Back to Zarla

Privacy Policy

Last updated: August 29, 2026

Zarla Inc., of 2093 Philadelphia Pike #1260, Claymont, DE 19703, United States, is committed to protecting and respecting your privacy.

This Privacy Policy (“Policy”) describes and governs the information-collection, use, and sharing practices of Zarla and its corporate affiliates, subsidiaries, and divisions (collectively, “Zarla,” “we,” “us,” and “our”) with respect to our website, our web application, and the other services that link to this Policy (together, the “Services”). Zarla is the AI website builder and bundled small-business toolkit — website generation and editing, custom-domain publishing, and tools including a CRM and lead inbox, bookings, invoicing and payments, forms, SEO tools, social feeds, and a blog.

Before you submit any information through the Services, please review this Policy together with our Terms of Use. This Policy applies only to information collected through the Services and not to information you may provide to any third-party sites we link to, except as expressly provided here. For the purposes of data-protection laws applicable to you (“Applicable Law”), Zarla is the “data controller” for the information you provide through the Services.

1. Information We Collect

We collect information in a few ways: when you provide it directly, when we collect it automatically as you use the Services, and — in limited cases — from third parties.

A. Information you provide directly

We may collect information from you when you:

  • Register for an account or sign in;
  • Create or edit a website or use one of the bundled tools;
  • Fill in a form, complete a survey, or provide feedback;
  • Subscribe to a paid plan or place an order;
  • Communicate with us by email or through support; or
  • Post content to your site or through the Services.

The information you provide may include your name, email address, business name and contact details, phone number, the content and business information you enter to generate or edit your site, and your account credentials. If you subscribe to a paid plan, our payment processor (Stripe) collects the payment information needed to process your transaction. Zarla does not collect, store, or maintain your full card details; that information is handled by Stripe under its own terms and privacy policy. Where you use Zarla to take payments from your own customers through Stripe Connect, those customer payments are likewise processed by Stripe.

You are not obligated to provide us with your information, but if you do not, we may be unable to provide the Services you request.

B. Information collected automatically

When you access the Services, we may automatically collect certain information about your device and usage, such as your IP address, general (city or region level) location derived from it, device and browser type, operating system, referring and exit pages, the pages and features you view, the dates and times of your visits, and error logs. We use this information to operate, secure, analyze, and improve the Services. We collect it using server logs and cookies and similar technologies, as described in the “Cookies and Analytics” section below.

C. Information from third parties

If you sign in through a third-party login (for example, Google OAuth), we receive basic profile information from that provider, such as your name and email address, to create and authenticate your account. If you connect a third-party service to a Zarla feature — for example, Google Calendar for bookings, Google Business Profile or Google Search Console for SEO tools, or an Instagram feed — we receive the information from that service that is necessary to provide the feature you enabled.

2. How We Use Your Information

We may use your information to:

  • Provide, operate, maintain, and secure the Services;
  • Generate, edit, host, and publish your website and power the bundled tools you use;
  • Process your subscription and, where applicable, payments you take from your own customers;
  • Send you service-related communications, such as account, billing, security, and usage notifications;
  • With your consent where required, send you product updates and marketing communications, and SMS notifications you have opted into;
  • Respond to your inquiries and provide customer support;
  • Analyze usage to understand and improve the Services — including analyzing AI editing requests in categorized form (for example, noting that a request asked for a feature we don't support yet, without storing the text of your message) to decide what to build next;
  • Detect, prevent, and address fraud, abuse, security incidents, and violations of our Terms; and
  • Comply with our legal obligations and enforce our agreements.

We may aggregate or de-identify information and use it for any purpose. We do not use sensitive personal information for any purpose other than providing the Services you request, and we will seek your explicit consent where required by law.

3. How We Disclose Your Information

We may disclose your information in the following circumstances:

  • With your consent. We may disclose information to third parties when you direct or permit us to.
  • Service providers (sub-processors). We share information with the vendors that help us run the Services, listed below. They are permitted to process information only to provide services to Zarla and are contractually bound to protect it.
  • Legal and safety. We may access, preserve, and disclose information where we reasonably believe it is necessary to comply with law or legal process, enforce our Terms, respond to claims, or protect the rights, property, or safety of Zarla, our users, or the public.
  • Business transfers. If Zarla is involved in a merger, acquisition, financing, or sale of assets, your information may be among the transferred assets.

Sub-processors

We rely on the following categories of sub-processors to operate the Services. Each processes only the information needed for its function:

  • Hosting and infrastructure: Vercel (application hosting); Google Cloud Platform (published-site serving, storage, and CDN); Supabase (database, authentication, and file storage); Cloudflare (DNS); Upstash (rate limiting).
  • Payments: Stripe (subscription billing and, through Stripe Connect, payments you take from your own customers).
  • Artificial intelligence: Anthropic (Claude) and OpenAI for text and site generation; image-generation providers including Ideogram and Recraft.
  • Email: Postmark (transactional and marketing email).
  • SMS: an SMS delivery provider, used to send notifications you have opted into.
  • Google APIs: Google OAuth (sign-in), Google Calendar (bookings sync), Google Maps and Places and Google Fonts (site features), and Google Business Profile and Google Search Console (SEO features).
  • Domains: our domain registrar (OpenSRS / Tucows).
  • Social: Behold (Instagram feed embeds).

