Vzla.io Vzla.io
Subscribe
Home Products Consumers Businesses Community Blog
← Back to legal

Account privacy policy

Updated October 13, 2026

This policy applies to the Vzla.io account used to sign in to Vzla.io products. Processing within each product, including subscriptions, is described in that product’s privacy policy. It applies the EU General Data Protection Regulation (GDPR) to all users.

Controller

Vzla.io is the controller. Legal entity, address and contact details are published in the imprint. Privacy contact: privacy@vzla.io.

Data we process

  • Email address.
  • Password, stored as a salted hash.
  • Date of account creation and of acceptance of the terms.
  • If you sign in with Google or Apple: the identifier the provider assigns to you, your email address and whether the provider has verified it. With Apple’s “Hide my email”, the email address is a relay address provided by Apple.
  • One-time codes sent by email to verify your address, sign you in or reset your password.
  • Session data, which is strictly necessary for the service: on the web, a session cookie and a security (CSRF) cookie; on mobile, a sign-in token kept in the device’s secure storage.
  • IP address and device or browser type.
  • Creating and maintaining the account, signing you in, and sending account emails (codes and security notices): performance of a contract (Art. 6(1)(b) GDPR).
  • Limiting failed sign-in attempts and preventing abuse: our legitimate interest in the security of the service (Art. 6(1)(f) GDPR).
  • Retaining or disclosing data where required by law: legal obligation (Art. 6(1)(c) GDPR).

Recipients

Data is disclosed to processors acting on our instructions under data-processing agreements:

  • Hosting providers.
  • Email delivery provider.
  • Payment processor (Stripe), only if you subscribe to a product, as described in that product’s privacy policy.

Google and Apple process data as independent controllers when you use their sign-in. Data may be disclosed to public authorities where required by law.

International transfers

Data is processed in the United States and in other countries where our processors operate. Transfers of personal data from the European Economic Area or the United Kingdom are based on the European Commission’s Standard Contractual Clauses or another transfer mechanism recognised under the GDPR.

Retention

  • Account data: until the account is deleted.
  • One-time codes: until used or expired, within minutes.
  • IP address and device data: for the period needed to detect and investigate abuse, then deleted.
  • Data we are legally required to keep: for the period required by law.

Your rights

You have the right to access, rectify and erase your data, to restrict its processing, to data portability, and to object to processing based on legitimate interests (Art. 15–21 GDPR). You can delete your account from the account screen of any Vzla.io product; deletion cancels active subscriptions and ends all sessions. To exercise your rights, contact privacy@vzla.io. We respond within one month. You have the right to lodge a complaint with a data protection supervisory authority.

Required data and automated decisions

An email address and password, or a Google or Apple sign-in, are required to create an account; without them an account cannot be provided. No decisions are made by automated means, including profiling.

Changes

Changes are published on this page with a new date. Material changes are notified by email or in the app.