Privacy policy

Who processes your data

Zentral is the brand; behind it there are two entities, and the one that answers to each customer depends on its billing address, as in Annex A of the Terms of Service:

• United States and Latin America other than Peru: Indrox LLC, a Delaware limited liability company, 25 Southwest 9th Street, Suite 406, Miami, FL 33130, United States.
• Peru: Intellisoft Innovation S.A.C.S. (trading as Indrox), RUC 20612414344, Calle Marcona 310, Santiago de Surco, Lima 15038, Peru.
• For the data collected on this website (demo form and cookies) the controller is Indrox LLC.
• For anything concerning your data: legal@indrox.com, or +51 952 756 376.

Two distinct scopes

On this website we act as the controller: we decide what is collected and why. The next sections describe that scope.

Inside the application it is the other way round: the data a customer company and its users submit to Zentral (“Customer Data”) belongs to that company. The company acts as controller and we act as processor, under the Data Processing Addendum (DPA) that forms part of the Terms of Service. That scope is described at the end of this policy.

What we collect on this site

Only what you type into the demo form. We do not buy lists or obtain your details from third parties.

• Required: full name, work email, phone, company, role, number of employees and what you want to fix.
• Optional: website, country and city, industry, the tools you work with today, modules of interest, timeline and how you heard about us.
• If you also book a slot, Cal.com records the date and time you chose.

What we use it for

One purpose only: preparing and running the demo you asked for, and following up on it.

• Contacting you to arrange or confirm the meeting.
• Showing up to the demo with the modules and cases you told us about, instead of a generic deck.
• Sending you the proposal or pricing we discuss on the call.

Legal basis

Your consent, given when you tick the box on the form. You can withdraw it at any time by writing to us, and we will stop contacting you at no cost to you.

Who we share it with

We do not sell or trade your data. It only passes through the providers we need for the form to work:

• Resend — delivers your request by email to our team and stores your email address for future communications from us. Servers in the United States.
• Cal.com — handles scheduling if you book a slot. It receives your name, email and what you wrote under “what do you want to fix” to pre-fill the booking.
• Vercel — hosts this site and runs the function that receives the form. It logs the technical data any web server logs.

Where it is processed

Indrox LLC is in the United States and every provider above hosts there. If you write to us from Peru, from anywhere else in Latin America or from the European Union, your data leaves your territory for the United States.

By submitting the form you accept that international transfer. It is unavoidable for the email to reach us: there is no version of this that keeps your data inside your own country.

How long we keep it

For as long as we have a commercial relationship with you, and up to two years after the last contact if that relationship does not materialise. If you ask us to delete it sooner, we do.

Cookies and tracking

We use a single measurement provider, Google, loaded through Google Tag Manager. Until you accept in the notice at the bottom it runs in denied consent mode: it sets no cookie and stores no identifier, it only counts visits in aggregate. If you accept, it switches to full measurement with cookies.

• Google Analytics 4 — which pages are visited and from where, so we know which content helps.
• Google Ads — attributing which campaign brought in a demo request.

How to change your decision

Your answer to the notice is stored in your browser’s local storage, not in a cookie. To change it, clear this site’s data from your browser settings: the notice will appear again.

If you accepted and want to reverse it, do that and also delete cookies from google.com and googletagmanager.com.

Data inside the application

Customer Data belongs to the company that holds the account. We host, store, transmit, process and display it solely to provide, secure, support and improve the Service for that company, and as instructed by it.

We do not use Customer Data to train, fine-tune or improve any machine learning or artificial intelligence model, whether our own or a third party’s.

• Export: the company can export its data at any time, in CSV or SQL format.
• Deletion: after the subscription ends we retain the data for sixty (60) days and then permanently delete it. Backups are purged on an ordinary thirty (30) day rotation cycle.
• If we become aware of a personal data breach affecting Customer Data, we notify the company without undue delay.

Where the Service is hosted

The Service is hosted in the United States (AWS, us-east-1). Files and documents are stored in Cloudflare R2, pinned to the Eastern North America region, which comprises data centres in the United States and Canada.

Our personnel located in Peru and other jurisdictions may access Customer Data for support, maintenance and incident response, subject to confidentiality obligations and the safeguards of the DPA.

Artificial intelligence

Zentral’s AI features use Google language models (Gemini API) under paid-tier terms, in which the provider commits not to use submitted content to improve its models.

Before any data is transmitted to Google, identifiers classified as restricted — national identity numbers, tax identification numbers, bank account numbers, payroll amounts and health-related data — are irreversibly removed, and other identifiers such as names, emails and phone numbers are replaced with tokens. Semantic search indexing runs on infrastructure we operate and transmits no data to third parties.

Subprocessors of the Service

These providers process Customer Data on our behalf (Annex B of the Terms of Service). We give at least thirty (30) days’ notice before adding or replacing one:

• Amazon Web Services, Inc. — cloud hosting and compute — United States (us-east-1, Northern Virginia).
• Cloudflare, Inc. (R2) — object storage of files and documents — Eastern North America.
• Google LLC (Gemini API, paid tier) — generative AI processing — United States.
• Stripe, Inc. — payment processing (Region 1) — United States.
• Culqi S.A.C. — payment processing (Region 2) — Peru.
• Sinch Sweden AB (Mailjet) — transactional email — European Union.
• Intellisoft Innovation S.A.C.S. (trading as Indrox) — support, maintenance and incident response — Peru.

Your rights

We grant you these rights wherever you live. We are not going to ask you to prove which law covers you before we act on them:

• Ask us for a copy of the data we hold about you.
• Correct anything that is wrong.
• Ask us to delete it.
• Object to us using it to contact you, or withdraw your consent.

Which law covers you

If you live in Peru, the Personal Data Protection Act (Law No. 29733) grants you the rights of access, rectification, cancellation and objection. If you live in the European Union or the United Kingdom, the GDPR applies. If you live in California, the CCPA does.

The list above covers all of them, so the procedure does not change with your country: you write to us and we act.

How to exercise them

Write to legal@indrox.com from the email address you used on the form or the one you sign in to Zentral with, and we will reply within 20 working days at most. No forms, no paperwork: an email is enough.

Changes to this policy

If we change it, we update the date in the header. Changes that affect what we use your data for will be communicated to you by email before they take effect.