Privacy Policy

1. Who We Are

Zeloric.io (“Zeloric”, “we”, “us”, or “our”) runs a realistic workplace with five desks (Tech support, Fraud prevention, Anti-money laundering, Medical claims and Network engineering) where people work tickets and cases and keep a graded record of the work.

We operate Zeloric, a realistic workplace with five desks where people work tickets and cases: a free tier, The Desk and the Desk Pro, which adds career tools to the Desk. The Residency is no longer sold; it applies to existing Residents only.

This policy covers visitors, free-ticket users, and Desk and Desk Pro subscribers, and Residents who joined before 6 October 2026. Payment and transaction data comes with buying the Desk or the Desk Pro.

What you pay and how billing works is set out in our Terms of Service.

For all privacy-related matters, you can reach us at info@zeloric.io.

2. Data We Collect

Residency applications (closed)

There is no application today. Until 6 October 2026, people who applied for the Residency gave us the following, which we keep as set out in Section 6:

• Identity: First name, last name
• Contact: Email address, phone number
• Background: whatever you choose to tell us in your application, and your résumé
• Location: Country of residence
• Professional profiles: GitHub URL and LinkedIn URL (both optional)
• Application materials: Resume or CV (uploaded file), personal statement
• Residency preference: Selected track

When you pay

The Desk and the Desk Pro are paid monthly. Payment is processed by Stripe, and we never receive or store your full card number. In connection with a purchase we collect and hold:

• Billing identity and contact: The name and email address you check out with, and the billing address our payment processor collects from you.
• Transaction records: Your payment-processor customer and subscription identifiers, the amount and currency of each payment, your plan and billing history, your payment status including whether a payment has failed, the date your access is paid through, and any refund, cancellation or payment dispute.
• Country signals: A country derived from your IP address and, where you provide one, from your billing address. We use these to establish where a sale takes place, which we need for tax and compliance purposes.

• Your acceptance record: When you accept our Terms of Service and Refund Policy at checkout, we record which versions you accepted, the date and time, your IP address, and your browser user agent.

  This is how we can show what you actually agreed to, and it is recorded before any payment is taken.

While you use Zeloric

Once you work tickets, on any plan, we collect the data your work produces:

• Your work: The tickets and incidents you handle, the comments and resolutions you write, and the deliverables you produce.

  This includes the requests you send from the workbench’s API client: the method, the address and the status it answered, never the headers or body you send.

• Assessment: The skill scores recorded against your account, your progress through The Desk, and the records issued to you.
• Profile content: The experience, projects and credentials you choose to add to your Zeloric profile, including anything you publish on your public work record.

• AI feature inputs and outputs: Everything you type into the Career Copilot, the complete transcripts of the interviews you run in the Interview Gym, the work you send in to be graded, the replies you send to the customer and to a colleague, the notes you ask the buddy to check, the resume text and answers you send in for interview prep, and the prompts you try in the Prompt Lab, along with the scores and written feedback generated from them.

  These are stored against your account, and they are sent to Anthropic in order to produce a response. Section 7 sets out that sharing in full, and you should read it before using these features.

When you work a free ticket

To work a free ticket, you give us your name and an email address. We store both as you typed them. We do not check at that point that the address is yours.

• What we use them for: Only to send you the report on your ticket and, at most, one reminder if you do not finish it. Nothing else is sent to that address unless you keep your record or apply.
• Stopping the emails: The link in the report or reminder lets you stop further emails about the ticket. After that, we do not send free-ticket emails to that address again.
• Keeping your record: If you open that link and choose to keep your record, the address becomes your account's email address.

• How long we keep them: If you do not keep your record, we delete your name, email address and the ticket you worked 90 days after you last used them.

  You last used them when you most recently gave us your details, worked on the ticket, opened your report link for the first time, or were sent your report or reminder.

  We do not delete them while your report link still works, or if you have applied or paid. You can ask us to delete them sooner at any time.

