Privacy follows purpose, consent, and restraint.

Scope

This policy applies to the public website, DecisionGraph Weekly™, authenticated DecisionGraph Intelligence Membership accounts and content, billing and entitlement administration, Team seats, and related service communications.

Information we collect

When you subscribe, we process the email address you provide and related consent, confirmation, delivery, and suppression events. Depending on the service used, ZAPHAN may also process name and organization; account, authentication, and session records; subscription, renewal, cancellation, and entitlement status; Team-seat records; provider transaction identifiers and limited billing information; service engagement; and security, device, IP, and diagnostic logs. ZAPHAN does not store full payment-card numbers.

How we use information

We use data to operate and secure the service, authenticate accounts, administer Membership and Team seats, reconcile subscriptions, deliver protected content, send transactional notices, administer the newsletter, maintain consent and cancellation evidence, measure performance, prevent abuse, troubleshoot, and comply with law. Marketing permission, Membership entitlement, and other permissions remain separate.

Providers

Supabase processes application, authentication, entitlement, and audit state; Stripe processes billing, payment, and relevant tax events; Google Workspace SMTP relay supports authentication and transactional Membership email; Beehiiv operates newsletter and marketing email; OpenAI Sites and Cloudflare provide hosting, delivery, domain security, and privacy-limited analytics.

Analytics

ZAPHAN uses Cloudflare Web Analytics to measure aggregate visits and performance without analytics cookies or fingerprinting. Cloudflare dashboard reporting is retained for the prior six months. ZAPHAN’s first-party event layer is limited to page visits, Weekly Brief reads, PDF downloads, subscription initiation/completion, and sanitized UTM source, medium, campaign, and content. URLs must not contain personal identifiers. Advertising profiling, fingerprinting, session replay, keystroke capture, and sensitive form-field collection are prohibited. First-party analytics are retained no longer than 13 months.

Cookies and security

Approved providers may use cookies or tokens necessary for security, authentication, session integrity, entitlement enforcement, preferences, fraud prevention, and service operation. Protected content uses server-side authorization; robots controls and hidden links are not treated as access controls. No internet service can guarantee absolute security.

Retention

Tax, invoice, refund, and chargeback records are normally retained seven years after the relevant tax year. Terms, Privacy, recurring-consent, entitlement, and Team-seat history are normally retained for the relationship plus six years. Account profile and support records are normally retained 24 months after the relationship. Invitations are normally retained 90 days after expiry or revocation, authentication/security logs 12 months, protected-access logs 24 months, privacy-request records six years, and backups on a rolling 35-day basis. Legal holds, disputes, incidents, provider rules, and law may override normal deletion.

Your choices and requests

Where applicable, you may request access, correction, deletion, or portability and exercise available opt-out rights. You do not need to create a new account to make a request. ZAPHAN acknowledges privacy requests within ten business days and responds within 45 days where applicable; a permitted extension includes notice. Submit requests through the privacy request page or email info@zaphanintelligence.com.

Children, international processing, and changes

The service is intended for business and professional audiences and is not directed to children under 13. Providers may process information in other jurisdictions subject to applicable safeguards. Material changes will be identified with a revised date and any notice or consent required by law.