Privacy policy

1Who looks after your data

The controller of your personal data is Zyggs. The Zyggs legal team acts as the data protection officer (the contact the LGPD provides for) and answers requests through the support form, in the Privacy and data category.

2What data we process and why

• Account: e-mail, display name, preferred language and password. The password is kept only as a PBKDF2 digest of 100,000 rounds, which cannot be turned back into it. Used to create the account, sign in and send you notices.
• Session: a random identifier in a cookie; the database keeps only its SHA-256 digest. Keeps you signed in for up to 30 days without use.
• Program licence: when you activate Zyggs on a device, we keep an identifier of the device as a digest, the name the system gives it, the operating system, the device’s public key and the dates of activation and of last contact. Used to keep the plan’s device limit and to let you deactivate a device in the panel.
• Free trial: a digest of the device identifier, so the trial is used once per device.
• Subscription: the plan, the state of the subscription, the space packs and the customer identifier at Stripe. The card number is typed into Stripe’s own form and does not pass through Zyggs servers.
• Prices in your currency: the country of your connection, as Cloudflare reports it, chooses the currency the prices are shown in. It is used for that answer only and is not kept.
• Cloud: the projects you upload, with name, size and dates, and up to 19 earlier versions of each. Used so you can open your projects on another computer and get versions back.
• Community and artists: the public name, texts, images and dates of what you publish, the reports you send and the proposals exchanged between companies and artists.
• Support and survey: the messages of your tickets and the answers you give to the satisfaction survey, which is optional.
• Protecting the service: counters of requests per account over short windows, to stop abuse, and a record of the team's administrative actions.

3What the program sends over the internet

The program works on your computer and does not send your drawings to Zyggs on its own. It uses the internet to: check the licence with the Zyggs server; ask the same server which version is the newest for your system (only the name of the system goes with the question); open the subscription pages in your browser; upload and download cloud projects, when you use sync; and look for reference images on Wikimedia Commons, when you use the reference search.

In the reference search, the term you search for goes to Wikimedia Commons, which follows the privacy policy of the Wikimedia Foundation. The program collects no usage statistics and sends no crash reports.

4Legal bases

• Performance of the contract: account, session, licence, subscription, cloud, publications and support.
• Legitimate interest: preventing fraud and abuse, security, community moderation and the limit of one trial per device.
• Legal obligation: payment records required by tax law and answers to orders from authorities.
• Consent: the satisfaction survey. You can stop answering at any time.

5Who we share data with

We do not sell personal data and do not use it for advertising. We share only what is needed with the suppliers that run the service:

• Cloudflare: hosts the site, the database and the cloud files, and protects the site against attacks.
• Stripe: processes payments and prevents fraud.
• Resend: sends the account e-mails, such as address confirmation, password recovery and notices.
• Wikimedia Commons: receives the search term, when you use the program's reference search.

We can also provide data when an authority requires it as the law provides.

6International transfer

These suppliers can process data outside Brazil, including in the United States. The transfer follows article 33 of the LGPD and rests on these suppliers' data processing agreements and security measures.

7How long we keep data

• Account and content: while the account exists. After a deletion request, we erase the data within 30 days, except what the law requires us to keep.
• Sessions: up to 30 days without use, or until you sign out.
• Versions of cloud projects: the current one and the 19 before it, for each project.
• Payment records: for the period set by tax law, usually 5 years.
• Technical backup copies: up to 30 days.

8Your rights

Under the LGPD you can ask for: confirmation that we process your data; access to it; correction of incomplete or wrong data; anonymisation, blocking or deletion of unnecessary data; portability; the list of who we share it with; and withdrawal of consent, when consent is the basis.

Ask through the support form, in the Privacy and data category. We answer within 15 days. You can also file a complaint with the National Data Protection Authority (ANPD).

Part of this you can do yourself in the panel: change your name and the language of e-mails, change the password, end sessions, deactivate devices, cancel the plan and delete cloud projects.

9Security

• Encrypted connections (HTTPS) on the site and between the program and the server.
• Passwords kept only as PBKDF2 digests, and sessions only as SHA-256 digests.
• Each device proves its licence with a cryptographic key that stays on it.
• Team access limited to those who need it, with a record of administrative actions.

If there is a security incident that could cause relevant risk or harm, we tell the affected people and the ANPD, as the law requires.

10Children and teenagers

The service is not aimed at children. People under 18 use it with the permission and supervision of the person responsible for them. If we learn that we process data of a child without the consent of a parent or guardian, we delete that data.

11Changes to this policy

When this policy changes in a relevant way, we tell you by e-mail and on the site before the change applies. The date at the top shows the version in force.