Privacy Policy
Last updated 22 October 2026
This policy explains what personal data ZenQueue processes, why, who receives it and what rights you have. It covers the website at zen-queue.com and the ZenQueue admin app, the service businesses use to run their queues.
Who is responsible
The controller for the processing described here is:
- Name: [CONTROLLER NAME]
- Address: [CONTROLLER ADDRESS]
- Registration number: [REGISTRATION NUMBER]
- VAT ID: [VAT ID]
For any question about your data, or to use your rights, write to [email protected].
What we collect and why
When you visit zen-queue.com. Our hosting provider processes your IP address and the technical details your browser sends, such as the page requested and the browser type, to deliver the site and protect it against attacks. We do not use analytics, tracking or advertising tools, and the site sets no cookies. See the Cookie Notice for details.
When you use the contact form. We process your name, email address, optional company name and phone number, and your message to answer your request, and we send you a confirmation email. Your message is delivered to our contact address, which Cloudflare Email Routing forwards to our inbox at Google (Gmail). Before the form is sent, a bot check (Cloudflare Turnstile) processes your IP address and technical details of your browser and device to tell people from automated spam. We also keep your IP address in memory for up to one hour to limit repeated submissions. Legal basis: our legitimate interest in answering enquiries and keeping the form free of spam, or steps you ask us to take before entering into a contract (Art. 6(1)(f) and 6(1)(b) GDPR).
When you email us. Email you send to [email protected] or [email protected] is forwarded by Cloudflare Email Routing to our inbox at Google (Gmail), where we read and answer it. Legal basis: our legitimate interest in answering you (Art. 6(1)(f) GDPR) and, when you use your data protection rights, our legal duty to answer (Art. 6(1)(c) GDPR).
When you have an account in the admin app. We are the controller of your login and account data: your name, email address, phone number, postal address and preferred language, and your sign-in identity (email address, password and login session), which our login provider handles. Legal basis: performance of our contract with you or the business you represent (Art. 6(1)(b) GDPR), or, if a business invited you as its employee, our legitimate interest in providing the service that business uses (Art. 6(1)(f) GDPR), and our legitimate interest in keeping accounts secure (Art. 6(1)(f) GDPR). The business you work for is the controller of its work data about you in the service, such as your roles, the locations you work at and the schedules it sets; we process that data on its behalf as its processor, under the data processing terms in our Terms of Service. For requests about that data, please contact the business; we help it answer.
When a business subscribes. Billing details (business name, billing contact, address and payment method) are collected and processed by our payment provider, Stripe. We do not see or store full card numbers. Legal basis: performance of the contract (Art. 6(1)(b) GDPR) and our legal duty to keep accounting records (Art. 6(1)(c) GDPR).
Service emails. We send emails that the service needs, such as an invitation when you are added as an employee, and the sign-in emails of our login provider, such as email verification and password reset. They are sent from [email protected] through our email provider, Resend. We do not send newsletters or marketing emails.
People who join a business’s queue. When someone joins the queue of a business that uses ZenQueue, we process their first name, a device identifier and the times they joined and were served. We do this on behalf of that business, which decides why and how this data is used. The business is the controller for that data and we are its processor. If you joined a queue, please contact the business directly; we help it answer your request.
We do not sell personal data, and we do not make decisions about you based solely on automated processing.
Who receives your data
We use the following service providers (processors). Each one processes personal data only on our instructions and under a data processing agreement.
| Processor | Purpose | Data | Location | Safeguard |
|---|---|---|---|---|
| Auth0 (Okta) | Sign-in and account security for the admin app | Email address, password, login sessions | European Union | EU region; Standard Contractual Clauses for any access from outside the EU |
| Stripe | Subscription billing and payments | Business billing details, payment method, billing contact | European Union and United States | Standard Contractual Clauses and the EU-US Data Privacy Framework |
| Resend | Sending service emails, sign-in emails and contact form emails | Name, email address, email content | United States | Standard Contractual Clauses |
| Railway | Hosting of the ZenQueue API, its database and its logs | Account, business, location and queue data, all other data the API processes, IP addresses in logs | European Union | EU region; Standard Contractual Clauses for any access from outside the EU |
| Cloudflare | Website hosting and delivery, DNS, contact form handling, bot protection (Turnstile) and forwarding email sent to our contact and privacy addresses (Email Routing) | IP address, browser and device details, contact form content, email you send us | Global network, including the European Union and United States | Standard Contractual Clauses and the EU-US Data Privacy Framework |
| Google (Gmail) | Receiving contact form messages and email sent to our contact and privacy addresses, and nothing else | Name, email address, company name, phone number, message and email content | Global, including the European Union and United States | Standard Contractual Clauses and the EU-US Data Privacy Framework |
| Amazon Web Services | Previous hosting of the ZenQueue API, being retired | All data the API processes, IP addresses in logs | European Union (Paris) | EU region; Standard Contractual Clauses for any access from outside the EU |
We may also disclose personal data where the law requires it, for example to a court or public authority.
How long we keep it
- Account data is kept while the account exists. When a business account is deleted, it is deactivated, and a Grand Administrator can restore it within 30 days by logging in to the ZenQueue admin app and choosing “Restore business”. After that it stays stored until it is permanently deleted, which you can ask for at any time by writing to [email protected].
- Contact form messages and email you send us are kept as long as we need them to handle your request and any follow-up.
- Billing records are kept as long as tax and accounting law requires.
- Queue data is kept on behalf of the business while its account exists, unless the business deletes it earlier.
- IP addresses used to limit contact form submissions are kept in memory for up to one hour.
Your rights
Under the GDPR you have the right to:
- access the personal data we hold about you (Art. 15);
- have inaccurate data corrected (Art. 16);
- have your data erased (Art. 17);
- restrict how we process it (Art. 18);
- receive your data in a portable format (Art. 20);
- object to processing based on our legitimate interests (Art. 21).
To use these rights, write to [email protected]. We answer within one month.
You also have the right to lodge a complaint with a data protection supervisory authority, in particular in the EU country where you live, work or where you think the infringement took place (Art. 77).
Transfers outside the EU
Our main systems run in the European Union. Where a provider may access or process data outside the EU, the transfer is protected by the European Commission’s Standard Contractual Clauses or, for certified providers, the EU-US Data Privacy Framework.
Security
We protect personal data with encryption in transit, access limited to the people who need it, and providers that maintain recognised security certifications.
Children
ZenQueue is a service for businesses and is not directed at children under 16.
Changes to this policy
When we change this policy, we publish the new version on this page and update the date at the top. If a change materially affects how we use your data, we tell account holders by email before it takes effect.