Privacy Policy

This policy explains what personal data XKC Trading FZ-LLC handles, why, and what you can ask us to do about it. Clause 3 of the Terms of Service explains how the five Zenk documents fit together.

---

0. Which privacy laws this policy is built on

This policy is built on the Personal Data Protection Law of the United Arab Emirates, because XKC Trading FZ-LLC is a UAE company.

Where other privacy laws apply to you as a matter of mandatory law — for example the privacy law of the country, state or province where you live — we address the requirements those laws impose on us.

We do not claim that every privacy law in the world applies to Zenk. Which laws attach depends on where we operate and who we serve, not on preference.

1. Who controls your data

The controller of your personal data is XKC Trading FZ-LLC, a company registered with RAKEZ (the Ras Al Khaimah Economic Zone) in Ras Al Khaimah, United Arab Emirates.

Our address is:

XKC Trading FZ-LLC FDCW1185, Compass Building, Al Shohada Road, Al Hamra Industrial Zone-FZ, Ras Al Khaimah, United Arab Emirates

You can reach us about anything in this policy at support@zenktrading.com.

Privacy Officer. Our Privacy Officer is responsible for how we handle personal data. You can contact the Privacy Officer at support@zenktrading.com.

2. What this policy covers

This policy covers the Zenk website and your Zenk account, and it covers the two Zenk products — Zenk Risk and Zenk Guard — which are Windows plugin components that run inside ATAS on your own computer.

It also covers Zenk Updater, the Windows tool that installs and updates them (clause 9A).

It also covers the Calendar, Daily Journal and Weekly Review (together, the Journal), which run on the Zenk website and are included in Zenk Complete.

3. Account information

When you buy a subscription, we create an account. The account record holds:

• an internal customer id;
• your authentication user id;
• your email address;
• your payment-processor customer id; and
• the date the record was created.

You do not need an account to browse the public website, and browsing collects no account data.

4. Subscription and billing records

Alongside your account we hold records of the subscription itself:

• the payment-processor subscription and price identifiers;
• the subscription status as the payment processor reports it; and
• the cancellation, cancelled, ended and current-period-end timestamps.

These are commercial records of your subscription.

5. Payment information

Your payments are processed by Stripe. Our website has no field that takes your full card number or card security code. If you enter or update those details, you do so on Stripe's checkout or billing page, not on our website.

Stripe may include limited card details in payment information available to us, such as the card brand, last four digits and expiry date. We use the payment information Stripe sends us to keep your subscription and your access up to date.

We can see the same limited card details in our account with Stripe.

At checkout, Stripe collects your full billing address and keeps it in its own records, where we can also see it in our account with Stripe. Zenk's own database stores only the country and, where there is one, the state or province from that address. We use them to work out where sales taxes apply and which taxes apply to your purchase.

Our own records include Stripe identifiers for your customer record, subscription, price, checkout session, payment, invoice, refund and related Stripe events. Clause 4 describes the subscription records.

Stripe handles your card details under its own privacy policy. Clause 15A lists Stripe among the providers that process data for us, and clause 11 of the Terms of Service explains how payments are processed.

If a card refund fails. If a refund cannot be completed through the original payment method (clause 6A of the Refund Policy), we ask you by email for the details needed to pay it by bank transfer to an account in your name. These include the account holder's name and the account and bank details our bank needs, which may include your address. We may also ask for a document from your bank showing that the account is in your name. We never ask you to send card details by email. We use the information to verify your refund request and payment destination, make the transfer, and keep evidence of the payment, including for disputes. Our bank, any intermediary banks and your bank receive the information needed to process the transfer; clause 15B describes the possible international transfers. We keep a copy of the bank details, related correspondence and transfer evidence with our payment records under clause 16.

6. Licensing and activation records

To operate your licence we hold records mirrored from our external licensing service:

• the licensing service's licence and machine identifiers;
• the set of product entitlements your licence carries;
• the licence status as mirrored from that service;
• the provisioning state of your licence; and
• synchronisation, issue and expiry timestamps.

A hashed composite device fingerprint is used to activate your licence on a computer. Clause 7 covers that.

The rules about activation, computers and transfers are in clauses 5 to 7 of the Software Licence Agreement. This clause describes the records, not the rules.

7. How your computer is identified

To activate your licence on a computer, Zenk Risk and Zenk Guard create a device fingerprint. The fingerprint is one SHA-256 hash made from three values that Windows keeps on your computer:

• the Windows machine identifier (MachineGuid);
• the computer manufacturer's name, as the computer's BIOS reports it (SystemManufacturer); and
• the computer's model name, as the computer's BIOS reports it (SystemProductName).

