Privacy Policy

1. Introduction & Corporate Scope

This Privacy Policy governs the collection, processing, storage, and transfer of personal data and confidential business information by Zarp Studio LLC (“Zarp Studio”, “we”, “us”, or “our”), a Florida limited liability company with principal offices at 7600 Southland Blvd, Orlando, FL 32809.

This policy applies to all individuals and entities who:

• Visit our primary website (zarpstudio.com) or associated landing pages.
• Engage Zarp Studio for professional services, including website creation, software development, search engine optimization (SEO), paid media management, and CRM setup.
• Use or interact with our proprietary software tools, client reporting portals, or autonomous AI productivity applications, including Hermes Zarp.
• Interact with digital assets, forms, lead funnels, or client applications managed or engineered by Zarp Studio on behalf of our enterprise and home-service clients.

2. Information We Collect

Depending on how you engage with our services, we collect information across three primary categories:

2.1 Information Provided Directly by You

• Contact and Identity Data: Full name, professional title, corporate affiliation, business email address, direct phone number, and physical billing/shipping address.
• Commercial and Project Data: Service briefs, brand assets, architectural specifications, domain registrar access, hosting credentials, and project communication records.
• Financial and Billing Information: Payment transaction metadata, invoicing details, corporate tax identifiers, and payment method tokens (handled securely through PCI-DSS Level 1 certified processors).
• Communications: Inquiries submitted through contact forms, demo bookings, email correspondence, and telephone call notes.

2.2 Information Collected Automatically

• Device and Telemetry Data: IP address, browser type and version, operating system, device identifiers, language settings, and network provider.
• Log and Usage Data: Pages visited, time spent per page, click patterns, referral source, error logs, and performance diagnostics.

2.3 Information Processed on Behalf of Clients (Data Processor Role)

When Zarp Studio builds and maintains web applications, lead capture funnels, or CRM systems for our clients, we may act as a Data Processor under applicable privacy laws. In this capacity, we process end-user inquiries, service request submissions, and booking information strictly in accordance with our client contracts and instructions.

3. Data Practices by Service Line

5. Legal Bases for Processing (GDPR & Global Standards)

We process personal information under the following recognized legal bases:

• Contractual Necessity: To deliver requested web development, SEO, CRM, and AI agent services under our service agreements.
• Legitimate Interests: To improve system reliability, secure our digital infrastructure against fraud, and conduct commercial business-to-business communications.
• Consent: Where you have provided explicit affirmative consent, such as subscribing to our insights newsletter or authorizing third-party OAuth integrations.
• Legal Obligation: To comply with tax, financial, accounting, and regulatory compliance duties.

6. Subprocessors & Data Sharing

We engage select enterprise service providers to support our cloud infrastructure, security, and communications. All subprocessors are bound by strict Data Processing Addenda (DPAs) and confidentiality agreements:

7. Data Security & Storage Architecture

We maintain rigorous technical and organizational safeguards designed to prevent unauthorized access, destruction, disclosure, or alteration of your data:

• Encryption: TLS 1.3 encryption for all data in transit; AES-256 encryption for data at rest.
• Access Control: Multi-factor authentication (MFA) mandatory across all developer, administrative, and cloud accounts, with strict role-based access control (RBAC).
• Vulnerability Management: Continuous automated dependency auditing, zero-inline code reviews, and periodic automated static application security testing (SAST).
• Incident Response: Documented security incident response plan with mandatory stakeholder notification within 72 hours of confirmed breach detection.

8. Data Retention & Archival Lifecycle

We retain personal data only for as long as necessary to fulfill the operational purposes described in this policy, maintain active customer accounts, resolve disputes, and satisfy statutory tax and legal obligations.

Upon expiration of the applicable retention period or upon verified receipt of a deletion request, data is permanently scrubbed or irreversibly anonymized using secure deletion protocols.

9. Your Privacy Rights (GDPR / CCPA / LGPD)

Regardless of your jurisdiction, Zarp Studio provides comprehensive data privacy rights:

• Right of Access & Portability: You may request a machine-readable export of all personal data held concerning you.
• Right of Rectification: You may request correction of any inaccurate or incomplete records.
• Right of Erasure (“Right to be Forgotten”): You may request permanent deletion of your personal records.
• Right to Restrict or Object: You may restrict certain processing activities or opt out of direct marketing communications at any time.
• Non-Discrimination: We will never deny services, charge different prices, or degrade quality for exercising your privacy rights.

10. OAuth Revocation & Data Deletion

You maintain direct, real-time control over all connected third-party integrations:

11. Cookies & Analytics Technologies

Our website uses cookies and similar technologies (e.g. local storage) to provide essential security, maintain session state, remember language preferences, and gather aggregate traffic analytics.

You can configure your browser settings to reject non-essential cookies. Essential functional cookies necessary for core website operations cannot be disabled without affecting site availability.

12. Children's Privacy (COPPA Compliance)

Our websites, applications, and services are directed exclusively to business professionals and individuals aged 18 and older. We do not knowingly collect or solicit personal data from children under 13 (or under 16 where applicable by regional law). If we learn that we have inadvertently collected data from a child, we will take immediate steps to delete such data from our servers.

13. Policy Updates & Versioning

We reserve the right to amend this Privacy Policy periodically to reflect technological advancements, operational changes, or new regulatory requirements.

Material changes will be communicated by updating the “Last Updated” timestamp at the top of this page and, where appropriate, notifying active clients via email or in-app notices.

14. Contact Information & Legal Inquiries

For any privacy inquiries, Data Protection Officer (DPO) communications, or regulatory correspondence, please reach our legal and privacy team: