Privacy Policy

Draft — not yet reviewed by an attorney. The factual descriptions of what this site collects and does are accurate. Anything highlighted below is a business or legal decision that has not been made, and this page must be reviewed by a qualified attorney before the site accepts payments.

Who we are

ZeroDayITServices LLC, a limited liability company registered in Texas, United States, operating ZeroDayITServices.com. Registered address: 1002 Austin Court, Weatherford, TX 76086, United States. Data protection contact: [email protected].

We are the data controller for the personal data described on this page.

What we collect

This list is complete and describes what the site actually stores today.

• Your email address. Required to sign in. We do not store a password — sign-in uses a one-time link sent to your inbox, so there is no password of yours for us to lose.
• A display name, only if you choose to appear on the leaderboard. It is off by default and your email is never shown there.
• Your learning activity — which modules you complete, practice-exam scores, XP, streaks and badges earned.
• What you have bought and when, and whether access is perpetual or runs to a date.
• Messages you send us through the contact form: name, email, phone if you give one, what you are interested in, and your message.
• Your IP address, used to rate-limit sign-in and contact requests, and recorded against sign-in link requests so abuse can be traced.

What we never collect

We do not see or store card numbers, expiry dates or security codes. Payment details are entered on Stripe's own checkout page and never reach our servers. We hold only Stripe's reference for the transaction.

We do not run advertising trackers, and we do not sell or share personal data with advertisers.

Who else processes your data

• Stripe — payments. Receives your email and purchase details.
• Cloudflare — hosting, content delivery, and the bot check on our contact form. Processes your IP address as part of serving the site.
• Resend — sends sign-in links and confirmation emails. Receives your email address.
• Google — hosts our own mailbox through Google Workspace. Anything you send us through the contact form, or by email, is delivered to and stored there.

We use no analytics provider at present. If that changes, this page and our cookie policy will be updated first.

How long we keep it

Sign-in links expire after 15 minutes and are single-use. Sessions expire after 30 days. Beyond that:

• Your account and learning activity — kept for as long as you have an account. Ask us to delete it and we will, without needing a reason.
• Purchase records — kept for 7 years. Tax law requires us to be able to show what we sold and when, so this is the one category we cannot delete on request. It is the record of the transaction, not a profile of you.
• Messages you send through the contact form — kept for 24 months, then deleted.

Deleting your account removes your learning history and closes your access to anything you bought. It does not reverse a purchase or issue a refund — see the refund policy for that.

Your rights

We operate under United States law, and under the EU and UK GDPR where it applies to you. Rather than work out which regime covers you before answering, we offer the same rights to everyone who asks:

• Know whether we hold data about you, and get a copy of it.
• Correct anything inaccurate.
• Delete your account and the data attached to it, except records we are required to keep — purchase and tax records are the usual exception, and deleting your account does not undo a completed transaction.
• Take your data elsewhere in a portable format.
• Object to, or restrict, how we use it.

There is nothing to opt out of for targeted advertising, sale of personal data, or automated profiling, because we do none of those. That is a statement about how the site is built, not a promise about the future — if it ever changes, this page changes first.

Email [email protected] to make a request. Under the Texas Data Privacy and Security Act we have 45 days to respond, extendable once where a request is complex; under the GDPR we have one month, extendable by two further months on the same basis. We aim to be well inside both. If we refuse a request we will tell you why, and you may appeal by replying to that decision.

If you are in the EU or UK and are unhappy with how we have handled your data, you have the right to complain to your national data protection authority. Doing so does not require you to contact us first.

Children

This site is intended for adults and is not directed at children. You must be 18 or older to create an account or buy anything here. We do not knowingly collect personal data from anyone under 18. If you believe a child has created an account, email [email protected] and we will delete it and the data attached to it.

We do not ask for a date of birth, so we cannot verify age at sign-up — the requirement is stated rather than enforced technically. Collecting birth dates from every customer in order to screen out a group the site is not aimed at would mean gathering more personal data, not less, which is the opposite of how the rest of this page is built.

Security

Traffic is encrypted in transit. Course materials are stored privately and released only after an access check. Sign-in tokens are stored hashed, so a copy of our database would not yield a working link. Session cookies are restricted to this site and cannot be read by scripts.

Last updated: 18 August 2026 · Questions: contact us