Only the hash leaves your computer. It is sent to our licensing service, Keygen Cloud (clause 15A), when you activate your licence and when the Software checks it. The three values themselves are never sent and are never written to a log. The fingerprint does not use your network card (MAC) address, a disk serial number, your IP address or your Windows user name.

As with any internet connection, the licensing service sees the IP address your computer connects from. The Software does not send it as data.

Clause 8 of the Software Licence Agreement states how the fingerprint is used to activate your licence.

8. Records of what you agreed to

When you accept the five Zenk documents at checkout, we record that acceptance. The record holds:

• a pre-checkout identifier and your customer id;
• the time of acceptance;
• the version of every document you were shown and accepted;
• the country of residence you selected at checkout;
• the plan you chose and the monthly price shown in the box;
• that you confirmed you live in the country you selected;
• where the acceptance came from; and
• audit references for the checkout session and the confirming webhook.

We keep these records because they are the evidence of what you agreed to and when.

If we ask you to show where you live (clause 4A of the Terms of Service), we keep what you send us and the result of our check for the period clause 16 states for payment records. Send only what we ask for: you may hide anything on a document that we do not need.

Clause 7 of the Terms of Service explains how a subscription is formed and how acceptance is taken.

9. Website logs and technical data

The Zenk website application deliberately stores no visitor IP address. Our own code does not read or record the IP address of any request. When enabled, the website analytics described in clause 12 records no visitor IP address in our application.

The login, account, checkout, download, Zenk Updater and Journal features run on our servers and write technical log lines about what happened — fixed codes, outcomes and technical identifiers, some of which, such as payment-processor identifiers, we can link to your account. Those log lines are written to our hosting provider's logs.

Our hosting provider keeps those log lines for 30 days.

Three things follow, and we state them rather than leave them out:

• The website is served through our hosting provider, and that provider necessarily receives the IP address of each request at the infrastructure layer. That is how serving a website works. It is not something Zenk collects into its own records.
• Email you send to our support address is received and stored by our business-email provider.
• If you call our telephone number, our telephone provider receives the number you call from, the time and length of the call and any message you leave, and delivers the message to our business email.

This is not a promise that no IP address is ever processed anywhere. It is a description of what the Zenk application itself does.

9A. Zenk Updater and support

When Zenk Updater signs in, checks which products your subscription includes, or downloads a product, our servers keep a record of the request: your account, the time, what was requested, the products concerned and the outcome. This record never contains your sign-in codes, tokens or download links. We use these records to run the service, to investigate problems and to protect your account. Product files are delivered through short-lived download links from our storage provider (clause 15A), which keeps its own access logs of those requests, including the link used. As with any internet connection, our hosting provider and our storage provider see the IP address your computer connects from. We also keep a record of each computer signed in to Zenk Updater: when it was signed in and last used, when its sign-in ends, and, if it was signed out or removed, when and why. Your Zenk account lists these computers, and you can remove one there.

Zenk Updater can produce a diagnostic report for support. It never sends the report itself: you choose whether to copy it into an email to us. The report describes your Zenk installation - versions, the Zenk files and folders it manages and their fingerprints, and the Updater's recent activity. It does not contain your trading data, your product settings or your licence key. Folder paths in it can, in some cases, include your Windows user name or the name of a network server. Like any support email, it is kept by our business-email provider (clause 9). Clause 16 explains how long we keep data.

If support authorises a recovery step on your computer, our servers keep a record of it: your account, the step and its details, the Zenk Updater version and a SHA-256 fingerprint of its program file, a SHA-256 fingerprint of the installation's state supplied by Zenk Updater, the identifiers of the authorisation and of the request that used it, and when it was created, revealed, used, ended or due to expire. Zenk displays the one-time support code in your Zenk account and does not send it by email. Our servers store a SHA-256 digest of the code, never the code itself.

10. Trading data

Zenk Risk and Zenk Guard run on your own computer. They do not send your trading data - prices, orders, positions, P&L, account numbers or your limits - to Zenk or to anyone else.

Zenk Risk and Zenk Guard make one internet connection: to our licensing service, Keygen Cloud (clause 15A), to activate your licence and to check it. What Zenk Risk and Zenk Guard send is your licence key, the device fingerprint described in clause 7, technical identifiers of your licence and its activation, and a request counter. Clause 7 also explains what the licensing service sees when your computer connects. Zenk Updater, which installs and updates them, connects to our servers and our storage provider as clause 9A describes.

The products also keep files on your own computer. They hold your settings, account balance, daily P&L, trade and loss counts, position state, the state of your stop and target orders, cost information, limits and order identifiers, and a licence file that Windows encrypts for your Windows user account. These files stay on your computer and are not sent to us.

The products also write logs on your own computer. Zenk Risk writes its log lines into the log of ATAS, the trading platform it runs in; they include order details such as order identifiers and prices. Zenk Guard keeps its own log files, which include fills (order identifier, price and volume) and records of limit breaches and of positions it closed. The logs do not contain your licence key or your device fingerprint. The products do not send them to us.

