ZonazoneXAUUSD-Signale
Anmelden
Registrieren

Datenschutzerklärung

Diese Seite ist derzeit nur auf Englisch verfügbar.

This page is being prepared with our legal counsel and will be published before payments open.

The effective date will be set at finalisation.

This policy explains what personal data we process when you use Zonazone, why, and your rights, in line with Indonesia's Personal Data Protection Law (Law No. 27 of 2022).

  1. Data controller

    The data controller is Zonazone, a trade name run by an individual: [operator full name], [address]. Contact for personal data matters: [email protected].

  2. Data we collect

    • Account: email, Google name and account ID if you log in with Google, language, time zone, and theme preference.
    • Sessions and security: login times, device type, and IP address and browser stored as hashes (not as is).
    • Payments: plan, amount, status, and transaction ID from Whop. Card or account data is processed by Whop and not stored by us.
    • Risk notice consent: version and time of consent.
    • Notifications: browser push subscriptions and notification preferences.
    • Affiliates (if you join): display name, payout account (encrypted), clicks and referrals with IP and browser as hashes, referral emails shown masked.
    • Visitors: anonymous daily visit counts from hashes, without cookies.

  3. Cookies and on-device storage

    • an_at and an_rt: login session cookies (httpOnly), required to sign in.
    • an_s: a marker that you are logged in, with no secret content.
    • Language cookie: remembers the last language you chose.
    • an_ref: if you open the site through an affiliate link (?ref=CODE), this cookie holds a random click ID to record which affiliate referred you. It lasts 400 days, is renewed on every visit, and can be deleted at any time in your browser settings.
    • Browser local storage: theme preference and technical session markers.

    We do not use advertising cookies or third-party trackers.

  4. Purposes and legal bases

    • Providing the service and performing our agreement with you: accounts, Signal Room access, payments, notifications, and the affiliate program.
    • Security and abuse prevention: one active session, rate limiting, affiliate fraud detection.
    • Legal obligations: transaction records and tax.
    • Your consent: push notifications and marketing emails (if any), which you can withdraw at any time.

  5. Third parties that process data

    • Whop: payment processing.
    • Google: sign-in with a Google account.
    • Transactional email provider: sign-in links and notifications.
    • Browser push services (e.g. Google, Mozilla, Apple): push notification delivery.
    • Cloudflare: DNS and network protection.
    • Hosting and backup storage providers: servers and database backups.
    • The affiliate who referred you (if you arrived through an affiliate link): sees your email in masked form, the date you joined, your number of payments, and the total you paid. No other data is shown.

    We do not sell your personal data.

  6. Transfers outside Indonesia

    Some of the providers above process data outside Indonesia. We choose providers with an equal or higher level of data protection, as required by the PDP Law.

  7. Retention

    • Account data is kept while the account is active and deleted or anonymised after it is closed, except where retention is required.
    • Transaction data and audit logs are kept for as long as tax and bookkeeping rules require.
    • Database backups are kept for at most 30 days.

  8. Your rights

    Under the PDP Law you may request access to and a copy of your data, correction of inaccurate data, deletion, withdrawal of consent, and object to certain processing. Send requests to [email protected] from your account email. We respond within the time limits set by the PDP Law.

  9. Data security

    Data is sent over HTTPS. Sessions use httpOnly cookies, IP addresses and browsers are stored as hashes, affiliate payout accounts are encrypted, and admin access requires Google sign-in with two-step verification and is recorded in an audit log.

  10. Personal data breaches

    If a personal data protection failure occurs, we notify you and the competent authority within 3 × 24 hours of becoming aware of it, as required by the PDP Law.

  11. Age of users

    The service is only for users aged 18 or older. We do not knowingly process children's data.

  12. Changes and contact

    This policy may change; material changes are announced on the site or by email. Privacy questions: [email protected].