PZZS Privacy Policy

Last updated: October 25, 2026

1. Information We Collect

• Account information: email address, password (stored as an argon2id hash we cannot reverse), two-factor configuration;
• Google sign-in (only if you use it): your Google account identifier and email address — see Section 4;
• Billing information: name, billing address, phone (for invoicing);
• Usage and log data: sign-in IPs and times, audit logs, instance resource usage and traffic statistics;
• Payment information: handled by third-party processors — we never store your card numbers; for cryptocurrency payments we record only on-chain transaction data;
• Communications: ticket content, attachments, and email correspondence.

2. How We Use It

We use this information to provide and maintain the Service, bill and issue invoices, verify identity and secure accounts, prevent fraud and abuse (including referral risk controls), comply with legal obligations, and send you service notifications. We do not sell your personal information and do not use it for third-party advertising.

You can turn off billing, service and support emails under Account → Email notifications or with the unsubscribe link at the bottom of each email. Some notices are always sent by email because they concern your account, your money or the continuity of your services — for example renewal reminders and low-balance warnings, bills and charges, failed payments, suspension and deletion warnings, abuse notices, security alerts and legal notices. In-app notifications are always kept.

3. Sharing

We share only what is necessary, in these cases: (a) service providers (sub-processors), including email delivery, CDN and human verification, third-party sign-in (Google OAuth, only if you use it), and payment processors; (b) as required by law, court order, or lawful government request; (c) as necessary to protect the rights, property, or safety of us or others (including abuse investigations).

4. Google Sign-In and Google User Data

Signing in with Google is optional. If you use it, PZZS requests only Google's basic openid and email permissions. We do not request access to your Gmail, Google Drive, contacts, calendar or any other Google service, and we never see your Google password.

• What we receive: your Google account identifier, your email address, and whether Google has verified that email address. We do not receive your name or profile photo.
• How we use it: only to sign you in; to create your PZZS account if you are new, after you accept our terms; and to connect Google sign-in to your existing PZZS account when the verified email addresses match or when you link it under Account. The email address becomes your account email and is used as described in this policy.
• What we store: your Google account identifier, kept on your PZZS account. The access token issued by Google is used once to read the information above and is then discarded; we do not request offline access and keep no Google tokens.
• Sharing: we do not sell Google user data or use it for advertising. We do not transfer it to anyone except the service providers that help us run the Service (such as email delivery for your account email) and where required by law. We do not use Google user data to develop, improve or train artificial intelligence or machine learning models.
• Retention and deletion: the Google account identifier is kept while your PZZS account exists and is erased when you delete your account (Account → Delete account). You can remove PZZS's access at any time at myaccount.google.com/permissions; to have Google sign-in disconnected from your PZZS account without deleting it, contact legal@pzzs.com.

PZZS's use and transfer of information received from Google APIs adheres to the Google API Services User Data Policy, including the Limited Use requirements.

5. Cookies and Local Storage

We use browser local storage for your session tokens and interface preferences. We do not use third-party tracking cookies.

6. Data Retention

We keep personal information only as long as needed for the purposes above. Specifically:

• Account and billing records (orders, invoices, payments and wallet transactions) are retained after account closure for as long as tax and legal requirements demand;
• Instance data is unrecoverable once an instance is destroyed;
• Sign-in records: session records (IP address and browser) are deleted 90 days after the session ends; devices remembered for sign-in verification are forgotten after 12 months without use; revoked or expired API tokens are deleted after 90 days;
• Notifications and audit logs (including records of staff access to your information) are kept for 12 months; other operational logs are rotated automatically and kept no longer than 12 months. Records of your acceptance of these policies and of account closure are kept for as long as needed to establish, exercise or defend legal claims;
• Ticket attachments are stored encrypted and kept with the ticket; you can delete your own attachments from the ticket at any time. Files uploaded but never sent with a ticket are deleted after 24 hours;
• Identity verification (KYC) documents are kept for 90 days after the review is completed (approved or rejected), or after the verification request is closed, and are then deleted automatically; they cannot be deleted earlier (including on account closure), and only the verification result is kept on your account after that;
• Abuse reports: the reporter's email address and the IP address the report was submitted from are deleted 12 months after the case is closed; the case record and how it was handled are kept;
• Backups: our encrypted system backups are kept for up to 30 days, so deleted information may remain in them until they expire.

7. Your Rights

You can access and correct your account and billing information in the panel at any time. You also have the right to know what personal information we hold about you, to receive a copy of it, to have it corrected or deleted, and not to be discriminated against for exercising these rights. California residents have these rights under the CCPA/CPRA.

• Download your data: under Account → Download your data you can download a copy of your personal information at any time (a ZIP archive of JSON files together with the attachments you uploaded). For your security, passwords, two-factor secrets, server root passwords and API token values are never included.
• Delete your account: under Account → Delete account you can delete your account yourself once you have no remaining servers, unpaid orders or bills, payments in progress, or pending withdrawals. Deletion takes effect immediately: your email address, billing details, sign-in history, SSH keys, passkeys, API tokens, saved cards, notification channels, ticket messages and attachments are removed (messages and attachments in tickets about an abuse case are kept as the record of how the case was handled), you are signed out everywhere, and any remaining wallet or affiliate balance is forfeited. Your email address can then be used to sign up again.
• What we keep: records of orders, invoices, payments and wallet transactions are retained after deletion for as long as tax, accounting and other legal requirements demand; they are no longer linked to your email address. We may also keep information where necessary to prevent fraud or abuse, to resolve disputes, or to comply with a legal obligation.
• Other requests: you or your authorized agent may also contact legal@pzzs.com. We may need to verify your identity before acting on a request. We confirm receipt within 10 business days and respond within 45 days; where reasonably necessary we may extend this once by up to another 45 days and will tell you why.

8. Security

We protect your information with industry-standard measures: one-way password hashing, AES-256-GCM encryption of sensitive credentials at rest, TLS in transit, and internal access auditing. No system is perfectly secure — safeguard your credentials and enable two-factor authentication.

9. Minors

The Service is intended for users 18 or older. We do not knowingly collect personal information from minors.

10. Changes and Contact

Material changes to this policy are announced via the panel or email. For privacy questions, contact legal@pzzs.com. If you submit an abuse report, we keep your email address, the IP address you submitted it from and your report to investigate and to contact you, and we do not share them with the customer you reported. Your email address and IP address are deleted 12 months after the case is closed; if you delete your PZZS account, your email address is removed from your reports straight away.