Privacy policy
Last updated: 15 October 2026
This policy explains how Zpoa Inc ("ZPOA", "we", "us") handles personal data when you visit our websites (zpoa.com, thoshika.com and ciyora.com), contact us, or hold an account with us. It also explains how we act when our customers use our products to process personal data.
Who is responsible
- For our websites, sales and account administration, ZPOA is the Data Fiduciary under the Digital Personal Data Protection Act, 2023 ("DPDP Act") and the controller under other laws that use that term.
- For data our customers put into Thoshika or Ciyora Fabric (for example employee, payroll, customer or device data), the customer is the Data Fiduciary and ZPOA is its Data Processor. We process that data only on the customer's instructions, under our agreement with them. If you are an employee or customer of one of our customers, please contact that organisation first; we will help them respond.
What we collect
- Contact and account details you give us: name, work email, phone number, company, job title and messages you send.
- Billing details for paying customers: billing contact, address, tax identifiers such as GSTIN, and payment records. We do not store full card numbers.
- Technical data when you use our services: IP address, device and browser type, sign-in events and security logs.
- Website data: our websites do not use advertising or third-party analytics cookies. The site remembers your colour theme and, on pricing pages, your chosen country, in your own browser's local storage. That information is not sent to us.
Why we use it
| Purpose | Basis |
|---|---|
| Replying to enquiries and providing demos | Your consent, which you give by contacting us, and our legitimate use of information you voluntarily provide |
| Providing, securing and supporting the services | Performance of our contract with the customer |
| Billing, tax and accounting | Compliance with law |
| Detecting and preventing fraud, abuse and security incidents | Legitimate uses permitted by law |
| Product news, where you have opted in | Your consent, which you can withdraw at any time |
We do not sell personal data, and we do not use customer data to train general-purpose AI models.
Where data is stored
Hosted in India · data stays in India. Customer data in our products is stored and processed in India. Some supporting providers (for example email delivery) may process limited data, such as notification email addresses, outside India; we use providers bound by contract to protect it, and our processing follows DPDP Act 2023 obligations, including any restrictions the Government of India notifies on transfers outside India.
How long we keep it
We keep personal data only as long as needed for the purpose it was collected for, or as the law requires (for example, tax records). Customer data is deleted or returned at the end of the contract as the agreement provides.
Security
We apply reasonable security safeguards, including encryption in transit, role-based access with least privilege, tenant isolation, logging and monitoring. See Trust and security.
Your rights
Subject to the DPDP Act and other applicable law, you can ask us to:
- tell you what personal data we process about you and how;
- correct, complete, update or erase it;
- withdraw consent you have given (this does not affect processing before withdrawal);
- nominate another person to exercise your rights in the event of your death or incapacity.
You can also raise a grievance with us. If you are not satisfied with our response, you may complain to the Data Protection Board of India.
Grievance officer and contact
Email privacy@zpoa.com. For contracts and legal notices, email legal@zpoa.com; to report a security issue, email security@zpoa.com. We will acknowledge your request promptly and respond within the time the law requires.
Children
Our services are for businesses and are not directed at children. We do not knowingly collect personal data from children.
Changes
We will post changes to this policy on this page and update the date at the top. If a change materially affects how we use your data, we will tell account holders in advance.