Privacy · Fair information practice
Privacy policy
We describe, in more depth than a short pop-up, what we may know about you when you use this public site, how we treat it, who we share it with, and how to exercise the rights the law in your place may offer.
Who the controller is, and what the site is for
Our identity and address. For the personal data that we control through this public website, the controller is Zlexironflox, with a U.S. business address at 1500 Lexington Ave, New York, NY 10029, United States. You can reach the privacy inbox at the email in the “Contact and verification” section, or by using the form on the Contact page, which goes through a similar process with an explicit consent line.
Purpose in plain words. The site is meant to offer educational, non-urgent information about how people sometimes arrange work and rest, without any promise of a particular result and without a doctor–patient, therapist–client, or similar regulated relationship. That framing matters to privacy because the kinds of data we need are relatively limited; we are not, through this product alone, asking you to upload lab values or a government identifier.
Not an emergency line. The methods we list for contact are not monitored as an emergency, crisis, or 24/7 support channel. You should not rely on them if you are in a situation that requires a local public safety or a licensed professional. That limitation also affects the kinds of extra sensitive categories we have little reason to receive through the site, unless you put them in a free text field, in which case the “Sensitive content you choose to add” part applies.
What categories of data may exist, in rough buckets
Server and device signals. When you open a page, a typical stack records at least: time, the path you request, a status code, a user-agent string, sometimes a referer, and a network address that may point to a region or an organization. The address can be a personal data “identifier” in the extended sense, even if we never learn your name from it. With cookies or storage that you have allowed, we may also see a browser-side label that lets an analytics or marketing script attribute multiple views to a stable-enough id during its lifetime.
Data you type into forms. If you use the public contact form, you send a name, an email, and a message, plus a line that you accept processing in line with this policy, which is itself a record. If you call us, we may keep the number, time window, a short text note, and a link back to an email if you later write to us, so a thread stays coherent. If you use postal mail, the envelope, date, and content may be stored for the period needed to answer and, if the message touches taxes or a dispute, a longer time based on a retention schedule. We do not read your mail in order to build a public profile, but to respond and to show good faith in any later audit.
Data from partners. If a payment provider, email sender, or hosting vendor tells us a transaction id, a bounce reason, or a delivery proof, that information may sit next to a row about you in a database we control. We do not need to name every sub-field here; the important part is the category, not the name of a column, which can change in a product upgrade. You can always ask, under your access right, for a file that lists what we are able to export for you with reasonable effort.
Sensitive content you choose to add. If, despite our guidance, you enter health, political, or other special-category material in a message, we will treat the whole message in line with the stricter set of rights that may apply, including deletion, though we can still have to keep a minimal log if a court or a regulatory authority orders us to preserve evidence, or if a narrow legal defense requires a record that the contact occurred.
Identifiers, household
Network address, a cookie or similar label, a phone number, an email local part, and, if you give it, a physical address when needed to ship a future physical item, which is not the general case for a pure web brochure today, but the policy is written to stay accurate if a product later ships.
Commercial, education context
Whether you are interested in a future workshop, a partner license, or a public mention, to the extent you tell us. We will not add demographic guesses from a third-party data broker; if we did in a new project, a separate, prominent notice and consent path would be required where the law needs it.
Why we use data, in order of the usual story arc
Deliver, secure, and improve the site in good faith. We have a legitimate interest, and in some U.S. contexts a “business purpose” similar to a service provider role in other laws, in keeping the service available, in debugging broken links, in measuring aggregate performance of pages, in defending against attack traffic, and in training staff with redacted materials when we on-board a new engineer under confidentiality.
Answer your questions, carry out a contract, or set one up with you if you order a service. If you buy or reserve something we sell in the future, the core processing is to perform the contract, record tax, and help you and us in a support exchange. The legal base may be contract under the GDPR, and a parallel U.S. contract plus consumer-law overlay.
Meet legal duties. We may be asked to run know-your-client steps for certain payments, to respond to a lawful subpoena, to preserve records in a pre-litigation hold, to respond to a consumer-rights request under a U.S. state act, to answer a DPA, or to show work if we are audited. In those cases, a legal obligation, a substantial public interest in narrow cases, or a claim defense may be the most accurate label.
