Privacy notice

The controller of your data is Abdallah Mohamed, an individual trading as Zolai Studio, the services arm of Zolai (zolai.io). There is no registered company yet; when there is, this notice will name it.

For anything about your data, write to abdallah@zolai.io. Our postal address is printed in the footer of every email we send; if you need it and don't have one of our emails, ask at the same address.

If we emailed you about your company's website, we hold:

• your name, your role and your work email address
• your company's name, its website and the country it's based in
• public facts about that website: whether it runs on Webflow, its speed scores, its size
• the page where your address was published (so we can show where it came from)
• whether the address was checked as deliverable
• the emails we sent you and any replies you sent back

We never hold a personal email address, phone number, home address, social profiles, photos or anything sensitive about you.

We didn't get this from you. It comes from public business sources only: your company's own website, public business registers (such as Companies House in the UK), and professional details published on the web, found through a search service (Serper) and a business email finder (Hunter). We never buy or rent lists, never scrape pages behind a login, and never take addresses from sites that forbid it.

If you asked for a free audit on this site, we hold the email address and website you typed, whether you ticked the box to hear from us again, and the country your request came from (worked out from your IP address; we keep the country, not the address).

This site sets no analytics or advertising cookies. If you switch between light and dark mode, that choice stays in your browser. Our host keeps standard server logs (IP address, browser, pages requested) to run and protect the site.

Our legitimate interest in emailing you: offering a relevant service to a business whose website visibly runs on the platform we migrate from. We weighed it against your interests in a written Legitimate Interests Assessment. In short: we use only business contact details about you in your work role; we contact one person per company, at most three times; every email is written about your company's own public website and read by a person before it's sent; there's no tracking; and any opt-out is honoured at once and for good. You can ask us for the full assessment.

We only email businesses where the law allows it without prior consent. In the UK that means companies and LLPs (not sole traders or partnerships). We don't email anyone in Germany, Austria, Switzerland, Italy, Spain, Poland, Denmark, the Czech Republic, Greece or Portugal, where business email needs prior consent.

No decision with legal or similarly significant effects is made about you automatically. Software helps us find companies and draft emails; a person approves every email before it leaves.

We never sell your data or share it with anyone for their own use. These providers process it for us, only to run the service:

Several of these providers are based in the United States or store data there, so your data may leave the UK and the EEA. Where it does, it's protected by the provider's data processing terms: the UK–US data bridge or the EU–US Data Privacy Framework where the provider is certified, and otherwise the European Commission's Standard Contractual Clauses with the UK Addendum.

To be confirmed: Which safeguard applies to each provider, and the region our database is hosted in.

We keep your data only as long as we need it, and a daily task removes it when that time is up. “Removed” means your name, role and email address are deleted; what stays is a one-way fingerprint of the address (a SHA-256 hash) so we never email it again. The fingerprint can't be turned back into your address.

You can object to us using your data for direct marketing at any time. That right is absolute: we stop, at once and for good, and you don't have to give a reason.

You can also ask us to:

• give you a copy of everything we hold about you (access)
• correct anything that's wrong (rectification)
• delete your data (erasure)
• stop using it while a question about it is settled (restriction)
• give you the audit request data you gave us in a reusable format (portability)
• withdraw your consent to follow-ups after an audit

Email abdallah@zolai.io, or reply to any email we sent. We answer within one month. If you ask us to delete your data, we delete it and keep only the one-way fingerprint of your address, so we can make sure we never email you again; we'll tell you that when we confirm.

Every email we send has a one-click unsubscribe link at the bottom, and most email apps show an “Unsubscribe” button next to our address. You can also just reply “stop”, “remove me” or anything like it. Any of these works instantly: the address goes on our block list, anything still waiting to be sent to it is cancelled, and it stays blocked for good.

If you're unhappy with how we've handled your data, tell us first and we'll try to put it right. You also have the right to complain to a data protection authority: in the UK, the Information Commissioner's Office; in the EU and EEA, the authority where you live or work (for example the Data Protection Commission in Ireland or the CNIL in France).

When what we do with your data changes, we update this page and the date at the top.