• Erasure: If you ask us to erase your data, the name and email address you gave are deleted with it. We keep a fingerprint of the address only so that we never send it free-ticket emails again.

Information collected automatically

When you visit our website, we may automatically collect basic technical data including your IP address, browser type and version, device type, pages visited, and time spent on the site. This data is used solely for security monitoring and improving website performance.

We also keep a first-party interaction log recording the type of event, the page it happened on, and a random session identifier, so we can tell which parts of the site are working.

When you are not signed in, it is not tied to your name. It is not shared with any advertising network.

When you are signed in and working in the workbench, we also record what you click and which tools and tickets you open. This record is tied to your account. We record the name of the button or link, never what you type.

We use it to see how the workbench is used and which parts of it are hard to use. Zeloric staff can see it. We keep it for 180 days and then delete it.

You can ask to see it, or ask us to delete it sooner, at any time.

If you use Team chat in the workbench, we keep the messages you write and the replies you receive. Your conversations with the colleagues who are not real people are visible only to you and to Zeloric staff.

Messages you post in a shared channel are visible to the other members in it. We keep Team chat messages for 180 days and then delete them, and we delete them sooner if you ask us to erase your data.

The workbench leaderboard

The workbench has a leaderboard. It shows your name, as you registered it, and the number of your tickets that have been graded. These are shown to other learners signed in to the workbench.

Nothing else about you is shown there: no email address, no employer, no photo, and no score.

The leaderboard is off unless you turn it on. To turn it on, open the workbench, choose “Your standing”, and tick the box marked “Show my name on the board”.

You can turn it off in the same place at any time, and your name is then not shown to other learners. You can also email us and we will do it for you.

When a company invites you to an assessment

If a company invites you to an assessment, we collect three kinds of information.

• Identifiers: your name and your email.
• Professional information: your work on the assessment, and its result.
• Internet activity: only what happens during the assessment session.

We record your answers, the steps you took, and how long each part took. We do not record your screen outside the assessment, your keystrokes, or your camera.

We use it to run the assessment, and to show the company that invited you how you worked. We do not sell it, and we do not share it for advertising.

The company that invited you, and Zeloric staff who support the service, can see it. Every view is logged. We show the result to that company only after you agree. The companies that host the service also process it, only to provide the service. We will name them here once our agreements with them are signed.

We keep it for 12 months after the company that invited you first views it, or 12 months after you finish if it is never viewed, then delete it. You can ask us to delete it sooner at /data-request/.

If you need more time, a different format, or another accommodation, email support@zeloric.io before you start.

3. How We Use Your Data

We use your personal data only for the following purposes:

• Running your account: To give you the plan you chose, grade your tickets, keep your record, and publish it only when you choose to
• Communication: To contact you regarding your account, your tickets, your grades and your plan
• The Residency: For Residents who joined before 6 October 2026, to run the Residency they bought
• Payments and billing: To take monthly payments for the Desk and the Desk Pro (and Residency instalments), handle failed payments, process refunds and cancellations, respond to payment disputes, and keep the accounting and tax records we are required to keep
• AI-assisted features: To operate the Career Copilot, the Interview Gym, grading, the customer and colleague replies, the buddy checks, interview prep and the Prompt Lab, which generate responses, interviews, scores and feedback from what you enter and from the data held on your account
• Assessment: To issue your Zeloric record upon completion of The Desk. Scores and the desk you worked are assessment data, and they are not shared with any advertising network.
• Workbench activity: To see how the workbench is used and which parts of it are hard to use
• News from Zeloric: With your consent, to tell you about new tickets and features
• Legal compliance: To comply with applicable legal obligations

We do not use your data for automated decision-making or profiling that produces legal effects.

