Privacy & Cookie Policy

1. Introduction

At Zuzo, we take your privacy seriously.

Zuzo is operated by Armand Digital Limited, a company registered in England and Wales under company number 13081571, with its registered address at 12 Fore Street, Chudleigh, Devon, TQ13 0HX, United Kingdom.

This Privacy & Cookie Policy explains how we collect, use, store, share and protect personal information when you visit our website, subscribe to Zuzo, use our financial management tools or communicate with us.

It also explains your rights under applicable UK data protection legislation and how we use cookies and similar technologies.

For privacy enquiries or requests concerning your personal information, contact:

support@getzuzo.com

2. Our role in handling personal data

Depending on the circumstances, Armand Digital Limited may act as either a data controller or a data processor.

When we act as a data controller

We determine why and how we process personal information relating to activities including:

• Account registration and authentication.
• Subscription management and payments.
• Customer support and communications.
• Marketing and promotional activities.
• Website analytics and advertising.
• Platform security and fraud prevention.
• Personal financial planning information submitted by individuals where we determine the purposes and means of processing.

When we act as a data processor

Where a business customer uploads or connects personal information relating to its employees, customers, suppliers or other individuals, and determines the purposes of that processing, we generally act as a data processor on that customer's behalf.

Such processing is governed by our Data Processing Agreement, which forms part of our Terms and Conditions where applicable.

The classification depends on the actual processing activity and relevant legal responsibilities.

3. Information we collect

Depending on your use of Zuzo, we may process the following categories of information.

3.1 Account information

Your name, email address, account credentials, business name, account preferences, subscription details and authentication records.

3.2 Business financial information

Information entered, uploaded or imported into Zuzo, including:

• Profit and Loss reports.
• Income and expenses.
• Accounting transactions.
• Invoices, bills and account balances.
• Cashflow forecasts and financial projections.
• Business performance indicators.
• Financial targets and planning information.

3.3 Personal financial and planning information

Where you choose to use relevant features, this may include:

• Income, expenditure and savings.
• Assets, liabilities and investments.
• Property values and business valuations.
• Debt balances, interest rates and repayments.
• Financial goals and planning information.
• Information about your spouse or partner that you choose to enter.

3.4 Connected accounting software

Where you authorise a connection to Xero, Zuzo may retrieve and store relevant accounting information required to provide financial reporting, forecasting and analysis.

The integration is read-only and is not designed to create or modify transactions in Xero.

We do not receive your Xero password through this integration. Authorised connection tokens are used to maintain the connection.

3.5 Payments and subscription records

We use payment providers, including Stripe, to manage subscriptions and billing.

We may receive transaction identifiers, payment status, billing information and subscription history.

Payment-card information is processed through the payment provider's systems in accordance with its applicable arrangements.

3.6 Technical information

This may include your IP address, browser type, device information, login activity, session information, security events, error reports and interactions with the website or Service.

3.7 Communications

We may retain emails, support requests, feedback, enquiries and other communications you send to us.

We may also process contact and marketing information collected when you register for our educational resources, webinars or other promotional activities.

4. How we use your information and our lawful bases

Where we act as a controller, we process personal information for the following purposes, subject to the circumstances and applicable law.

Where we rely on legitimate interests, we consider those interests against the rights and freedoms of affected individuals.

Where consent is required, you may withdraw that consent without affecting the lawfulness of processing carried out beforehand.

Where we act as a processor, the relevant business customer is generally responsible for identifying its lawful basis and providing appropriate privacy information to individuals.

5. How Zuzo uses financial information

We use financial information to provide the functionality you request, including financial reporting, cashflow forecasting, money management, debt planning, financial goal tracking and educational insights.

Some tools generate calculations, forecasts, summaries and suggested financial actions based on information you provide.

These outputs are intended for financial education and planning support. They are not a substitute for regulated financial, investment, tax or other professional advice.

Please refer to our Financial Disclaimer and Terms and Conditions for further information.

6. Artificial intelligence

Certain Zuzo features may offer optional AI-assisted financial insights.

For example, selected figures and metrics derived from Profit and Loss reports may be processed through an AI service to generate explanatory analysis.

Our current infrastructure arrangements involve Emergent and its AI service, which may use Anthropic's Claude models.

We aim to limit the information submitted for AI processing to what is reasonably necessary for the requested functionality.

