Privacy policy.

Who is responsible

The site owner is responsible for the publication. Privacy questions can be sent to hello@zunvo.example.

What we collect

• Public browsing: no account is required. We do not set advertising or analytics cookies on public pages, and we do not build a visitor profile.
• Outbound click records: when someone uses a marketplace link, the server may record the product ID, marketplace key, collection or category context, a timestamp, and a coarse bot flag. It does not record an IP address, a full user agent, or any cookie identifier.
• Security rate limiting: login, search suggestions and outbound redirects are rate-limited. To do this, the server derives a short-lived keyed hash from a request IP or email address. These counters expire automatically and are not used for profiling or marketing.
• Administration: the private admin area uses a server-side session. The browser receives a random session token in an HTTP-only cookie; the database stores only a hash of that token. Session records contain the linked user ID and timestamps, not browsing activity.
• Email: if you write to the contact address, your message and email address are used to reply. Do not send sensitive information you would not want retained in an inbox.

What we deliberately do not collect

We do not collect payment details, postal addresses, phone numbers, precise location or marketplace account credentials. We do not sell personal data. We do not run retargeting pixels or advertising identifiers in this build.

Service providers

The site may rely on a hosting provider for server logs and delivery, a MongoDB provider for catalogue and session storage, and an image host such as Cloudinary for editorial uploads. Those providers process data under their own terms. When you follow an affiliate link, the marketplace receives the request from your browser and may set its own cookies; its privacy policy applies from that point.

Retention

Admin sessions expire on a short idle timeout and a fixed absolute lifetime, and expired sessions are purged. Rate-limit counters expire automatically. Outbound click records are retained only as aggregate counts for editorial reporting; they contain no visitor identifier. Contact emails are retained as long as needed to handle the enquiry.

Your choices

Because the public site does not maintain visitor accounts or profiles, there is usually no personal record to access or delete. You can ask about any message you have sent, request its deletion, or object to how the site handles your data by writing to the contact address. You can also block cookies in your browser; the public catalogue does not depend on them.

Children

The site is intended for a general audience and does not knowingly collect personal information from children. If you believe a child has sent personal information by email, contact us and we will remove it.

Changes

If the data handling changes — for example, if account features or analytics are added — this page will be updated and the date above will change. Material changes should be highlighted on the homepage.