4. Legal Basis for Processing

We process your personal data under the following legal bases:

• Legitimate interests: Keeping the site secure, finding and fixing faults, and seeing which parts of the workbench are hard to use
• Contract performance: Running the free ticket or the plan you chose, taking your payment, and delivering what you have paid for
• Consent: For any marketing communications, and for analytics in the site's cookie banner. You may withdraw consent at any time
• Legal obligation: Where we are required to process data to comply with applicable laws

5. Data Storage & Security

Your data is stored on secure cloud infrastructure provided by Supabase, Inc., a GDPR-compliant data processor. All data is encrypted in transit (TLS/HTTPS) and at rest.

We implement appropriate technical and organisational measures to protect your personal data against unauthorised access, alteration, disclosure, or destruction.

Access to your data is restricted to authorised Zeloric team members who need it for the work they are doing, whether that is grading, running the desk, or helping you with a billing question.

Uploaded resumes are stored in a private, access-controlled storage bucket and are not publicly accessible.

While we take reasonable precautions, no method of transmission over the internet is 100% secure. If you have concerns about data security, please contact us at info@zeloric.io.

6. Data Retention

• Your account and record: Kept for as long as your account is open, whether or not you pay for a plan, so the record of your work is there when you need it. When you close your account (ask at /data-request/), we confirm the address is yours, take down any published record page, and delete your data within 30 days. Billing records are the exception: we keep them for as long as tax and accounting law requires.
• Unsuccessful applications: Retained for 12 months from the application, then permanently deleted.
• Accepted Resident data: Retained for the duration of the programme plus 3 years following completion, to support record verification requests and alumni network participation.
• Marketing consent records: Retained until you withdraw your consent.
• Website technical logs: Retained for up to 90 days for security monitoring purposes, then deleted.
• Workbench activity: What you click and open in the workbench while signed in is kept for 180 days, then deleted, as set out in Section 2 under “Information collected automatically”.
• Team chat: Messages in the workbench’s Team chat are kept for 180 days, then deleted.

• Free tickets you did not keep: Your name, email address and the ticket you worked are deleted 90 days after you last used them, as set out in Section 2 under “When you work a free ticket”.

  We keep only the fingerprint of the address described there.

You may request early deletion of your data at any time by contacting us (see Section 8 and Section 13).

7. Sharing Your Data

We do not sell, rent, or trade your personal data to any third party.

We may share your data in the following limited circumstances:

• Service providers: We use the following sub-processors, each under their own terms, and none of them may use your data for their own purposes:
  • Supabase - database, authentication and file storage (our primary infrastructure).
  • Anthropic - AI features. This includes grading, the Copilot, the customer and colleague replies, the buddy checks, the Interview Gym and interview prep, and the Prompt Lab, and every other AI tool on Zeloric, which send your name, your scores, the work you send in, anything you type into them, and complete interview transcripts.
  • Deepgram - Voice. When you speak in an interview or on a call, your voice goes from your browser to Deepgram, which turns it into text. Zeloric does not keep a copy of your voice.
  • Stripe - payments. They receive your name and email; we never see your full card details.
  • Resend - transactional email. They receive your name and address.
  • Vercel - website and application hosting, and, if you accept analytics, page-view counts (Vercel Analytics).
  • Cloudflare - bot protection on our forms.
  • Sentry - uptime and scheduled-job monitoring. It checks that our pages and jobs are running, and receives no personal data.
  • PostHog - error tracking, and measuring the cost and speed of our AI features. When something breaks it receives the error and the type of page it happened on, with any private link or code removed, and your account identifier if you are signed in. For each AI response it receives counts, timings and cost tied to your account identifier, never anything you or the AI wrote. If you accept analytics it also receives page views with an anonymous id; if you decline, it receives no page views.

  If you message us on Instagram, we use ManyChat, Inc. to send and manage those messages. It stores your Instagram handle, messages and opt-in status on our behalf. We keep this for up to 12 months after your last message, and you can ask us to delete it at info@zeloric.io.

