Effective 3 September 2026 · Version 2026-09-03
Privacy Notice
This notice explains how ZBANG LTD uses personal information in connection with the Zbang website, orders, payment, onboarding, and Google Ads audit service. The service is intended only for business customers, but information about business representatives can still be personal data.
1. Who is responsible
ZBANG LTD is the controller for order administration, payments, support, security, service communications, and its own business records. Company number 11824205; registered in England and Wales; registered office: 71–75 Shelton Street, London, WC2H 9JQ, United Kingdom. Privacy enquiries: privacy@zbang.ai.
When a business customer makes personal data in its advertising account available solely for an audit on its documented instructions, the customer may be the controller and ZBANG LTD may act as its processor. The roles depend on the data and circumstances. Appropriate written data-processing terms must be in place where required.
2. Information we collect
| Category | Examples |
|---|---|
| Order and contact | Work email, business website, approximate advertising-spend range, business name, and representatives' contact details. |
| Billing and tax | Billing name and address, country, business or tax status, VAT or tax identifier, amount and currency. Stripe receives card details directly; Zbang does not store full card details. |
| Payment and order records | Stripe checkout, customer, payment and dispute identifiers; payment, refund and dispute status; timestamps; accepted legal-document versions; and the signed advertising-choice snapshot applying when checkout began. |
| Audit intake | Your offer, objectives, concerns, selected spend range, free-text audit question, onboarding status, and access-confirmation dates. |
| Advertising-account information | Campaign structure, settings, budgets, bids, search terms, ads, creative, and measurement information visible through the access you provide. |
| Technical and preference data | Request and security data such as IP-derived rate-limit identifiers, browser storage, essential session state, and analytics or advertising choices. |
| Communications | Messages, support requests, complaint or cancellation information, and correspondence about the service. |
3. Where information comes from
We receive information from you or another representative of your business, from Stripe about the payment, from Google when you grant account access, and automatically from your browser or our hosting and security systems when you use the site.
4. Why we use information and our lawful bases
| Purpose | Lawful basis |
|---|---|
| Assess an order, take payment, provide onboarding, perform the audit, and respond about the service. | Contract and steps requested before a contract where you contract personally; otherwise our legitimate interests in supplying the service to your business. |
| Keep invoices, tax, payment, refund, dispute, and accounting records. | Legal obligation and our legitimate interests in accurate business records and resolving claims. |
| Protect checkout and onboarding, limit abuse, diagnose errors, and establish or defend legal claims. | Our legitimate interests in operating a secure and reliable service and protecting legal rights. |
| Use Google Ads information to prepare the requested audit. | Performance of the contract and our legitimate interests; where we act as processor, the business customer's documented instructions govern the processing. |
| Measure site use with Google Analytics 4. | Consent, recorded through your analytics choice. Analytics remains off unless you choose it. |
| Measure and attribute advertising with Google Ads and Meta. | Consent, recorded through your advertising choice. Advertising technology remains off unless you choose it. |
Where we rely on legitimate interests, we consider the need to run and protect the service against the effect on the people concerned. You may object as described below. You can withdraw an analytics or advertising choice at any time through Cookie settings without affecting earlier lawful processing.
5. Who receives information
We disclose only what is needed for the relevant purpose to:
- Stripe, which hosts checkout and processes payment, billing, tax, refund, and dispute information;
- Railway and related infrastructure providers used to host the application and database;
- Google, for the read-only advertising-account access you authorise and, after an analytics or advertising choice, measurement services;
- Meta, only after an advertising choice, for the advertising measurement described above;
- accountants, insurers, legal advisers, and other professional advisers where reasonably necessary; and
- regulators, courts, law enforcement, or another party where disclosure is required by law or needed to protect legal rights.
We do not sell personal information.
6. International transfers
Some service providers may process information outside the United Kingdom. Where UK data-protection law treats this as a restricted transfer, we use a permitted mechanism appropriate to the destination and provider, such as UK adequacy regulations or contractual safeguards, together with any required assessment. Contact privacy@zbang.ai for information about safeguards relevant to your data.
7. Retention
We retain order, intake, payment, tax, support, and audit records only while needed to deliver the service, manage access, answer queries or disputes, meet accounting and legal duties, and establish or defend claims. The applicable period depends on the record, whether an order completed, any dispute, and the statutory or limitation period that applies. When information is no longer needed for those purposes, it should be deleted or anonymised.
- The checkout-return credential expires after 30 days and is removed from the browser after a successful return.
- The paid-onboarding browser credential expires after 14 days.
- Cookie choices expire for authorization purposes after 180 days; limited historical consent evidence attached to an order may be retained with that order record.
- An unfinished intake draft in session storage is ignored after 24 hours and is removed after submission or when the browser session ends.
Removing browser credentials does not delete the underlying order or accounting record. You may ask about the period applying to a particular record by contacting us.
8. Security and account access
Zbang uses access controls and other technical and organisational measures intended to protect information. No internet service can guarantee absolute security. Use Google's access controls, grant only the requested read-only role, never send a password or recovery code, and remove access when it is no longer needed.
9. Your rights
Depending on the circumstances, UK data-protection law may give you rights to access, correct, erase, restrict, or receive your personal data, and to object to certain processing. You can also withdraw consent for future analytics or advertising processing. These rights can be limited where an exemption applies or records must be retained by law. Email privacy@zbang.ai to make a request. We may need to verify your identity and authority.
You may complain to the UK Information Commissioner's Office. See the ICO's current contact options at ico.org.uk/make-a-complaint. We would welcome the opportunity to address your concern first.
10. Required information and automated decisions
Fields marked as required are needed to assess or fulfil the order. Without them, Zbang may be unable to accept payment or deliver the audit. Do not put unnecessary personal data into free-text fields or the advertising account made available for review. Zbang does not use the information described here to make solely automated decisions that produce legal or similarly significant effects.
11. Cookies and choices
See the Cookie Policy for essential state and optional analytics and advertising technologies. Optional technologies operate only after the corresponding choice. You can reopen Cookie settings from the footer at any time.
12. Changes
We may update this notice when the service or legal requirements change. The effective date and version at the top identify the published notice. Material changes will be highlighted where appropriate.