ZephyrQLPrivacy statement
Draft, last changed 2026-10-29.
Who is responsible
UptimeVanguard, De Ambacht HOUSE-NO-TBD, 4681 CV Nieuw-Vossemeer, Netherlands, KvK 42017143, is the controller for the processing described here. Contact: [email protected].
The ZephyrQL app
ZephyrQL connects only to the database servers you configure. Your queries and data go from the app to those servers, not to us. The app sends no telemetry, no analytics and no crash reports. The log of AI agent (MCP) calls stays in a file on your computer.
The app contacts us for two things:
- Update check. At most once every 24 hours, and when you check by hand, the app asks zephyrql.com for the newest version. It sends its own version and platform (for example win-x64). You can turn the check off in the settings.
- License and trial. Every 6 hours the app contacts license.zephyrql.com. It sends a random install id, its version and platform, the computer name (you can change it), and three hashed values that identify the computer (see below).
The license server
license.zephyrql.com runs on our own server in Germany. It stores:
- Your e-mail address, when you sign in. Sign-in works with a code we e-mail to you; we store the code only as a hash.
- Licenses and seats: organization name, number of seats, paid-until date, the e-mail address of each seat holder.
- Installs: install id, computer name, platform, app version and the dates of activation, refresh and last contact.
- Computers: three values derived from the operating system id, the hardware id and a network adapter. The app hashes them, and the server hashes them again with a key only the server has. We never store the original ids.
- Trial start and end per computer, and a log of license events (for example "seat assigned").
We do not store IP addresses, your country or your browser. The server uses your IP address only in memory, to limit the number of requests. It forgets the address at most 25 hours after your last request. The sign-in pages set one cookie that keeps you signed in; it expires after 1 hour. We set no other cookies. We have no data protection officer; write to us at the address above.
This website and downloads
zephyrql.com and downloads.zephyrql.com run on Cloudflare. We use no cookies, no analytics and no third-party scripts on these sites. Cloudflare processes your IP address to deliver the pages and files and to protect them against attacks.
Sign-in codes go out through Cloudflare's e-mail service. Mail to [email protected] and [email protected] is forwarded by Cloudflare to our mailbox, hosted by Intention in the Netherlands.
Payments
Sales are not open yet. When they open, you order at license.zephyrql.com. We store the order: your name, address, company name and VAT number (for businesses), the number of seats, the price, the VAT and the payment status. For EU VAT we must record where you are: we store the billing country, the country of your internet connection and the country of your payment method, as country codes only, never your IP address. A business VAT number is checked with the EU VIES service. Mollie (the Netherlands) processes the payment. Mollie is a separate controller for the payment data it collects, under its own privacy statement.
Why we process this data
| Purpose | Data and legal basis |
|---|---|
| License and trial you ask for | E-mail, license, seat, install and trial data. Performance of a contract. Without this data we cannot activate the app. |
| Seats an employer assigns | The seat holder's e-mail address. Our legitimate interest in managing the employer's license. |
| One trial per computer | The hashed computer values. Our legitimate interest in preventing repeated trials (see below). |
| Security and updates | Rate limiting in memory, error logs, update requests. Our legitimate interest in secure, current software. |
| Support | What you write to us. Your request and our legitimate interest in answering it. |
| Invoices, once sales open | Billing data. Legal obligation. |
Computer values and the trial
To give each computer one trial, the app reads three ids from your computer and sends only hashes of them. This reading is needed to provide the trial and license you ask for. A less intrusive check, such as an account per trial, would let anyone start a new trial with a new e-mail address. Hashes can match by mistake; if the app tells you a trial was used and you think that is wrong, write to us and a person looks at it. You may object to this processing; we then stop the trial on that computer, because the trial cannot run without it.
How long we keep it
- Sign-in codes: deleted 2 days after they expire. Approval codes for the app: 1 day after they expire. Sessions: when they expire.
- Account, license, install and computer records: as long as your account or license exists. Ask us and we delete them, unless the law requires us to keep them.
- Backups of the license database: 14 days. Deleted data can stay in a backup for up to 14 days.
- Server error logs (no IP addresses): up to 1 year.
- Computer and trial records without a license: deleted 12 months after the trial ends. Audit events about them are kept without identifying data (no computer name, platform, app version or ids).
- Invoices and accounting records, once sales open: 7 years; records for EU VAT on sales to consumers (OSS): 10 years, as tax law requires.
- Orders that were not paid, were canceled or expired: as long as needed to handle them, then on request. We will set a fixed period before sales open.
Processors and transfers
We use Cloudflare (website, downloads, the connection to the license server, e-mail), Hetzner Online (the server in Germany) and Intention (mailbox, the Netherlands). Cloudflare can process data in the United States; it is certified under the EU-US Data Privacy Framework.
Your rights
You can ask to see, correct or delete your data, to limit or object to its use, and to receive it in a common file format. Write to [email protected]. You can also complain to the Dutch data protection authority, the Autoriteit Persoonsgegevens.