If you use "Report a problem", the product writes a report file on your computer and sends nothing. You decide whether to email that file to us.

10A. Journal data

The Journal holds what you put into it:

• the trades you import from a file you export from ATAS: the account name as ATAS exported it, the instrument, the direction, the times, the prices, the volume and the P&L;
• for each import: the name of the file, the time zone you confirmed, when you imported it, and how many rows were imported or skipped;
• what you write: your rating of a day, your reflections and notes, the tags you create, and a video link if you add one; and
• the screenshots you upload.

We do not keep the import file itself. We do not open a video link you add.

Your notes and your screenshots hold whatever you choose to put in them.

11. Error monitoring

We use Sentry for server-side error monitoring.

Monitoring events may contain technical event and audit identifiers, fixed error and status codes, and limited operational metadata. We can link these identifiers back to your account records when we investigate an incident. We do not include customer names, email addresses, card details, request bodies, headers or raw IP addresses in the monitoring event payload.

Sentry may derive approximate geographic information from the network connection used to transmit an event.

12. Analytics

When enabled, we use Vercel Web Analytics to count visits to the Zenk website. It tells us how many people visit, which pages they view, which website or search engine brought them, which country they are in, and which kind of device, browser and operating system they use. When enabled, we also count a few actions: a click on Get Zenk, the start of a checkout, and a completed purchase together with the plan chosen. We use these counts to understand how the website is used and to improve it.

It sets no cookies and uses no browser storage. We do not see who you are: it records no name, no email address and no IP address, and we see only aggregated counts. To tell one visit from the next on the same day, Vercel forms a hash from the incoming request; that hash is discarded after 24 hours, so visits are not linked across days or across websites.

You can refuse. If your browser sends a Do Not Track or Global Privacy Control signal, our browser-side analytics does not record your visit or your actions on the website. Completed purchases may still be counted anonymously from our server, without identifying you in the analytics event.

Vercel processes this data for us (clause 15A). What our hosting provider necessarily receives at the network layer is described in clause 9. If this changes, we will update this policy as described in clause 23.

13. Cookies and browser storage

The public pages of the Zenk website set no cookies, and the application uses no browser storage — no localStorage, sessionStorage or indexedDB anywhere in it. The fonts it uses are served from our own site rather than fetched from a third party.

When you ask for a login link and when you log in, our login system sets cookies that keep you signed in to your account. They are used only for that.

We do not use cookies or browser storage for advertising, and we do not use them to build a profile of you.

Whether a consent banner is required follows from the privacy laws that apply to you under clause 0, not from any provider's description of its own product.

14. Why we use your data

We use your data to:

• create and operate your Zenk account;
• check whether Zenk is available in your country of residence, and check that the country you gave is true where we have reason to doubt it (clause 4A of the Terms of Service);
• take and record payment for your subscription, make refunds, and manage renewal and cancellation;
• calculate and account for applicable tax;
• issue, activate, validate and maintain your licence, and provide your downloads;
• keep your Journal and show it to you, if your plan includes it;
• send you transactional email about your account, subscription and licence;
• provide Support when you contact us;
• keep the records we are legally required to keep, including accounting, tax and acceptance records;
• understand how the website is used and improve it, from the aggregated visit counts described in clause 12;
• prevent and investigate fraud and misuse;
• establish, exercise or defend legal claims, including payment disputes.

The legal grounds we rely on are those that the privacy laws identified in clause 0 provide for these purposes.

15A. Who processes data for us

We use the following providers for the roles listed.

ATAS is the third-party platform the Zenk products run inside. We do not own or control it.

If a provider or its role changes, we will update this policy as described in clause 23.

15B. Where your data is processed

Zenk is based in the United Arab Emirates. The providers listed in clause 15A process personal data in the countries described below. Depending on where you live, your data may be processed outside your country.

For a refund by bank transfer (clause 5), our bank, any intermediary bank on the route and your bank receive your bank details in the countries where they operate.

16. How long we keep your data

We keep each category of data only as long as it is needed for the purpose it was collected for, and then delete it.

Your account and your Journal. While you have access to the Journal, what is in it stays until you remove it. If your access to the Journal ends, we keep your Journal locked so that it is there if you come back, while retaining it remains necessary for that purpose. When your account is deleted (clause 17), your Journal and the other data listed there are deleted.

Payment, tax and contract records. Records of your subscription, payments, refunds, invoices and tax, your acceptance of our terms, and payment disputes are kept for seven years after the end of the tax year they relate to, the period UAE tax law requires for tax records, and longer while a tax audit, a dispute, a refund claim or a legal claim concerning them is open. We then delete them.