According to Emergent's stated contractual arrangements, customer personal data is not used to train AI models, and equivalent restrictions apply to its AI subprocessors.

The precise AI processing configuration and retention periods applicable to Zuzo remain subject to confirmation.

AI-generated outputs may be inaccurate or incomplete and should be independently reviewed.

We do not intend to use AI-generated financial insights to make solely automated decisions about individuals that produce legal or similarly significant effects.

7. Sharing information with third parties

We use third-party providers to operate, maintain and support Zuzo.

Depending on the services used, these may include:

• Emergent Labs Inc. — managed application infrastructure and associated services.
• MongoDB Atlas — database infrastructure through Emergent.
• Amazon Web Services — hosting and storage infrastructure through Emergent.
• Anthropic — optional AI-assisted financial analysis through Emergent.
• Stripe — subscription payments and billing.
• Resend — account verification, password resets and transactional email communications.
• GoHighLevel — customer relationship management and relevant marketing activities.
• Xero — customer-authorised accounting software integration.

Providers do not necessarily have the same legal role in every activity. Some operate as processors or subprocessors, while others may act as independent controllers.

Where required, we use appropriate contractual and organisational safeguards.

We may also disclose information where required by law, to protect legal rights or in connection with a legitimate business transaction, subject to applicable data protection requirements.

We do not sell your personal financial information.

8. International data transfers

Although Armand Digital Limited is based in the United Kingdom, certain providers involved in operating Zuzo are located outside the UK.

Our current infrastructure documentation indicates that database hosting and storage may take place in the United States, with certain authorised processing or access potentially taking place in the European Union and India.

The exact infrastructure regions and transfer arrangements applicable to Zuzo remain subject to confirmation.

Where personal information is transferred internationally, we will use an appropriate lawful transfer mechanism where required, which may include UK adequacy regulations, the UK International Data Transfer Agreement or the UK Addendum to approved Standard Contractual Clauses.

We will also implement any required transfer risk assessments and additional safeguards.

9. Data security

We use technical and organisational security measures appropriate to the nature of the information processed and the risks involved.

Based on the current Zuzo application configuration, these include:

• HTTPS/TLS encryption for data transmitted through the Service.
• Secure and HttpOnly session cookies.
• Authenticated account access.
• Optional two-factor authentication.
• Restricted administrative access.
• Additional encryption of Xero authorisation tokens.
• Access restrictions for authorised personnel and service providers.
• Account deletion procedures.

Our hosting provider, Emergent, reports maintaining ISO 27001 certification and SOC 2 Type II attestation.

These are provider-level security credentials and do not mean Zuzo or Armand Digital Limited independently holds those certifications.

No online system can be guaranteed completely secure.

You are responsible for keeping your login credentials confidential and notifying us promptly if you believe your account has been compromised.

10. How long we keep information

We retain personal information only for as long as reasonably necessary for the relevant purposes, including providing the Service, complying with legal requirements, maintaining security and resolving disputes.

10.1 Active subscriptions

Information required to provide Zuzo is generally retained while your subscription is active, subject to any earlier deletion you request and applicable legal or contractual obligations.

10.2 Cancellation and expiry

Cancelling a subscription stops future renewal but does not ordinarily end access immediately.

You retain access until the end of your paid subscription period.

When that period expires, access to the Zuzo platform ends.

10.3 Post-subscription data export

After your paid subscription expires, you have 90 calendar days to request an export of available account data by emailing:

support@getzuzo.com

The 90-day period begins when the paid subscription expires, not when you submit your cancellation request.

You do not need an active subscription to request an export during this period.

10.4 Deletion after expiry

Subject to applicable legal obligations and contractual requirements, we retain relevant customer data for up to 90 calendar days after subscription expiry.

At the end of that period, Armand Digital will arrange for the secure deletion of the relevant Customer Personal Data from active application systems, subject to applicable backup retention arrangements, technical limitations and legally required retention.

10.5 Customer-requested account deletion

If you separately initiate account deletion, Zuzo's current process includes a 30-day recovery period, after which an automated permanent deletion procedure is initiated.

This differs from ordinary subscription cancellation.

You should request any required data export before initiating account deletion.

10.6 Backups

Information deleted from active systems may remain temporarily in secure infrastructure backups until it is removed through the applicable backup-retention cycle.

The maximum backup retention period for individual Zuzo user records is still being verified with our infrastructure provider.

