# Privacy Policy

Learn how Z-Mask by ZCNTech handles account data, uploaded files, document masking, payment data, retention and GDPR-related privacy rights.

Source: https://z-mask.com/privacy/

Back to Z-MaskZ-MASK LEGALPrivacy PolicyLearn how Z-Mask by ZCNTech handles account data, uploaded files, document masking, payment data, retention and GDPR-related privacy rights.Last updated: October 17, 2026Who we areZ-Mask is a personal data masking and document redaction service operated by ZCNTech. The product helps users detect and mask personal data in text, documents, images and tables before that data is shared, analyzed or used in downstream systems.For privacy questions, contact us at info@zcntech.com.Data we processAccount data may include your email address, authentication provider details, workspace activity, plan status and support messages.Processing data may include files or text that you upload for masking, detected entity summaries, generated redacted outputs, page or credit usage, timestamps and technical logs required to operate the service.Payment data is handled by our payment provider. Z-Mask does not store full card numbers.How we use dataWe use data to provide the masking workspace, process uploaded documents, calculate usage, support authentication, deliver billing workflows, troubleshoot issues, improve reliability and comply with legal obligations.We do not sell customer documents or use uploaded content to train public artificial intelligence models.Document processing and retentionUploaded files are processed to detect and redact personal data. For newly archived PDF jobs, the SaaS workspace retains encrypted original and masked copies so that the account owner can review them in Processing history. Authorized administrators can access these records for administration. Original image uploads are not currently included in PDF archival, and older jobs may not have archived copies.History also stores account-linked summaries, file names, status, page usage and masked text. There is currently no automatic archive expiry period. Removing a history record does not necessarily remove its archived files; contact info@zcntech.com to request deletion of both. Enterprise deployments can define separate retention policies.Legal basis and GDPR rightsWhere GDPR applies, we process personal data based on contract performance, legitimate interests, consent where required, and compliance with legal obligations.Depending on your location and role, you may have rights to access, correct, delete, restrict or export personal data. You can contact info@zcntech.com to request assistance.Subprocessors and infrastructureZ-Mask may use infrastructure, authentication, storage, email, analytics, payment and security providers to operate the service. These providers are used only for service delivery and administration.For enterprise or private cloud deployments, infrastructure location and subprocessors can be handled under a separate agreement.SecurityBrowser access uses HTTPS. PDF copies are encrypted before transfer to archive storage, and document retrieval requires a server-side access check. The archive transfer channel currently uses FTP rather than TLS, so transport protection does not extend to that channel or its login credentials. No online service can guarantee absolute security. Contact us to discuss deployment-specific safeguards before processing highly sensitive material.This public page is provided for transparency and Google OAuth application review. Enterprise customers may request a signed Data Processing Agreement and deployment-specific security terms.