Privacy Policy

This Privacy Policy explains what personal information Zelmora Studio collects, why, how long we keep it, and the choices and rights you have. It covers zelmorastudio.com (blog), shop.zelmorastudio.com (shop), accounts.zelmorastudio.com (sign-in) and our web apps.

1. Who is responsible

Zelmora Studio, a brand operated by Farhan Farooq, a sole proprietor based in Lahore, Pakistan, is responsible for your personal information (the “controller”). Contact: support@zelmorastudio.com.

Paddle.com is our online reseller and Merchant of Record. For payments, Paddle is responsible for the data it collects at checkout under its own privacy notice.

2. What we collect

Information you give us

• Account: name, email address, password (stored only as a secure hash), and preferences such as theme and email settings.
• App content: what you enter into our web apps, for example the guest list, budget or checklist in the Wedding Planner.
• Messages: what you send through the contact form or by email, including your name, email address and, if you choose, your local time zone.
• Newsletter: your email address and when and where you signed up.
• Reviews: any review you post on a product page.

Information from your purchases

Paddle tells us what you bought so we can deliver it: order and subscription IDs, the product, amount, currency, country, date and your email address. We do not receive your full card number.

Information collected automatically

• Sign-in history (for account security): when you sign in, we record the date and time, your IP address, your internet provider and network, an approximate location from your IP address (city, region, country), your device and browser details (device type and model, browser and version, operating system, screen size, time zone, language, and graphics card model), and a device identifier, which is a scrambled code derived from your browser’s settings. If you allow it in your browser’s own location prompt, we also record your device’s location (coordinates and accuracy) and turn it into a town or address. This sign-in history is kept for 180 days. You see a summary (city, country, internet provider and device) in My Zelmora → Security.
• Signed-in devices: device and browser name, IP address, approximate place and when it was last active, so you can sign out other devices.
• Security logs: IP address, the page requested and browser type when our systems detect suspicious activity (for example repeated failed sign-ins or attacks), to protect the Services.
• Browser notifications: if you allow them, your browser’s push subscription, so we can send notices about new posts and products.
• Invitation and consent records: to avoid showing our newsletter invitation too often and to record your cookie choice, we store a scrambled, non-reversible version of your IP address with the date and your choice.
• Analytics (only with your consent): Google Analytics collects pages visited, approximate location, device and browser information. See our Cookie Policy.

3. Why we use it, and our legal basis

We do not sell, rent or trade your personal information, and we do not use it for advertising. We do not make decisions about you based only on automated processing that have legal or similarly significant effects.

4. Who we share it with

We share personal information only with service providers that help us run the Services, and only what they need:

• Paddle — checkout, payments, tax, invoices and refunds.
• Our hosting provider — stores our websites and databases.
• Our email providers — deliver account emails, replies and newsletters.
• Cloud file storage (Cloudflare R2) — stores and delivers product downloads and site images. Your profile photo and images you attach to support chats are kept in a separate private storage area: they are never public and are shown only to you and Zelmora staff, through your signed-in session.
• OpenStreetMap (Nominatim) — turns sign-in coordinates into a town name, only if you allowed location.
• Google Analytics — only if you accepted analytics cookies.

We may also share information if the law requires it, to protect our rights or the safety of others, or with a business that takes over Zelmora Studio (we would tell you first).

5. International transfers

We are based in Pakistan and some of our providers process data in other countries, including the UK, the EU and the United States. Where required, we rely on safeguards such as the provider’s standard contractual clauses.

6. How long we keep it

• Account and app content: while your account is open. If you delete your account in My Zelmora, it is deleted straight away (after we email you a data export); if you ask us by email, we delete or anonymise it within 30 days. Purchase records are kept without your name where tax law requires.
• Inactive accounts: deleted after 6 months in a row with no active web-app subscription. We email a reminder one month before and a data-export link (valid 30 days) before deleting.
• Profile photo and support-chat images: until you remove them, the chat is deleted, or your account is deleted.
• Sign-in sessions: 24 hours, or 7 days if you choose “No auto logout” after signing in.
• Purchase records: as long as needed for tax and accounting rules.
• Sign-in history: 180 days.
• Newsletter: until you unsubscribe.
• Contact messages: up to 2 years.
• Newsletter invitation records: 30 days. Cookie consent records: about 13 months.
• Security logs: only as long as needed to protect the Services.

7. Your rights and choices

• You can ask to access, correct, export or delete your personal information, or object to or restrict how we use it.
• You can withdraw consent at any time: unsubscribe links in every email, email settings in My Zelmora, browser notification settings, location settings, and Cookie settings.
• In My Zelmora you can see your sign-in history and signed-in devices, and sign out other devices.
• When your account is deleted (by you, or under the inactivity rule) we first email you a data export: one zip with your account details and your data from each app (JSON / CSV and uploaded files).
• To use any of these rights, email support@zelmorastudio.com. We reply within 30 days. You may also complain to the data protection authority where you live.

8. Cookies

We use essential cookies to run the site, and optional analytics cookies only with your consent. Details and how to change your choice are in our Cookie Policy.

9. Security

We protect your information with encrypted connections (HTTPS), hashed passwords, access controls and monitoring for suspicious activity. No online service can be completely secure, so please use a strong, unique password and tell us if you notice anything unusual.

10. Children

Our Services are not aimed at children under 16, and we do not knowingly collect their personal information. If you think a child has given us information, please contact us and we will delete it.

11. Changes to this policy

We will update this policy when our practices change. The date at the top shows the last update. If a change is important, we will tell registered customers by email or on the site.

12. Contact

Questions or requests about your privacy: support@zelmorastudio.com.