10.7 Administrative and legal records

Certain billing, accounting, subscription, security and compliance records may be retained separately where necessary for legal obligations, legitimate business purposes or legal claims.

11. Your rights

Subject to applicable conditions and exceptions under UK data protection law, you may have the right to:

• Request access to your personal information.
• Request correction of inaccurate or incomplete information.
• Request erasure of personal information.
• Restrict certain processing.
• Object to processing in relevant circumstances.
• Receive certain information in a portable format.
• Withdraw consent where processing is based on consent.
• Exercise rights relating to qualifying automated decision-making.

To exercise your rights, contact support@getzuzo.com.

We may need to verify your identity before responding.

Where a request concerns information processed on behalf of a business customer, we may refer the request to that customer or assist the customer in responding.

You may also raise concerns with the Information Commissioner's Office at www.ico.org.uk.

12. Marketing communications

We may send service-related messages necessary for account administration, security, billing and operation of Zuzo.

We may also send educational content, product announcements and marketing communications where permitted under applicable law.

Where required, we will obtain consent before sending direct electronic marketing.

You can unsubscribe from marketing emails using the unsubscribe link or by contacting us.

Unsubscribing from marketing does not prevent necessary service-related communications.

13. Cookies and similar technologies

Cookies and similar technologies help websites and applications function, remember preferences, understand usage and support marketing activities.

These technologies may include browser cookies, local storage, pixels, scripts and similar tracking mechanisms.

13.1 Essential technologies

These support login sessions, security, account authentication and the basic operation of Zuzo.

They do not generally require consent where a relevant legal exemption applies.

13.2 Analytics

We may use analytics technologies to understand how people interact with our website and application and to identify opportunities for improvement.

Where an analytics activity qualifies for a statutory exception, we will comply with its conditions, including providing an easy method to object where required.

Otherwise, we will obtain consent where legally required.

13.3 Advertising and Marketing Cookies (Including Meta Pixel)

We may use advertising and marketing technologies, including the Meta (Facebook) Pixel, to understand how visitors interact with our website, measure the effectiveness of our advertising campaigns and display relevant advertisements on third-party platforms.

These technologies may collect information about your device, browser, IP address, pages visited and interactions with our website, including actions such as registering for an account or completing a purchase.

Where you consent to advertising tracking, information may be shared with Meta Platforms and other applicable advertising partners. These providers may use the information in accordance with their own privacy policies, including for advertising measurement and personalised advertising.

We will only activate non-essential advertising and marketing tracking technologies where you have provided valid consent through our cookie consent mechanism.

You can accept or reject optional advertising cookies without affecting your ability to browse our website or use Zuzo.

You can withdraw or change your consent at any time through our cookie settings.

For more information about how Meta processes information, please refer to Meta's Privacy Policy at https://www.facebook.com/privacy/policy/.

13.4 Your choices

We recognise the importance of giving users control over cookies and similar tracking technologies.

Where consent is legally required, we will obtain consent before activating non-essential tracking technologies.

Where a statutory consent exception applies, we will comply with the relevant conditions, including providing an appropriate means of objecting where required.

You may also control certain cookies through your browser settings, although disabling essential technologies may affect the operation of Zuzo.

13.5 Cookie inventory

The specific cookies and similar technologies used by Zuzo may change as we develop the Service and introduce new functionality.

We will maintain information about the technologies in use, including their purposes, providers and relevant retention periods, and update this information as necessary.

14. Third-party websites and integrations

Zuzo may contain links to, or integrations with, third-party websites and platforms.

These organisations may have their own privacy policies and contractual terms.

Where you choose to connect a third-party service, you should review its applicable terms and privacy information.

15. Children's privacy

Zuzo is intended for adults aged 18 or over.

We do not knowingly offer accounts to children.

If we become aware that a child has registered for the Service contrary to this restriction, we may take appropriate steps to restrict the account and address the relevant personal information.

16. Changes to this policy

We may update this Privacy & Cookie Policy to reflect changes to our services, technology, data processing arrangements or applicable law.

Where changes are material, we will provide appropriate notice.

The latest version will be made available through the Zuzo website or application.

17. Contact us

Armand Digital Limited

Company number: 13081571

12 Fore Street
Chudleigh
Devon
TQ13 0HX
United Kingdom

Email: support@getzuzo.com

For privacy requests, complaints or data exports, please use the email address above.