Privacy policy
What we keep, and why.
eZacto is made by CONFLICT LLC, a small software studio in Miami, Florida. This policy covers ezacto.com, the marketing site for eZacto, and the separately described hosted eZacto service operated by CONFLICT. It does not cover the demo at ezacto.io or anything you self-host. If you run your own copy of eZacto, we do not receive its business records merely because you use it. Information you send to our support team is a separate case.
The short version: we collect as little as we can, we tell you what we do with it, we don’t sell it, and you can ask us to delete data we no longer need to retain.
What we collect and why
The hosted-interest signup. If you fill in the form, we keep your email address and, only if you choose to answer, a team-size band, a rough switch timing, and whether the proposed price interests you. We use this to understand interest in hosted eZacto, manage the limited-beta list, and contact you when self-service signup becomes available. Signing up is free, needs no card, and is not a purchase or a promise that a hosted service launches. The legal basis is the consent you give by ticking the box on the form. We may email you about hosted eZacto and nothing else; every email has an unsubscribe link.
Website analytics, only if you accept. We would like to know which parts of the page people read and where they give up. For that we use Google Analytics 4 and Microsoft Clarity, and neither loads until you choose “Accept analytics”. If you decline, nothing loads and the site works exactly the same. If you accept, Google Analytics receives page views, scroll depth, and a handful of named events (a click on the demo link, a click on the hosted-interest button, a change to the pricing calculator, starting the form, and a successful signup). The events carry coarse values only, such as a team-size band; they never carry your email address, the page’s query string, or free text. Clarity records how a session moves around the page with strict masking: page text, signup inputs, and form messages are masked. The current website grants analytics consent only; advertising storage, advertising user data and ad personalization remain denied. Any future advertising measurement requires its own disclosure and applicable consent before it is enabled.
Correspondence. If you email us, we keep the message so we can answer it and refer back to it.
What we deliberately don’t collect. We do not send your IP address, your name, or the page you came from with the form. This describes the form payload, not every network request: the providers delivering and protecting the website receive connection information such as IP addresses and browser details. We do not add fingerprinting to the signup form.
When we access or disclose your information
To run the site. Signups are stored in our own database on Cloudflare (D1) and copied to HubSpot, which we use to email you. Analytics data, when you accept it, goes to Google and Microsoft. The site itself is served by Cloudflare. Their roles depend on the service. Cloudflare and HubSpot process signup data for us under applicable data-processing terms. Microsoft describes Clarity as a data controller under its own privacy statement; it is not simply our instructed subprocessor. Google’s roles depend on the service and settings. See Microsoft’s privacy statement and Google’s privacy policy.
To answer you. Someone at CONFLICT will look at your signup or your email when they need to reply to you or to count interest. Nobody browses the list for fun.
When the law requires it. We would disclose data if legally compelled to, and we would tell you unless we were legally prohibited from doing so.
Never for sale. We do not sell or rent signup lists. We do not provide signup emails to advertising audiences. Optional analytics disclosures and provider roles are described above; declining analytics prevents those tags from loading.
Your rights
Wherever you live, you can ask us what we hold about you, ask us to correct it, ask us to delete it, ask for a copy, or object to how we use it. Email privacy@ezacto.com and we will answer within 30 days. Deleting your signup removes you from the interest count; there is no cost and no downside to asking. If you are in the EU, UK, or Switzerland you also have the right to complain to your local data protection authority.
How long we keep it
For new beta-list signups, we retain your application while it is needed to manage your requested participation and communications, and review it no later than 12 months after signup. You can withdraw and request deletion sooner. Earlier signups remain subject to the retention notice given when they were collected; this update does not retroactively extend that period. We may retain a minimal suppression record to honor an unsubscribe request. Analytics: Google Analytics keeps event data for 14 months; Clarity keeps recordings for 30 days and aggregated heatmaps for 13 months. Correspondence: as long as it is useful for answering you.
How we secure it
Cloudflare Turnstile checks signup requests for abuse. It processes browser and network signals for this security purpose, independently of optional analytics. Challenge tokens are verified by our server and are not saved with your signup or sent to analytics.
