongside a masked form of the purchaser's email address. Referral partners never receive your name, full email address, payment details, or any other personal information.
Legal Requirements: When required by law or to protect our rights.

We do not share or sell phone numbers or SMS opt-in data to any third party for marketing purposes. Phone numbers are only shared with Twilio (our SMS delivery provider) for the sole purpose of sending the messages you have opted in to receive.

4. SMS / Text Messaging

When you add a phone number to your Cemzlah account, you can opt in to receive SMS messages from us. Your consent is required (an unchecked checkbox during phone-number setup); we do not enroll you in SMS automatically.

What we send:

Booking confirmations and order notifications
Account updates (verification codes during phone setup, security alerts)
Occasional promotional offers
Two-factor authentication codes — sent only when you have enabled SMS-based 2FA in your account security settings, and treated as transactional / always-on regardless of marketing opt-out

Message frequency: Varies based on your account activity. Most users receive fewer than 5 messages per month. Transactional messages (verification codes, security alerts) are sent on demand and not subject to a frequency cap.

Message and data rates may apply. Your mobile carrier may charge you for incoming SMS based on your plan. Cemzlah does not charge a fee to receive these messages.

Opt out: Reply STOP to any Cemzlah SMS at any time to stop all non-transactional messages. You will receive one confirmation message and then no further marketing or notification SMS. To re-enable messages later, reply START or remove and re-add your phone number in your account settings.

Help: Reply HELP to any Cemzlah SMS for assistance, or contact hello@cemzlah.com.

Removing your phone number: You can remove your phone number at any time from your account profile at accounts.cemzlah.com/profile. Removing your number disables any SMS-based services tied to it, including SMS 2FA.

Phone-number sharing: Phone numbers and SMS opt-in data are never sold, rented, or shared with third parties for their own marketing. They are passed only to Twilio for the technical purpose of delivering the messages you opted in to receive.

5. Data Security

We implement industry-standard security measures to protect your data, including encryption in transit (TLS/SSL), secure authentication, and regular security updates.

6. Your Privacy Rights

Wherever you live, you have the following rights over your personal data. To exercise any of them, email hello@cemzlah.com from the address on your account; we verify your identity before acting and respond within the timeframe required by applicable law (and in any case within 45 days). Exercising a right is free and never results in discriminatory treatment.

Access — obtain a copy of the personal data we hold about you
Correction — have inaccurate or incomplete data corrected
Deletion — have your data erased; see Account Deletion for the exact steps
Portability — receive your data in a portable, machine-readable format
Restriction & objection — restrict or object to certain processing, including processing based on legitimate interests
Withdraw consent — withdraw any consent you previously gave (e.g. marketing cookies or SMS) at any time, without affecting processing already carried out
Opt out of marketing communications

6.1 Legal bases (EEA / UK — GDPR & UK GDPR)

If you are in the European Economic Area or the United Kingdom, we process your personal data only where we have a legal basis to do so:

Performance of a contract — to provide the services you order and manage your account
Consent — for marketing cookies, the Meta Pixel / Conversions API, and SMS marketing (you may withdraw consent at any time)
Legal obligation — to meet tax, accounting, and other statutory requirements
Legitimate interests — to secure our services, prevent fraud, and improve our products, balanced against your rights

You also have the right to lodge a complaint with your local data protection authority (in the EEA) or the UK Information Commissioner's Office (ICO), though we encourage you to contact us first so we can help.

6.2 California residents (CCPA / CPRA)

If you are a California resident, you have the rights to know, access, correct, and delete the personal information we hold about you, and to opt out of the “sale” or “sharing” of personal information, as those terms are defined under the CCPA.

We do not sell your personal information, and we do not share it for cross-context behavioral advertising in exchange for money. If you opt in to marketing cookies, the resulting transfer of identifiers to Meta may be considered “sharing” under the CPRA; you can opt out at any time using the Cookie Settings link in our footer, and we honor Global Privacy Control (GPC) signals as a valid opt-out. We do not knowingly sell or share the personal information of consumers under 16. You may use an authorized agent to submit a request, and you have the right to appeal a refused request by replying to our response. We will not discriminate against you for exercising any of these rights.

7. Account Deletion

You can delete your Cemzlah account at any time, directly and free of charge. Your Cemzlah account is the single sign-on identity shared across every app and product we publish under our developer account — shown on store listings as Cemzlah, CEMZLAH, Cemzlah LLC, or CEMZLAH LLC, all the same entity (Cemzlah LLC) — so deleting it removes your access everywhere it is used.

