Privacy policy

What we collect

Account: your e-mail address, the name you give (optional), a hash of your password if you set one, and which sign-in methods you use (e-mail link, password, passkey, Google or Apple — from Google and Apple we receive only your e-mail address, whether it is verified, and your name).

Security: for each signed-in session, the browser or app it came from, the IP address and when it was last used; a log of account events such as sign-ins, password changes and data exports.

Licence and machines: your plan, when it renews, and for each machine linked to your account the name of the computer that runs Zorocut Nest, its operating system and the Zorocut Nest version.

Usage: the number of exports and quotes each month (the Free plan counts 10), and, once a machine is linked, totals Zorocut Nest reports for it after each export — the machine's name, type, power and controller, and totals per machine: exports, sheets, parts, estimated cut time and sheet material used — and, for each nest it runs, how many sheets and parts it placed. You can switch this off in the app (Machine → Output folder). When you are signed in on the online nester at zorocut.com, it sends the same two numbers for each nest you run there. Your drawings never leave your computer this way: no file, no geometry, no customer name.

Files you send to us on purpose: DXF files you send to your job list, and jobs that reach the list from a system you connect through the API, are stored on our servers so they can reach Zorocut Nest.

Payments: payments are processed by Stripe, under its own privacy policy. We receive your e-mail, country, billing address and VAT number where the tax calculation needs it, plan and payment status — never your card.

E-mails you write to us, so we can answer.

Where you first came from: on your first visit this browser keeps the name of the site that linked to us (only its address, such as google.com — never the page), the campaign tags in our own links (utm_…), the first page you opened, its language and the date. It stays in your browser and reaches us only if you create an account, as part of the sign-up; then it is stored with your account and used only to see which channels bring customers. Google's ad click id (gclid) is kept only where Google Ads may load, as described below.

What Zorocut Nest sends

Zorocut Nest works on your computer. Without an account it only checks zorocut.com for updates. Once you sign in and link a machine, it also exchanges licence checks, counts Free exports and sends the machine totals described above. It never uploads your drawings.

Website analytics and cookies

Our own analytics (Umami, hosted by us) counts visits without cookies and without identifying you.

In the European Economic Area, the United Kingdom and Switzerland, Google Analytics, Google Ads, Microsoft Clarity and Gravity load only if you accept the cookie banner. Everywhere else, Google Analytics and Google Ads load by default, the banner says so, and "Decline" turns them off; Microsoft Clarity and Gravity still load only if you accept. We work out which applies from the country Cloudflare reports for your connection, and if it can't tell, we treat you as being in the EEA.

Google Ads measures whether a visit from one of our Google ads went on to download the app, create an account or subscribe; we do not use it to show you personalised ads. Gravity measures whether our ads in AI chat apps bring visitors: which ad a visit came from and which pages it saw. You can change your mind at any time: "Cookie settings" at the bottom of every page clears your answer and shows the banner again (clearing this site's data in your browser does the same).

When you sign in we set a session cookie and short-lived security cookies (for Google/Apple sign-in, passkeys and confirming sensitive changes). They are needed for the account to work and are not used for advertising.

E-mails

Your account e-mail gets messages about your account, licence and payments.

Tips and news (about one e-mail a month) go only to people who ticked that box when signing up or switched it on in their account. We record when and where you agreed. Every such e-mail has an unsubscribe link, and the same switch in your account turns it off.

The newsletter (nesting and quoting tips and Zorocut news, about one e-mail a month) also goes to people without an account who entered their address in the newsletter form on our site and then confirmed it with the link we e-mailed; an address that is never confirmed gets nothing more. We keep the address, its language, the page it was entered on, and when and from which IP it was entered and confirmed. It is one list: being a customer never puts you on it, and the unsubscribe link in any newsletter or the switch in your account takes you off it.

Why we use your data

To provide the service you signed up for (contract): your account, licence, Zorocut Nest, the online tools and support.

To keep accounts secure and understand how Zorocut Nest works with each controller (legitimate interest): security logs and machine totals.

To understand which of our channels bring customers (legitimate interest): where a new account first came from, kept with the account.

With your consent: tips and news e-mails, Microsoft Clarity and Gravity (measuring our own ads), and, in the EEA, the UK and Switzerland, Google Analytics and Google Ads. You can withdraw it at any time.

Outside the EEA, the UK and Switzerland, measuring visits and our own ads with Google Analytics and Google Ads (legitimate interest), unless you decline in the banner.

To keep invoices and tax records as the law requires (legal obligation): we keep them, with Stripe.

Who processes it for us

Contabo (servers in the European Union) hosts the service and the database; Cloudflare delivers the website and protects it; Zoho sends our e-mails and holds the mailbox [email protected]; Anthropic (Claude) helps us draft answers to the e-mails you send us — it reads the message, a person reads every answer before it is sent, and Anthropic does not train its models on this data; Stripe handles payments; Google and Apple only when you choose to sign in with them; Microsoft Clarity and Gravity only with your consent; Google Analytics and Google Ads with your consent in the EEA, the UK and Switzerland, and unless you decline elsewhere. Encrypted backups are stored with Cloudflare R2.

Some of these companies may process data outside the European Union; they do so under the European Commission's standard contractual clauses or an equivalent safeguard. We do not sell your data. Its only advertising use is measuring our own ads with Google Ads and Gravity, as described above.

How long we keep it

As long as your account exists. When you delete your account it is removed after 30 days (write to us within those 30 days to restore it); backups roll over and the data disappears from them afterwards.

Signed-in sessions expire on their own. Payment records are kept for as long as tax law requires, by us and Stripe.

Your rights

You can see, download and delete your data from your account page, or ask us by e-mail. You can also ask us to correct it, restrict or object to how we use it, and withdraw any consent you gave.

If you think we got something wrong, write to us first. You can also complain to the Romanian data protection authority, ANSPDCP (dataprotection.ro), or the authority in your country.

Children

Zorocut is a tool for sheet-metal cutting businesses and is not meant for anyone under 16.

Changes

When this policy changes, we update the date at the top; for important changes we also tell account holders by e-mail.