Everything travels over HTTPS. Signups live in our own Cloudflare database and in HubSpot, encrypted at rest; access is limited to the people at CONFLICT who need it, behind two-factor authentication. The form posts to our own site and to nowhere else.
Where the data lives
We are in the United States, our Cloudflare database is created in North America, and HubSpot stores signups in a United States data center. If you are outside the United States, using the form means your data is transferred here. For data from the EU, UK, or Switzerland we rely on our processors’ standard contractual clauses where applicable. Agreeing to a privacy policy or opting into email does not, by itself, replace a required international-transfer safeguard. Contact us for information about the safeguards applicable to your data.
Changing your mind about analytics
Use “Privacy choices” in the footer of any page. Choosing “Withdraw consent” removes the analytics cookies the page can reach and reloads without the tags. The current site stores your choice, its version and timestamp in your browser. Clearing browser storage removes that local record and the site asks again. Withdrawal stops future collection; it does not automatically erase data already received by a provider. Contact us about deletion of previously collected data.
Support and additional service providers
Support submitted through an eZacto app is handled by our website service on Cloudflare and recorded in private GitHub support issues. It can include your message, optional reply address, app/platform information and diagnostic details you choose to attach. Do not send passwords, payment-card details or unnecessary customer records. Mobile builds with crash reporting enabled also use Sentry; see the mobile app privacy policy.
Hosted-beta infrastructure is being prepared with AWS for hosting, Amazon SES for service email, and Stripe Managed Payments/Link for eligible checkout and subscription purchases. These are separate from submitting this free interest form. Stripe also processes payment information for its own fraud-prevention and legal purposes, as described in Stripe’s privacy policy.
Hosted eZacto accounts
When hosted signup opens, we collect the account email, organization name, requested workspace address, plan choices, and any optional referral or acquisition source. We record email-verification and checkout status, the policy and beta-notice versions accepted, acceptance time, IP address and browser details for account security and evidence of the agreement. Stripe processes the payment method; we retain customer, subscription, invoice and payment-status references needed to administer billing. A free interest-list entry does not create a hosted account or start a paid subscription.
A hosted workspace processes information its users enter, including user profiles, projects, time entries, clients, invoices and attachments. We use it to provide, secure, back up and support that workspace. For customer-controlled workspace records, the customer generally decides why the information is processed and CONFLICT acts under the applicable service and processing terms. CONFLICT decides how to use its own account, billing, security and support records. AWS provides hosted storage, compute, authentication and service email; Stripe/Link handles eligible checkout and subscriptions; Cloudflare Turnstile checks signup for abuse. Support requests may be recorded in private GitHub issues. Hosted crash diagnostics may go to separate Sentry projects if that reporting is enabled.
The selected hosting region must be identified before activation. Regional commitments cover only the tenant data and backups expressly included in the hosted terms; billing, authentication, support, email, security logs and optional diagnostics may be processed elsewhere, including the United States. A regional choice does not itself establish compliance with every local privacy law. We retain account and workspace data while needed to provide the service, then handle closure, export, deletion and necessary legal records under the hosted retention terms and deletion process. Backup copies and independent provider records follow their applicable retention and restoration procedures; we do not promise immediate erasure of every copy. Contact privacy@ezacto.com for access, correction, export or deletion requests and information about applicable transfer safeguards and processing terms.
For a separately contracted CONFLICT-hosted workspace, see the hosted account-closure and retention terms. They distinguish necessary tax, accounting, employment and audit records from data eligible for erasure, identify US and Florida sources, and preserve mandatory privacy rights. Those recordkeeping duties do not justify retaining marketing-list data indefinitely and do not set the policy of independently self-hosted workspaces.
Adults and international visitors
The hosted-beta offer is for adults aged 18 or older, including businesses and individual consumers. A payment card does not verify age. We do not direct this marketing site to children. Hosting-region selection concerns the scope described for the hosted service; it does not make marketing, billing, support or analytics data EU-only.
Changes and questions
We may update this policy as the site changes. The date at the top moves when we do, and if a change matters to what we do with your signup we will email the list before it takes effect.
Questions, requests, or complaints: email privacy@ezacto.com, or write to CONFLICT LLC, 80 SW 8th St, Ste 2000, Miami, FL 33130, USA.