Privacy Policy

Last updated: May 30, 2026

This Privacy Policy describes how Zator ("Zator," "we," "us," or "our") collects, uses, stores, and shares information when you use the Zator mobile application, web dashboard, and related services (collectively, the "Service"). Zator is a banquet and event management platform provided to employees, supervisors, HR/administrators, and sales/CRM staff of businesses ("Companies") that subscribe to the Service.

If you are an employee or staff member using Zator, your Company is the controller of your personal data and you should also review your Company's internal privacy notices. Zator acts as a processor on behalf of your Company for most data described below.

1. Who This Policy Applies To

• Employees using the Zator mobile app (iOS and Android) to clock in/out, complete tasks, communicate with their team, and manage banquet operations.
• HR, administrators, and managers using the Zator web dashboard to manage staff, schedules, and clients.
• Sales/CRM users managing client inquiries and event bookings.
• Clients of subscribing Companies, whose contact and event details are stored in the Service by Company staff.

Zator is not directed to children. We do not knowingly collect personal data from anyone under 18. If you believe a minor's data has been provided to us, please contact your Company administrator.

2. Information We Collect

2.1 Account & Identity Information

We collect the following when you or your Company creates your account:

• Full name and phone number (with country code) — phone number is the primary identifier
• Profile photo
• Employment status (full-time, part-time, contractor), job position, joining date
• Company, business unit/location, department, and supervisor assignment
• Role(s) and entitlements (e.g., employee, HR, admin, sales)
• Firebase Authentication user ID

2.2 Identification Documents

For verification and HR compliance, the Service stores:

• Government-issued ID images (e.g., driver's license, passport) uploaded by you or HR
• Document metadata (type, upload timestamp)

These files are stored in Google Cloud Storage and are visible to authorized HR/admin users at your Company.

2.3 Attendance & Location Data

When you mark attendance through the mobile app:

• Clock-in and clock-out timestamps
• Your device's precise GPS coordinates captured only at the moment you tap "Mark Attendance", used to verify you are within the configured radius (approximately 500 meters) of your assigned office or unit
• Attendance status (present, absent, on leave)
• Device name

We do not track your location continuously or in the background. Location capture occurs only during the active attendance check-in action.

2.4 Client and Inquiry Data (entered by sales/CRM staff)

If you are a sales or CRM user, you may enter client information into the Service, including:

• Client first and last name, phone number, country code
• Client type (individual or corporate) and company name
• Referral source, general food preferences, remarks
• Event inquiry details (event type, date, guest count, party area preferences)
• Interaction history (calls, WhatsApp messages, meetings, notes)

If you are a client of a subscribing Company, this data was provided by that Company. Please contact them directly with any access, correction, or deletion requests.

2.5 Task, Response, and Operational Data

• Task assignments, statuses, completion timestamps, and responses
• Photos uploaded as task evidence (work documentation)
• Leave requests, escalation alerts, and notifications
• Event-related uploads such as menus, floor plans, and BTR files
• Bug reports (with submitting employee name, description, app version, platform)

2.6 Device & Technical Information

• Expo push notification tokens (associated with platform: iOS/Android and device name)
• App version and platform information
• Crash and error reports (where enabled)

2.7 Permissions Requested on Your Device

The mobile app may request the following permissions; you may grant or deny each one in your device settings:

We do not access location in the background, read SMS, or access call logs.

3. How We Use Your Information

We use the information described above to:

• Authenticate you via your phone number and a one-time password (OTP)
• Provide the core functionality of the Service (attendance, tasks, scheduling, client management, event operations)
• Verify attendance against your assigned office/unit location
• Send push notifications for tasks, reminders, and operational alerts
• Enable supervisors, HR, and administrators at your Company to manage staff and operations
• Enable sales and CRM users to manage clients and event inquiries
• Search client records (via Algolia) for sales workflows
• Generate aggregate reports and dashboards for your Company
• Diagnose crashes, fix bugs, and improve the Service
• Comply with legal obligations and enforce our terms

We do not sell your personal data, and we do not use it for advertising.

