Privacy Policy

• Account information. When you create an Account, we collect your name, email address, and password (stored only as a one-way cryptographic hash — we never store your actual password).
• Billing and entitlement information. If you purchase a paid tier, we store your subscription tier, billing period, coupon code used (if any), and payment status. We do not collect or store your card number or other raw payment details — these are handled directly by our payment processor, PayMongo (see Section 5).
• Saved circuit projects. If you save a circuit in ZOLB Circuit Lab (a feature available to Premium and VIP accounts, and to Free accounts that saved projects before that restriction took effect), we store the circuit’s components, wiring, and any code you wrote for it, so you can reload it later.
• Certificate information. If you claim a ZOLB Circuit Lab challenge certificate, we store the name you confirm for it and the details of the certificate. See Section 12.
• Contact form submissions. When you use the contact form, we collect the information you provide directly: your name, email address, company (optional), the service you’re interested in, and your message.
• Cookies and local storage. See Section 9 below.

We use the information described above only to:

• Authenticate you and operate your Account, including sign-in and sign-out;
• Provide the Service you request, including processing purchases, applying coupons, and maintaining your access to paid tiers;
• Respond to inquiries submitted through the contact form;
• Deliver circuits you choose to send to another user (see Section 11);
• Create, show, and verify the certificates you claim (see Section 12);
• Detect, investigate, and prevent fraud, abuse, or security incidents (for example, rate-limiting coupon-code attempts); and
• Comply with legal obligations, such as maintaining records where required by law.

We do not sell your personal information, and we do not use it for advertising, profiling, or any purpose beyond what is described above and elsewhere in this Policy.

• PayMongo — processes payments for paid tiers. PayMongo receives your payment details directly; we never see or store your card number.
• Brevo — delivers transactional emails, such as contact-form notifications.
• MongoDB Atlas — hosts our database. Data may be stored on servers located outside your home country as part of this hosting arrangement.
• Vercel — hosts and serves the Service.
• Meta (Facebook/Instagram), Google (Google Ads/YouTube), and TikTok — if you consent to marketing cookies (see Section 9), these platforms receive limited browsing data through their advertising pixels to measure and improve our ad campaigns. They never receive this data if you decline or have not yet made a choice.
• Each of these providers processes data only as needed to perform the service they provide to us, and is bound by its own privacy policy and, where applicable, a data-processing agreement with us.

Subject to certain exceptions under the DPA, you have the right to:

• Be informed that your personal information is being processed;
• Access your personal information that we hold;
• Object to or withdraw consent for processing, where consent is the basis for that processing;
• Correct any inaccurate or outdated personal information;
• Request erasure or blocking of your personal information under certain conditions;
• Receive a copy of your personal information in a portable format; and
• Be indemnified for damages sustained due to inaccurate, incomplete, or unlawfully obtained personal information, and to file a complaint with the National Privacy Commission.

To exercise any of these rights, contact us at admin@zolbtech.com. We will respond within a reasonable time as required by law.

Strictly necessary. The Service always uses a session cookie to keep you signed in and a local-storage entry to remember your light/dark theme preference and your cookie-consent choice. These cannot be turned off without breaking basic functionality, and we do not ask for consent to use them.

Marketing cookies (optional). If you consent, we load advertising pixels from Meta (Facebook/Instagram), Google (Google Ads/YouTube), and TikTok, which help us measure and improve ad campaigns. These are not loaded until you explicitly accept them in the cookie banner shown on your first visit, and never load at all for any platform we have not configured. You can accept, decline, or change your choice at any time using the “Cookie Preferences” link in the site footer.

Clearing cookies through your browser settings will sign you out and reset your cookie-consent choice, so the banner will appear again on your next visit.

Premium and VIP users can send a copy of a circuit to another Premium or VIP user. This section explains what happens to the information involved.

• What the receiver sees. When you send a circuit, you can choose to show or hide your name and email. They are shown by default. If shown, the receiver sees your name, your email, and the date you sent it. If hidden, the receiver sees only that the sender is hidden, and the date sent.
• What we keep. Even when you hide your name and email, ZOLB keeps a record of which account sent the circuit. We do not show it to the receiver. We use it only for security and to investigate abuse.
• Copies.The receiver’s copy is a snapshot made when you send it. Later changes to your circuit do not change their copy. The receiver can save their own edited version, and can remove a shared circuit from their own inbox. [OWNER TO CONFIRM — reflects how the app works today: a version the receiver saves keeps a note of who made the original, or that the sender is hidden.]
• Not public. Shared circuits are not public. There are no public links.
• How long we keep it. [OWNER TO CONFIRM: how long shared circuit snapshots and the sender record are kept]

This section applies when you claim a ZOLB Circuit Lab challenge certificate.

• What we store. The name you confirm for the certificate (first, last, and optionally middle name and suffix); the challenge you passed, its title and level; the dates you passed it and the certificate was issued; a certificate ID; whether the certificate is valid or revoked; how many times its verification page was opened and when last; and a record of any correction or revocation made by our staff (who, when, and why). We store only a one-way hash of your verification link, never the link itself, so we cannot show it to you again. We can only make you a new one.
• Who can see it. Anyone who has your verification link or scans the QR code on your PDF can open the public verification page. It shows the certificate title and level, the date, whether the certificate is valid, and your name with some letters hidden (for example, N**O). It does not show your full name, your email, your account, or any other certificate. The certificate ID is also printed on your PDF. Anyone who has that ID can type it into the checker on our Certificates page and see only whether the certificate is valid or revoked, its title and level, the date, and your name with some letters hidden. If you share the PDF itself, the person you give it to sees your full name, because it is printed on it.
• Your controls.In My Certificates you can switch public verification off or on at any time, or make a new verification link. A new link replaces the old one. While verification is off, your link, your QR code and the ID checker all show “Certificate not found.”
• PDF and email. We create your PDF when you download it and do not store it. When you claim a certificate we email you the PDF and your verification link at the email address of your Account.
• Corrections and revocation. If your name is spelled wrongly, contact us and we may correct it. We may revoke a certificate that was issued by mistake or obtained unfairly (see the Terms of Service). A revoked certificate shows only that it is revoked.
• If you delete your account. Your certificates are deleted with it. Before that, we email you a PDF copy of each valid certificate at your Account email address, so you keep a copy. These copies have no QR code, and your verification links stop working when the account is deleted. Deleted data may remain in routine backups for a limited time (see Section 7).