Optional marketing, only with a path that fits the region. We do not send you cold marketing email through this form unless a separate, clear opt-in exists and you can leave with one action. A consent record may include a timestamp, the list name, a short hash of the version of the form, and, if a double opt-in is used, the moment you confirmed, which is a common pattern for EU-friendly lists. You can still unsubscribe even when we rely on a soft opt-in, where a narrow exception exists for related products from the same business line.
No automated decision with legal or similar effect on this public site, today. We do not run a public scoring model that would deny a job, a loan, a license, or a public benefit, based on your behavior on the brochure alone. If a future system ever did, we will give you a human review path and a clear notice before a decision binds you, as required in your region.
When we let someone else help, and what the contract looks like in practice
We use a mix of in-house and vendor tools: hosting, transport encryption, mail delivery, optional analytics, optional advertising, a payment rail if a payment exists, a backup and archive layer, a logging front, and, when needed, outside counsel, forensic help, and an insurance-backed incident coach. Vendors in the EEA, UK, U.S., and other regions may each see a small slice, under our instructions, with a data processing addendum or a set of public terms the law treats as a commitment to process only for our purposes.
We do not sell the contact list to a random data broker. If a U.S. state’s definition of “sale” is broad enough to count a one-time, money-free trade of identifiers in an ad context, the Cookie and marketing sections plus any “Do not sell” page will describe a clear opt out. Corporate sale of business assets, merger, or investment diligence may need to transfer a database; we will use reasonable steps, including notice where practicable, and a continued privacy commitment from the new owner, subject to local law and your rights there.
How long, in broad strokes, not a secret calendar
Contact threads that are routine may be pruned a few years after the last non-automated touch, to balance your interest in a fresh start, our need to understand how we have advised you, and a tax or book-keeping need for an invoice, if one exists. Security logs and abuse traces may be shorter or longer depending on a rotation rule and a live investigation, which is why we do not name a single day count for all rows in all tables.
When you use the rights below to delete, we will remove the rows we can find with proportionate search, and we will ask our main processors to do the same, except where a narrow carve-out in law or a bona fide hold applies. A backup that is not easy to search line-by-line can keep a de-identified, encrypted copy until it ages out, which is a pattern many firms describe in similar policies.
If you are not in the United States, read this with your local sheet
Your data can be processed in the U.S. and other countries. For EEA, UK, or Swiss data, we add Standard Contractual Clauses with impact checks, and, where a court question appears, a supplementary measure such as at-rest encryption, limited access, or a regional deployment if a product allows it. If a transfer becomes unlawful under a new ruling, we will move to a lawful route or stop a specific flow, which may, in a narrow case, require pausing a feature that depended on a remote script.
Rights you can assert, and how to start
Depending on the law, you may request access, rectification, erasure, restriction, objection, portability, information about the logic in a non-existent automated public decision, human intervention if a later process exists, a machine-readable copy of a category, withdrawal of a consent, and an end to a sale, share, or certain profiling for ads, where the words in your state match that structure. In some U.S. states, you can appeal a refusal once in writing; we will tell you the hook for that in our reply, not here, because the rules move.
We can ask you to show you control the email, phone, or address you are talking about, to avoid leaking data to a stranger, and in some high-risk cases we can ask a little more, to the line your law allows, without turning the process into a long quiz. We do not make you create an account you did not have, just to get a first answer, unless the law explicitly lets us, which is not our default for this public site. If a request is clearly excessive or a repeat campaign, a reasonable fee or a pause may apply, as the GDPR and similar text foresee.
Supervisory authorities in the EEA, the ICO in the UK, a Swiss FDPIC path, a U.S. state attorney’s consumer desk, the FTC, or a sector body may take a case if you are not content with a final answer, without losing a court path where that remains. We do not retaliate by ending a basic service, charging a new fee, or downgrading a quality, because you used a right, to the extent the law in your state forbids that pattern.
Security approach, integrity, and how we will tell you of a real risk
We use layered access, a least-privilege default, a multi-factor sign-in for the admin path, a patch habit for known critical issues, and a vendor review for new high-risk services. We cannot guarantee a perfect state; we can say that we will tell affected people and, where a law requires, a public authority, without unreasonable delay, when a likely serious risk to you appears after a material breach, with the steps we suggest, such as a password reset or a watch on an account, again without a promise of a particular outcome, because the field changes fast.
Contact and verification for privacy questions. Email: contact@zlexironflox.world. Phone: +1 212-289-3846. For cookies use the Cookie policy and for general rules the Terms of use. To adjust browser tech: Cookie settings.