This policy explains how Zeros and Ones LLC ("we", "us") collects, uses, and shares personal information when you visit ezgrc.app, create an ezGRC account, or communicate with us.
Customer content is covered separately. When an organization uses ezGRC to run its compliance program, the evidence, documents, and other data it puts into the Service ("Customer Data") belong to that organization. For Customer Data we act as a processor (service provider) on the customer's behalf, under our Data Processing Addendum (https://ezgrc.app/legal/dpa). If your information is in a customer's ezGRC account and you have a question about it, please contact that organization; we will help them respond.
1. Information we collect
You give us:
- Account information: name, work email, organization name, password (stored as a salted hash, never in plain text), role, and profile details.
- Billing information: billing contact, company address, and tax details. Card and bank details are entered directly with our payment processor; we don't store full card numbers. If you buy through AWS Marketplace, AWS handles payment and shares limited account and subscription information with us (such as your AWS account ID and the plan purchased).
- Communications: messages you send us through email, contact forms, the Trust Center, support requests, and booking a meeting.
- Trust Center requests: if you request gated documents from our Trust Center (or a customer's), your name, email, company, and acceptance of the NDA.
Collected automatically:
- Usage and device data: IP address, browser and device type, pages and features used, timestamps, and error logs.
- Cookies and similar storage: the Service uses browser storage that is strictly necessary to sign you in, keep the Service secure, and remember preferences such as theme. On our public marketing pages (ezgrc.app home, pricing, about, contact and legal pages) we use Google Analytics to understand how visitors use the site, but only if you accept analytics in the cookie banner. If you decline, or don't choose, Google Analytics is not loaded. You can change your choice any time with the "Cookie settings" link in the site footer. Google Analytics never runs inside the signed-in application, the Trust Center, or token pages such as password reset and auditor links. Google Analytics data is kept for 14 months.
From third parties:
- Sign-in providers: if you sign in with single sign-on (Okta, Microsoft Entra, another OIDC/SAML provider, or TitaniumVault), we receive your name, email, and identity attributes your organization's provider shares.
- AWS Marketplace: subscription and entitlement information when you buy through AWS.
2. How we use it
- To provide, operate, secure, and support the Service and your account.
- To process payments, manage subscriptions and trials, and send receipts and account notices.
- To send service emails (for example welcome, onboarding, trial reminders, and security notices). Non-essential emails include an unsubscribe link.
- To respond to you and schedule meetings you request.
- To monitor and improve the Service, fix problems, and prevent abuse and fraud.
- To comply with law and enforce our terms.
We don't sell or share your personal information for cross-context behavioral advertising, and we don't use Customer Data to train AI models shared with other customers.
Legal bases (EEA, UK, Switzerland): performing our contract with you or your organization; our legitimate interests in running and securing a business software service; your consent where we ask for it; and compliance with legal obligations.
3. How we share it
We share personal information only:
- with service providers (subprocessors) that help us run the Service, under contracts that limit their use of the data. The current list, with their purpose and location, is at https://ezgrc.app/legal/subprocessors/;
- with AWS if you purchase through AWS Marketplace;
- with your organization, if you use an account it administers;
- if required by law or to protect rights, safety, and security; and
- in connection with a merger, acquisition, or sale of assets, subject to this policy.
4. International transfers
We are based in the United States and host the Service in the United States (AWS US East, N. Virginia). If you are outside the US, your information is transferred to the US. For transfers from the EEA, UK, and Switzerland we use the European Commission's Standard Contractual Clauses (and the UK Addendum) or another lawful transfer mechanism.
5. Retention
- Account and billing information: for as long as your account is active, and afterwards as needed for legal, tax, and accounting purposes (generally up to 7 years for billing records).
- Customer Data after a subscription or trial ends: 30 days, then deleted (see our Terms).
- Server and security logs: kept only as long as needed to operate and secure the Service, and never longer than 12 months.
- Marketing contacts: until you unsubscribe or ask us to delete them.
6. Security
We protect personal information with encryption in transit and at rest, access controls, and monitoring. Details are in Annex 2 of our Data Processing Addendum: https://ezgrc.app/legal/dpa/. No system is perfectly secure; if we learn of a breach affecting your personal information, we will notify you as the law requires.
7. Your rights
Depending on where you live, you may have the right to access, correct, delete, or receive a copy of your personal information, to object to or restrict certain processing, and to withdraw consent. California residents have the rights described in the CCPA/CPRA, including to know, delete, and correct, and to not be discriminated against for exercising them. We don't sell or share personal information as those laws define it, and we don't process sensitive personal information to infer characteristics.
To make a request, email privacy@zerosandones.us. We will verify your request and respond within the time the law requires (generally 30 to 45 days). You may use an authorized agent. If you are in the EEA or UK, you can also complain to your local data protection authority.
8. Children
The Service is for businesses and is not directed to children under 16. We don't knowingly collect their personal information.
9. Changes
We will post changes here and update the effective date. If changes are material, we will notify account owners by email or in the Service before they take effect.
10. Contact
Zeros and Ones LLC 2875 S Orange Ave, STE 500 #6340, Orlando, FL 32806, USA privacy@zerosandones.us · +1 (407) 987-2444