• Other learners: The workbench leaderboard shows your name and your graded ticket count to other learners signed in to the workbench, only if you turn it on. Section 2 says how to turn it on and off.
• Legal requirements: We may disclose your data if required to do so by law, court order, or governmental authority, or if we believe in good faith that such disclosure is necessary to protect our rights or the safety of any person.
• Business transfers: In the event of a merger, acquisition, or sale of assets, your data may be transferred to the successor entity. We will notify affected users in advance.

8. Your Rights

Depending on your location, you may have the following rights regarding your personal data:

• Right of access: Request a copy of the personal data we hold about you
• Right to rectification: Request correction of any inaccurate or incomplete data
• Right to erasure: Request deletion of your personal data (“right to be forgotten”), subject to legal retention requirements
• Right to restriction: Request that we limit how we process your data in certain circumstances
• Right to data portability: Request your data in a structured, machine-readable format
• Right to object: Object to processing based on legitimate interests
• Right to withdraw consent: Where processing is based on consent, withdraw it at any time without affecting prior processing

To exercise any of these rights, email us at info@zeloric.io with the subject line “Data Rights Request”. We will respond within 30 days. We may need to verify your identity before processing your request.

If you are located in the European Economic Area (EEA), UK, or a jurisdiction with applicable data protection law and you believe we have not addressed your concern adequately, you have the right to lodge a complaint with your local data protection authority.

9. Cookies & Tracking

We use no advertising cookies or pixels and no session recording. Some storage is needed for the site to work: signing in, your theme, and your cookie choice.

Analytics runs only if you accept it in the cookie banner: Vercel Analytics, PostHog page views, and our own record of which buttons are used, with an anonymous id kept in your browser's local storage, not in a cookie. If you decline, we store no analytics id and we send no page views or button use to PostHog or Vercel Analytics. Error reports can still go to PostHog, with no name and no account id from this browser. Signed-in AI cost counts can include your account id, as section 7 describes, and never text you wrote. We need these to keep the service working and to track its running cost. Speed Insights measures how fast pages load and carries no identifier. Our Cookie Policy lists each item.

Whether or not you accept analytics, we send PostHog an anonymous count when an account is created, a plan is bought or a plan is canceled, with no name, email or account id. If you accepted analytics, the count is linked to your account id.

10. International Data Transfers

Zeloric operates globally and your data may be processed on servers located outside your country of residence.

If you are based in the EEA or UK, your data may be transferred to countries that do not provide the same level of data protection as your home country.

The sub-processors listed in section 7 each maintain their own transfer safeguards, such as Standard Contractual Clauses or an equivalent framework, and we choose providers on that basis.

As a small and newly formed team we are still completing our own formal data-processing agreements, and we would rather tell you that plainly than imply protections we have not yet put in writing.

If you are in the EEA or UK and want to know exactly where your data sits before you start, email us and we will answer honestly.

11. Children's Privacy

Zeloric is for students, graduates, career changers and people already working in support, and is for people aged 18 or older, as our Terms require. We do not knowingly collect personal data from anyone under 18.

If you believe we have inadvertently collected data from a person under 18, please contact us immediately at info@zeloric.io and we will delete it promptly.

We honour Global Privacy Control as an opt-out of sale and sharing.

12. Changes to This Policy

We may update this Privacy Policy from time to time to reflect changes in our practices, legal requirements, or operational needs. When we make material changes, we will:

• Update the “Last updated” date at the top of this page
• Notify account holders the change affects, at the email address on file

• 2 November 2026 - a ManyChat processor notice was added for Instagram messages.
• 3 November 2026 - declining analytics stops page views and button-use tracking. Error reports and AI cost counts can still go to PostHog.
• 7 November 2026 - the AI features in section 2, section 3 and section 7 now name every AI tool and the companies that run it.

We encourage you to review this policy periodically. Continued use of our website or of a paid plan after changes take effect constitutes your acceptance of the updated policy.

13. Contact Us

If you have any questions, concerns, or requests relating to this Privacy Policy or the way we handle your data, please contact us:

• Email: info@zeloric.io
• Subject line: Privacy Enquiry

We are committed to resolving privacy concerns promptly and transparently.