Privacy Policy

Draft pending legal review. Effective date: TBD. Governing law: State of formation, TBD. Contact: [email protected].

1. Scope

This policy explains how Zero To Hero LLC (“Obsidian”) handles personal data for its platform. For data you collect from your own end-users, you are the controller and Obsidian is a processor acting on your instructions; this policy describes that processing but your own privacy notice governs your relationship with your end-users.

2. What we collect

• Account data: the names, email addresses, and credentials of your organization’s members.
• End-user data processed for you: license keys, device fingerprints and keys, sessions, and any customer records you create through the platform. We process these to provide licensing and verification on your behalf.
• Usage and operational data: logs, request metadata, and telemetry used to run, secure, and debug the service.
• Payment data: handled by our processor (Stripe). We receive subscription status and identifiers; we do not store your card details.

3. How we use it

To provide, secure, maintain, and improve the service; to bill for it; to communicate about it; to detect and prevent abuse; and to meet legal obligations. We do not sell personal data.

4. Subprocessors

We rely on a small set of vendors to run the platform, each handling data only as needed to provide their function:

• Stripe — payment processing and subscription billing.
• Cloudflare — edge, DNS, and custom-hostname delivery.
• Our hosting provider — servers and storage for the platform.
• Our email provider — transactional and account email.

5. Retention and deletion

We keep personal data for as long as your organization is active and as needed to provide the service, then delete or anonymize it within a reasonable period, subject to legal retention requirements. You can export your data and request deletion; end-user erasure requests you receive are yours to direct, and the platform provides the tools to act on them.

6. Security

We apply technical and organizational measures appropriate to the data, including encryption of secrets, isolation between organizations, signed runtime authority, and least-privilege access. No system is perfectly secure, but security is a first-order concern of the platform.

7. Your rights

Depending on where you live, you may have rights to access, correct, delete, or port your personal data, or to object to or restrict certain processing. Contact us to exercise them. For end-user data we process for a seller, we will refer the request to that seller.

8. International, children, and changes

The platform operates from the United States; using it involves transferring data there. The service is not directed to children. We may update this policy and will note material changes; continued use means acceptance.

9. Contact

Privacy questions: [email protected].