4. Legal Bases for Processing (GDPR)

Where the GDPR or similar laws apply, our legal grounds for processing your personal data are:

  • Performance of a contract — to provide the Services you have signed up for, or to take steps at your request before entering a contract.
  • Legitimate interests — for activities such as customer support, securing and improving the Services, and preventing fraud, where not overridden by your rights.
  • Legal compliance — where we must process data to meet a legal obligation.
  • Consent — where required, for example for certain marketing or SMS communications. You may withdraw consent at any time.

5. Cookies and Analytics

We use cookies and similar technologies for two main purposes: essential cookies that are necessary to operate the Services (for example, to keep you signed in and to secure your session), and analytics to understand how the Services are used so we can improve them. Our analytics are product-focused — we look at usage patterns, not cross-site advertising profiles. Zarla does not run a third-party advertising network on the Services and does not use your data to serve you interest-based ads across the web.

For analytics on our website, we use a first-party visitor identifier stored in your browser. If you create an account, we link that identifier to your account — along with the record of the pages you visited on our website, including before you signed up — so we can understand which of our pages help people find Zarla. If you later delete your account, we remove that link — the analytics records are kept only in de-identified form and are no longer connected to your account. You can remove the identifier at any time by clearing your browser's site data. We do not store your IP address in these analytics records.

You can control cookies through your browser settings, including blocking or deleting them, though some parts of the Services may not function properly without essential cookies. Because there is no consensus standard for “Do Not Track” browser signals, we do not currently respond to them.

6. Your Rights and Choices

You can review and update much of your account information directly in the Services. Depending on your location, you may also have the right to:

  • Access the personal data we hold about you;
  • Correct inaccurate or incomplete data;
  • Request deletion of your data;
  • Object to or restrict certain processing;
  • Port your data to another provider; and
  • Withdraw consent where processing is based on consent.

You can opt out of marketing emails at any time using the unsubscribe link in our emails, and opt out of SMS notifications by following the instructions in the message or in your account settings. Note that you may not opt out of essential service communications (such as billing and security notices) while you maintain an active account. To exercise any of these rights, contact us at hello@zarla.com. We may ask you to verify your identity before responding, and we will respond within the timeframe required by Applicable Law. Many of these rights are subject to limitations and exceptions under applicable law.

7. California Privacy Rights (CCPA / CPRA)

If you are a California resident, the California Consumer Privacy Act, as amended by the California Privacy Rights Act, gives you the right to:

  • Know what personal information we collect, use, and disclose about you;
  • Delete personal information we have collected from you, subject to certain exceptions;
  • Correct inaccurate personal information; and
  • Opt out of the sale or sharing of personal information.

Zarla does not sell your personal information, and we do not share it for cross-context behavioral advertising. We will not discriminate against you for exercising any of these rights. To make a request, contact us at hello@zarla.com. You may use an authorized agent to submit a request on your behalf, subject to verification.

8. Data Retention

We keep your information only for as long as is reasonably necessary for the purposes for which it was collected, taking into account our legal obligations. If you terminate your account, we will delete or de-identify your personal data within a reasonable period, except where we are required to retain it to comply with legal obligations, resolve disputes, or enforce our agreements. Residual copies may persist in backups for a limited time.

We keep analytics records of how you use our website and our web application for a maximum of 13 months from collection, after which they are deleted or de-identified.

9. Security

We maintain administrative, technical, and physical safeguards designed to protect your information against loss, misuse, and unauthorized access, disclosure, or alteration. Information is transmitted over encrypted connections using TLS. No method of transmission or storage is completely secure, however, so we cannot guarantee absolute security. You are responsible for keeping your account credentials confidential; please notify us immediately at hello@zarla.com if you believe your account has been compromised.

10. International Data Transfers

The Services are operated in the United States, and our primary database and file storage are located in the United States (Supabase, US region). If you access the Services from outside the United States, your information will be transferred to, and processed in, the United States and other locations that may not offer the same level of data protection as your home jurisdiction.

Where we transfer personal data out of the European Economic Area, the United Kingdom, or Switzerland, we rely on appropriate safeguards, including the EU-U.S. Data Privacy Framework (together with the UK Extension and the Swiss-U.S. Data Privacy Framework), where applicable, and the European Commission’s Standard Contractual Clauses. You may request more information about these safeguards by contacting us as described below.

11. Children

The Services are not directed to, and may not be used by, anyone under the age of 16, consistent with the age requirement in our Terms of Use. We do not knowingly collect personal information from children under 16. If you believe we have collected information from a child under 16, please contact us and we will take reasonable steps to delete it.

12. Changes to This Policy

We may update this Policy from time to time to reflect changes in the law, our practices, or the Services. When we make material changes, we will update the “Last updated” date above and, where appropriate, provide additional notice. Your continued use of the Services after an update takes effect constitutes your acceptance of the revised Policy.

13. Contact Us

If you have any questions about this Policy, wish to exercise your rights, or have any other privacy-related inquiry, contact us at:

Zarla Inc.
2093 Philadelphia Pike #1260, Claymont, DE 19703, United States
hello@zarla.com