To request deletion of your Cemzlah account:

Sign in and go to your security settings at accounts.cemzlah.com/security. Within our mobile apps you can reach the same screen from your account / profile settings.
Scroll to the Delete account section and select Delete Account.
Confirm your identity — enter your password, or, if you sign in only with Google or Discord, type delete my account — then confirm.
Your account is immediately scheduled for deletion, you are signed out on every device, and we email you a confirmation containing a link to cancel.
After a 30-day grace period, your account and associated data are permanently deleted and cannot be recovered.

Prefer to do it by email? Write to hello@cemzlah.com from the email address on your account and ask us to delete it. We will verify your identity and process the request on your behalf.

Cancelling a deletion request. During the 30-day grace period your account is deactivated but recoverable. You can cancel and reactivate it using the link in the confirmation email, or by signing back in and choosing Cancel Deletion & Reactivate Account. Once the 30 days elapse, the deletion is permanent and irreversible.

8. Data Retention

We keep your personal data only for as long as your account is active or as needed to provide our services. When you delete your account (see Account Deletion), the following applies.

Data that is permanently deleted after the 30-day grace period:

Your account profile — name, email address, password hash, and avatar image
Linked sign-in providers (Google, Discord) and passkeys
Active login sessions, devices, and authentication tokens
Orders, project requests, billing profile, support messages, and notification preferences
Phone number and SMS opt-in records, and WhatsApp contact data

Data that is retained, and why:

Financial and transaction records (invoices, receipts, payment records) are retained in our accounting system and by our PCI-compliant payment processor as required by tax, accounting, and anti-fraud law — typically for up to seven (7) years. These records are kept independently of your account and are not used to contact you after deletion.
A minimal deletion record (such as the account identifier and the date of deletion) is retained in our audit log for security, fraud-prevention, and legal compliance.
Aggregated or anonymized analytics that no longer identify you may be retained indefinitely.
Data already shared with third parties before deletion (e.g., advertising measurement data held by Meta, or SMS delivery logs held by Twilio) is retained by those providers under their own retention schedules and privacy policies.

Locally stored app data. Some Cemzlah apps store content (for example, media or files you create) only on your own device — it is never uploaded to or stored on Cemzlah servers. Deleting your account does not affect that data; to remove it, delete it within the app or uninstall the app.

9. Cookies

Essential cookies. We use essential cookies for authentication and session management. These are always active because the site cannot function without them, and they do not require your consent.

Marketing cookies (consent required). Only if you opt in, we load the Meta (Facebook) Pixel, which sets advertising cookies (such as _fbp) and shares your website activity with Meta so we can measure and improve our advertising campaigns. These cookies are off by default. The first time you visit we show a cookie banner where you can Accept all, Reject all, or Manage preferences to choose categories individually. If you do not opt in, no advertising cookies are set and no data is sent to Meta. If you later withdraw consent, we revoke tracking and clear those cookies.

You can change your choice at any time using the Cookie Settings link in the footer of every page. We also honor browser opt-out signals: if your browser sends a Global Privacy Control (GPC) or Do Not Track signal, marketing cookies stay off without any action from you.

10. Children's Privacy

Our services are not directed to children, and we do not knowingly collect personal information from anyone under the age of 13 — or, where their country sets a higher minimum age of digital consent (up to 16 in parts of the EEA), under that higher age. We check the date of birth and country you provide at sign-up and refuse accounts below the applicable minimum. You must be at least the age of majority in your jurisdiction, or have the consent of a parent or legal guardian, to create a Cemzlah account or use our apps. If you believe a child has provided us with personal information, contact us at hello@cemzlah.com and we will delete it promptly.

11. International Data Transfers

Cemzlah is based in the United States, and the service providers we use (such as our hosting, payment, SMS, and advertising-measurement partners) may process your data in the United States or other countries. These countries may have data-protection laws that differ from those in your country.

Where we transfer personal data out of the EEA or the UK, we rely on appropriate safeguards — such as the European Commission's Standard Contractual Clauses (and the UK Addendum) — to ensure your data remains protected to the standard required by applicable law.

12. Changes to This Policy

We may update this Privacy Policy from time to time to reflect changes in our practices, technology, or legal requirements. When we make material changes, we will update the “Last updated” date at the top of this page and, where required by law, notify you by email or through the service. Your continued use of Cemzlah after an update takes effect constitutes acceptance of the revised policy.

13. Contact Us

If you have questions about this privacy policy, or want help deleting your account or exercising any of your privacy rights, please contact us at hello@cemzlah.com.