Privacy policy
Last updated:
Words
- We: the operator of zriz. You: a person who has an account or visits zriz.io.
- Personal data: data about a person who can be identified.
- Cloud, org, member, run, space: see the word list.
Who is responsible
We decide why and how the data on this page is used. We are one person in Ukraine. Write to support@zriz.io.
Your org decides which data goes into its runs and its space. For that data your org is responsible, and we only process it for your org.
The data that we keep
| Data | Purpose | Legal base | How long |
|---|---|---|---|
| Account: e-mail address, display name, password as an Argon2id hash, role | Sign-in, service e-mail | Contract | Until the account is removed |
| Sign-in with Google or GitHub: your id, e-mail address and name there | Sign-in | Contract | Until the account is removed |
| Session: a hash of its token | Sign-in | Contract | 30 days, or until you sign out |
| Password reset: a hash of the link token, the time | Sign-in | Contract | The link works 1 hour. We remove the row when you use the link, or with your next reset request after the link is too old, or when the account is removed |
| Invite: e-mail address of the invited person, role | To add a member | Legitimate interest | Until the org is removed |
| Keys and runner keys: name, SHA-256 hash | Access for zz and the runner |
Contract | Until the account or the org is removed |
| Run: pipeline name, env, status, times, id of the key that started it, results | Test results | Contract | 7 days after the run ends (free tier) |
| Space: posts and service contracts, with the account id of the author | Team messages | Contract | Until the org is removed |
| Notifications: kind, recipient, delivery status | To send e-mail | Contract | 90 days |
| Access log of the web server: IP address, time, path, browser headers without cookies and keys | Security | Legitimate interest | 30 days at most |
| Sign-up and sign-in limits: IP address or IP block, in memory only | Security | Legitimate interest | 24 hours at most |
| Block list of the server: IP address of a client with many refused requests | Security | Legitimate interest | 1 hour |
| App log: ids, kinds, reasons, times. Sign-up lines hold a masked e-mail address | Security | Legitimate interest | Until the log is 500 MB. Then the oldest lines go |
| E-mail that you send to us | To answer you | Legitimate interest | Until your question is closed |
We use no consent as a legal base.
Each night the server makes a backup of the database and keeps the newest 7. The backups stay on the same server. Removed data stays in a backup for 7 days at most.
What the cloud does not get
zriz is built so that these stay in your network: the connection string of a database, the base URL of an HTTP resource, and each value that you list in sensitive.
A run holds data of your test systems: the fields that your checks need and, after a failed call, 4096 bytes at most of the last result. Read /docs/security.
Companies that process data
| Company | Role | Country |
|---|---|---|
| Hetzner | Hosts the server and the database | Germany |
| Resend | Sends our e-mail. Gets the address and the text | USA |
| Google, GitHub | Sign-in, only when you choose it | USA |
Where the data is
The server is in Germany. We are in Ukraine and read the data from there. Resend, Google and GitHub can process data in the USA. Ukraine and the USA are outside the European Union.
Your rights
You can ask us for a copy of your personal data, a correction, a removal, or a copy in a common file format. You can object to a use that has legitimate interest as its base. Write to support@zriz.io. You can also complain to the data protection authority of your country.
No automatic decision
zriz makes no automatic decision about a person that has a legal effect or a similar large effect. The limits on requests and on new accounts are automatic and equal for each address.
How to remove your account
Open /app/account. Type your e-mail address and select Delete account.
- You are the only member: the cloud removes the org and all its data.
- The org has a different admin: the cloud removes your account, sessions and keys. The org stays. Its runs, posts and service contracts stay, with your account id only.
- You are the only admin and the org has other members: the cloud refuses. First make a different member an admin.
When an admin removes you from an org, the cloud keeps your account record with your e-mail address. Write to support@zriz.io to remove it.
The cloud removes an account that did not confirm its e-mail address in 7 days and has no key, no runner key and no run.
Public pages
The public pages set no cookie and load no script of a third party.
Cookies of the app
Each cookie is necessary for sign-in. No cookie is for analytics or advertising.
| Cookie | Purpose | Life |
|---|---|---|
zriz_session |
Keeps you signed in | 30 days |
zriz_oauth_state, zriz_oauth_pending, zriz_next |
Carry one sign-in with Google or GitHub from start to end | 10 minutes |
zriz_device_code, zriz_device_consent |
Carry the code and your approval of one zz login |
10 minutes |