Who this policy covers
This policy applies when you visit Zyobit, run a public audit, create an account, subscribe to a plan, contact us, or use the Zyobit dashboard. Zyobit is the controller of account, website and public-audit information. When an agency supplies client information through its account, the agency is the controller and Zyobit acts as its processor; see the Data Processing Agreement.
Information we collect
- Audit inputs: a website or business name and a city and country. These are public business identifiers.
- Account information: your email address, organization, profile, settings, plan and the businesses or locations you manage.
- Public market information: business listings, ratings, review metadata, website content permitted by robots.txt, search results and AI-assistant answers. Zyobit does not retain scraped review bodies.
- Security and usage records: request timing, outcome and a salted one-way hash of an audit requester’s IP address for abuse prevention. Plain IP addresses are not stored in the audit log.
- Billing information: plan, subscription and Dodo Payments customer identifiers. Card numbers are entered with Dodo Payments and do not reach Zyobit’s servers.
- Newsletter subscriptions: the email address you provide when you sign up for updates.
- Messages: information you choose to include when you contact Zyobit or request support.
Public audit reports are accessible to anyone with the report link. Do not include confidential information in public audit inputs. Information from connected services, where available, is used only for the features you authorize.
How and why we use information
Zyobit uses this information to:
- run audits, calculate scores and create reports and recommendations;
- operate accounts, authentication, subscriptions and customer support;
- send the newsletter you subscribe to and service-related messages;
- protect the service, enforce request limits and investigate abuse;
- maintain and improve reliability and measurement quality; and
- meet legal, accounting and security obligations.
Where data-protection law requires a legal basis, these activities rely as applicable on performing a contract, legitimate interests in operating and securing the service, consent where requested, and compliance with legal obligations. Zyobit does not sell personal information or use customer private data to train a competing model.
Cookies and browser storage
Zyobit uses essential authentication cookies to keep signed-in sessions working. A referral link may set a referral-attribution cookie for up to 30 days and consume it at signup. Theme and sidebar preferences may be stored in your browser using cookies or local storage. The current site does not use advertising trackers.
On real audit reports, a first-party random browser identifier, stored for up to 30 days after an interaction, helps us understand report views, checklist engagement, plan interest, signup, and subscription conversion. We do not include email addresses, business names, website URLs, or checklist text in these engagement events. Do Not Track and Global Privacy Control preferences disable report engagement collection. Checklist activity does not verify that a fix was made or worked.
You can clear cookies and local storage in your browser settings. Blocking authentication cookies may prevent sign-in; clearing preferences resets your saved choices.
Retention, deletion and security
Account data is retained while the account is active. An account deletion request starts deletion of organization data, workspace audits, settings and connected-account tokens within 30 days. Encrypted OAuth tokens are deleted immediately when an integration is disconnected and on account deletion. Search Console query snapshots are customer-owned data and are deleted with their connection; they are otherwise retained for 13 months to support year-over-year reporting.
- Public audit reports
- 90 days after completion, unless the requester asks for earlier removal.
- Audit request logs
- 30 days, including salted identifiers used to prevent abuse.
- Contact messages
- 24 months.
- Billing and tax records
- Up to seven years where required by law.
- Encrypted backups
- Deleted data may remain for up to 35 days before backups expire.
Zyobit uses row-level tenant isolation, server-verified sessions, hashed audit-request identifiers and signed billing webhooks. No system is perfectly secure; the Security page describes the controls and current certification status without claiming an audit that has not happened.
Your choices and rights
Depending on where you live, you may have rights to access, correct, delete, restrict or receive a copy of personal data, object to certain processing, or withdraw consent where consent is the basis. You may also complain to your local data-protection authority.
To exercise a right or ask a privacy question, email privacy@zyobit.com. Include enough information to identify the relevant account or request. Zyobit may need to verify your identity before disclosing or deleting account information.
Workspace owners can request account deletion from Settings → Data. This records a request for review; it does not immediately erase the workspace. Cancel any active subscription separately to stop future renewal charges.
Public report deletion and privacy contact
To remove a public audit or ask us to delete personal data, email privacy@zyobit.com or submit a request through our contact form with the public report URL, the email used for the request (if any), and enough detail for us to locate it. We acknowledge deletion requests within two business days, verify authority where necessary, and normally complete valid requests within 30 days. You can also contact support@zyobit.comfor help locating a report.
Changes to this policy
Material changes will be posted here with an updated date. If a change materially affects how account information is used, Zyobit will provide an additional notice through the service or by email where practical.