Legal
Privacy Policy
Last updated 28 October 2026
This policy explains how Astrizon Technology Solutions Private Limited, a company registered in India, with its registered office at A103 MJ Lifestyle Astro, Chikkanagamangala Road, Bengaluru 560099, Karnataka, India ("Astrizon", "we") handles personal data in connection with zolensa.com and the Zolensa platform. It is written for the people who visit our website, the agency staff and clients who use Zolensa, and the research participants who take part in studies run on it.
1. Two different roles
As a controller, we decide how to use the data of website visitors, of people who contact us, and of the agency staff and clients who have a Zolensa account. This policy covers that use.
As a processor, we host and process research participants' data on behalf of the agency that runs the study. The agency decides what is collected and why, and its own privacy notice and consent form apply; you see them before you start a study. We use participants' data only to run the study for the agency, and never for our own marketing, profiling or training AI models.
2. What we collect
| Who | What |
|---|---|
| Website visitors | The details you send through the contact form (name, work email, company, country, phone if given, message). To keep out robots and fake requests, we check the IP address the form came from: its country and whether it is a VPN, proxy, Tor or hosting network, using IPzentra, an IP lookup service that Astrizon operates itself. Our servers record IP address, browser and pages requested, for security. |
| Agency staff and clients | Name, work email, password (stored only as a one-way hash), two-factor secret (encrypted), workspace and role, sign-in times and IP addresses, actions in the audit log, and the messages you send through Zolensa. For paying agencies: billing contact and invoice details. |
| Research participants (as processor) | What the agency asks for: usually name, email or mobile number, language and time zone, consent record, and the answers, videos, photos and voice notes you choose to share. Photos are stripped of location data. |
3. Why we use it, and on what basis
- To provide and secure the Service, and to keep accounts working (performance of our contract with the agency, and our legitimate interest in security).
- To answer messages and demo and trial requests, and to check that they are genuine (your request, and our legitimate interest in responding and in preventing fraud).
- To send account emails, such as invitations, sign-in links and password resets (performance of contract).
- To invoice and keep accounting records (legal obligation).
- To improve the Service using aggregated usage information that does not identify participants (legitimate interest).
We do not sell personal data, show advertising, or use participants' data for anything other than the agency's study.
4. Cookies
We use only cookies needed for the Service to work: a session cookie for signed-in staff, a form-protection token, and a sign-in cookie in the participant app. We do not use advertising or analytics cookies. The website remembers the language you choose in your browser’s own storage, and the demo form asks our app for a one-time timestamp to tell people from robots. Our pages load typefaces from Google Fonts, so your browser sends its IP address to Google when it loads them.
5. Who we share it with
We use the providers listed on our Subprocessors page to host and run the Service, under contracts that oblige them to protect the data. We disclose data to authorities only when the law requires it, and tell the affected agency unless we are prevented.
| Provider | What it does | Where | When used |
|---|---|---|---|
| DigitalOcean, LLC | Hosting of the application, database and files | India (Bengaluru data centre); file storage in the region chosen for the bucket | Always |
| Postmark (ActiveCampaign, LLC) | Sending emails: invitations, reminders, messages, account emails | United States | Always, unless the agency connects its own email provider |
| Google LLC (Google Fonts) | Delivering the typefaces used on our pages | Worldwide | Always: the browser fetches the fonts and Google receives its IP address |
| AI provider configured by Zolensa | Translating the study texts the agency writes (tasks, questions, consent), translating transcripts, and AI analysis of answers and transcripts | Depends on the provider | Only when the agency uses these AI features without its own provider |
| Transcription provider configured by Zolensa (OpenAI, Google or Deepgram) | Turning what participants say in videos and voice notes into text | United States, or as offered by the provider | Only for studies with transcripts switched on |
| Stripe Payments Europe, Ltd. / Stripe, Inc. | Card payments and invoices | Ireland and United States | Only when online payment is switched on |
| Text message provider configured by Zolensa | Sending reminders by text message to participants without an email address | Depends on the provider | Only when text messages are switched on |
6. International transfers
Zolensa is hosted in DigitalOcean's data centre in Bengaluru, India, and some providers are in the United States. When personal data from the European Economic Area, the United Kingdom or Switzerland is transferred, we use the European Commission's Standard Contractual Clauses, with the UK addendum, and assess the protection in the country concerned.
7. How long we keep it
- Participants' data: for the retention period the agency sets for the study, then it is deleted; earlier if the agency deletes it or the participant asks the agency.
- Staff accounts: while the account exists, and up to 30 days after the workspace closes.
- Security logs: up to 12 months. Audit records of consent and deletions: as long as the agency's data, or as the law requires.
- Contact form messages and demo or trial requests: up to 2 years. Records of blocked attempts: 90 days.
- Invoices and accounting records: as long as tax law requires (in India, at least 8 years).
8. How we protect it
Encrypted connections (HTTPS) everywhere, private storage for recordings with links that expire, passwords hashed with Argon2id, provider keys and two-factor secrets encrypted, two-factor sign-in for owners and staff, role-based access, rate limits and an audit log. More on our Security page.
9. Your rights
Depending on where you live, you can ask to access, correct, delete or receive a copy of your data, to restrict or object to how we use it, and to withdraw consent. Under India's Digital Personal Data Protection Act you can also seek grievance redressal and nominate someone to exercise your rights. Residents of California can ask what we collect and ask for deletion or correction; we do not sell or share personal information for advertising.
If you took part in a study, please contact the agency that ran it first; we will help them answer you. To ask us, write to the address below. We reply within one month.
10. Children
Our website and staff accounts are not for children. Agencies must not invite children to studies without the consent the law requires from a parent or guardian.
11. Changes
We will post any changes here and, if they are significant, tell account holders by email.
12. Contact and complaints
Write to our Grievance Officer and Data Protection contact at support@astrizon.com, or by post to Astrizon Technology Solutions Private Limited, A103 MJ Lifestyle Astro, Chikkanagamangala Road, Bengaluru 560099, Karnataka, India.
You may also complain to your data protection authority, such as the authority in your EU country, the UK Information Commissioner's Office, or the Data Protection Board of India.