4. Legal Basis (EEA / UK Users)

Where the GDPR or UK GDPR applies, we rely on the following legal bases:

• Contract — to provide the Service to your Company under its subscription agreement
• Legitimate interests — to operate, secure, and improve the Service
• Consent — for optional device permissions you grant (camera, location, contacts, etc.)
• Legal obligation — where required to retain or disclose data

5. How We Share Information

We share information only with the following categories of recipients:

5.1 Your Company and its Authorized Users

Your Company (and the HR, administrators, supervisors, and other authorized roles configured by your Company) can access information in accordance with role-based permissions configured within the Service. Multi-tenant data isolation ensures that one Company cannot access another Company's data.

5.2 Service Providers (Sub-processors)

We share information with the following third parties as needed to operate the Service:

Each provider is contractually obligated to process data only on our or your Company's behalf and in line with applicable law.

5.3 Legal and Safety Disclosures

We may disclose information if required by law, subpoena, or court order, or to protect the rights, property, or safety of Zator, our users, or others.

5.4 Business Transfers

If Zator is involved in a merger, acquisition, or sale of assets, your information may be transferred subject to this Policy.

6. Where Your Data Is Stored

The Service stores primary data in Google Cloud Firestore and Cloud Storage in the `asia-south2` region (Delhi, India). Some sub-processors (e.g., Algolia, Expo) may process data in other jurisdictions. By using the Service, you understand that your data may be transferred to and processed in countries other than your own. Where required, we rely on appropriate safeguards such as standard contractual clauses.

7. Data Retention

• Account and operational data is retained for as long as your account is active and your Company maintains its subscription, plus a reasonable period for backup, audit, and legal compliance.
• Scheduled notification records are automatically deleted approximately seven (7) days after their scheduled fire time.
• Identification documents are retained until removed by your HR/administrator or your Company terminates the Service.
• Attendance records are retained as part of your Company's employment records and may be subject to its own retention policies and applicable labor law.
• Push tokens may be disabled when no longer valid and removed during routine cleanup.

If you would like data deleted, please contact your Company's administrator, who can remove it through the Service. If the Service has been discontinued, contact us using the details below.

8. Your Rights

Depending on your jurisdiction, you may have rights to:

• Access the personal data we hold about you
• Correct inaccurate or incomplete data
• Request deletion of your data
• Object to or restrict certain processing
• Receive a copy of your data in a portable format
• Withdraw consent for permissions you previously granted (via your device settings)
• Lodge a complaint with a data protection authority

Because your Company controls most of the data in the Service, please direct rights requests to your Company in the first instance. We will support your Company in fulfilling valid requests.

9. Security

We use industry-standard safeguards to protect your information, including:

• TLS/HTTPS encryption in transit
• Encryption at rest provided by Google Cloud
• Role-based access controls enforced through Firebase Authentication custom claims and Firestore security rules
• Phone-based OTP authentication
• Multi-tenant data isolation at the database rule layer

No system is perfectly secure. If we become aware of a security incident affecting your data, we will notify you and/or your Company as required by law.

10. Authentication and Cookies

Mobile App

Authentication uses your phone number and a one-time password (OTP) delivered by SMS via Firebase Authentication. No passwords are stored.

Web Dashboard

The web dashboard uses a `__session` cookie containing your Firebase ID token to keep you signed in. The cookie:

• Is set with `HttpOnly`, `SameSite=Lax`, and `Secure` flags where applicable
• Expires approximately one (1) hour after issuance
• Is used solely to authenticate server-rendered requests

We do not use advertising cookies or third-party tracking cookies.

11. Children's Privacy

The Service is intended for use by adults in a professional employment context. We do not knowingly collect personal data from individuals under 18. If you believe we have collected such data, please contact us and we will delete it.

12. Changes to This Policy

We may update this Policy from time to time. When we make material changes, we will update the "Last updated" date above and, where appropriate, notify users through the app, web dashboard, or by other means. Continued use of the Service after changes take effect indicates your acceptance of the updated Policy.

13. Contact Us

If you have questions about this Policy or our handling of your data, please contact:

Zator Email: hello@spitballai.com

If you are an employee or staff member of a subscribing Company, you may also contact your HR or administrator directly.