Legal

Privacy Policy

This policy explains how Caesar Cipher Advanced Research OÜ processes personal data through the ZebraZones website and its inquiry forms.

1. Controller

Company: Caesar Cipher Advanced Research OÜ

Registry code: 17405528

Register: Estonian Commercial Register

VAT number: EE102940741

Address: Tartu mnt 67/1-13b, 10115 Tallinn, Estonia

Email: legal@zebrazones.com

Data protection contact: legal@zebrazones.com

2. What data we process

When you submit a contact or analysis request, we process your email address and the message or problem description you provide, along with any other details you choose to share, such as your name or company.

When you order an audit, we also process whether you buy as a business or a private individual, your business name and EU VAT ID if you provide them, and a record of the terms and consents you accepted, for example your request that the audit starts before the withdrawal period ends. We check EU VAT IDs with the European Commission's VIES service, which returns the registered business name and address.

When you use the repository analyzer, we process the GitHub repository URL you submit and a copy of the repository's code in order to produce a scoping result and price estimate. If you give us access to a private repository, we also process the GitHub account details shown to us as part of that access.

We may also process limited technical information, such as IP addresses and request details in server logs, necessary to keep the website secure, prevent abuse, and maintain a reliable service.

3. Repository code is not personal data

We analyze source code, not personal data. We do not treat the contents of a submitted repository as personal data and do not process it as such.

By submitting a repository, you confirm that it does not contain personal data, for example customer records, database exports, seed or test data about real people, or credentials belonging to individuals. You are responsible for removing any such data before you submit a repository or give us access to it.

If we notice personal data in a repository, we may stop the analysis and delete our copy of the repository.

4. Why we process it

  • To review and respond to your inquiry or audit request.
  • To assess whether ZebraZones is a fit for the requested project.
  • To send follow-up materials such as a scoping questionnaire, proposal, or payment link.
  • To maintain internal records of business inquiries and follow-up.
  • To protect the website and forms from abuse and repeated automated submissions.

5. Legal bases

We process data needed to respond to a request or take steps at your request before entering into a contract. We also rely on our legitimate interest in managing business inquiries, maintaining appropriate records, and protecting the website and its forms. If we request consent for an optional purpose, you may withdraw that consent at any time.

6. Recipients and service providers

Personal data may be accessed by authorised ZebraZones personnel who need it to respond to requests and provide services.

We use service providers in the following categories:

  • Hosting providers that run our website, servers, and email.
  • Inference providers that run the AI models we use to analyze repository code.
  • Payment providers that process audit payments.

They process data only as needed to provide those services and under appropriate contractual and legal safeguards.

7. International transfers

Some service providers, in particular inference providers, may process data outside the European Economic Area. Where such processing involves personal data, we use an applicable adequacy decision or other lawful safeguards, such as the European Commission's standard contractual clauses, where required.

8. Retention

We retain inquiry data only for as long as it is needed to handle the request, provide related follow-up, meet contractual or accounting obligations, resolve disputes, and protect our legal interests. We delete or anonymize data when it is no longer needed, subject to lawful backup and legal retention requirements.

  • Repository copies and analysis results: kept for 30 days after your inquiry so we can prepare and carry out your audit. If you do not submit an inquiry, they are deleted within 30 days of the analysis.
  • Access to private repositories: we stop using any repository access you gave us 30 days after our last interaction with you. You can remove our access on GitHub at any time.
  • Server logs: kept for 30 days.
  • Orders, invoices, and payment records: kept for as long as accounting and tax law requires, currently seven years in Estonia.

You can ask us to delete a repository copy or analysis at any time via legal@zebrazones.com.

9. Your rights

Subject to the conditions in the GDPR, you may request access to, correction of, deletion of, or restriction of processing of your personal data. You may also object to processing based on legitimate interests, request data portability where applicable, and withdraw consent where processing is based on consent. To exercise a right, contact legal@zebrazones.com.

10. Cookies, analytics, and automated decisions

The current website does not use non-essential analytics or advertising cookies. If that changes, this policy and any required consent mechanism will be updated.

We do not use automated decision-making or profiling that produces legal or similarly significant effects about people who submit forms.

11. Complaints

You may contact us first so we can address your concern. You also have the right to lodge a complaint with the Estonian Data Protection Inspectorate, Andmekaitse Inspektsioon, Tatari 39, 10134 Tallinn, Estonia, info@aki.ee. More information is available at aki.ee.

Last updated: September 28, 2026.