Records that stop a payment being processed twice. With those records we keep the payment reference numbers that stop the same payment, refund or purchase from being processed a second time. They are kept exactly as long as the records they protect, and deleted with them.

Chargebacks. If a payment was reversed through your bank, a record of that stays with your payment records for the same period and is linked to the email address of your account.

Support emails. We keep the emails you send to Support, at help@zenktrading.com or support@zenktrading.com, the voicemail messages our telephone provider delivers to us, and our replies, for five years after the last message in the conversation, meeting the UAE commercial-law minimum of five years from each message, unless a longer period is required by law or needed for a specific unresolved legal claim or dispute. We delete them when that period ends. The records of your payments, refunds and invoices are kept as stated above for payment records.

Zenk Updater. Updater codes and sign-in sessions are deleted 30 days after they expire. The records of a computer signed in to Zenk Updater are deleted 30 days after that computer's sign-in has ended, or when you delete your account. The records of your Updater activity described in clause 9A are kept for 12 months.

Backups and our providers. Our database provider keeps daily backups for 7 days, so deleted data can remain in a backup until it ages out; backups are used only to restore the service. Our providers keep their own records for their own periods: Stripe keeps payment records as financial law requires it, our email provider keeps sending records for 30 days, our error monitoring keeps events for 30 days, and our telephone provider keeps voicemail recordings and transcripts for the period its own terms set (clause 15A). Our hosting log retention is in clause 9 and the 24-hour analytics hash in clause 12.

We will not publish a number we cannot honour.

17. Deleting your data

We delete data that is no longer needed.

Deleting your account. You can ask to delete your Zenk account on your account page at any time, and your request is saved. Where your subscription allows it, we stop its automatic renewal straight away, and you keep access until the end of the period you have paid for. Your account is deleted only after that period has ended and only when nothing stands in the way: while a payment, a refund or a subscription on your account is still being processed, while a payment dispute or a legal claim concerning your account is open, or while your account is restricted, your request waits, and your account page tells you so. Deleting it removes your sign-in, your Journal (your trades, what you wrote and your screenshots), your Zenk Updater codes, sign-ins and computers, and the computers registered to your licence.

What we keep, and why. We keep the payment, tax, contract-evidence and dispute records described in clause 16, with the reference numbers that stop a payment being processed twice and the support emails clause 16 describes, for the period stated there, subject to any longer retention required by law or needed for a specific unresolved legal claim or dispute, and then delete them. We cannot always delete these records earlier on request. Some records must be kept to meet legal duties, resolve disputes or prevent the same payment from being processed again. We will not promise to delete everything, because that is a promise we would have to break. If you open a new account later with the same email address, it is joined to these records.

What else stays. Your account record stays without its sign-in. It keeps your email address and the identifiers that link it to the records above, so that a payment, a refund or a chargeback can still be matched to them, and it is kept with those records for the same period. We keep the record of your deletion request, which shows when you made it and when each step was carried out, as evidence of what we deleted, for the same period. Your licence stays at our licensing service with your payment records; it holds no name or email address, and the computers registered to it are deleted. The records of your Zenk Updater activity described in clause 9A are kept for 12 months after each entry, and then deleted.

Other requests. You can also email us (clause 18). We will delete what we can and tell you plainly what we are keeping and why. If you ask us to delete your Journal, we delete all of it: your trades, what you wrote and your screenshots.

18. Your rights and how to use them

Depending on the privacy laws that apply to you under clause 0, you may have rights to access your data, correct it, ask for it to be deleted, or object to a particular use.

There is one request process, and it is the same for everyone: email support@zenktrading.com and tell us what you want. We will handle your request under whichever law applies to you.

This is how we work, not a claim about your legal rights. We do not promise every right that exists in every jurisdiction — clause 0 explains which laws we are working from.

19. How we protect your data

This clause is deliberately short, because we would rather describe what exists than imply more.

What exists and what we can state:

• The website is configured to use encrypted connections and to send HTTP Strict Transport Security headers.
• You log in to your Zenk account with a link we email you. Zenk does not ask you to create a password for that account.
• Your card details never pass through our website; you enter them on Stripe's pages (clause 5).
• The keys the website uses to reach its providers are kept in the hosting provider's configuration, outside the website's code, and no such key is in the website's source. The Zenk products installed on your computer contain no Stripe secrets, Keygen administration credentials, private keys or database passwords.

We rely on the security of the providers in clause 15A for the systems they run.

What we do not claim. No system is completely secure, and we do not promise that ours is. As Zenk's infrastructure develops, this clause will be updated to describe what is genuinely in place at that time.

20. Age requirement

You can hold a Zenk subscription if you are at least 18, or at least the age of majority where you live if that is higher.

21. Complaints

If you are unhappy with how we have handled your data, please tell us first at support@zenktrading.com so that we have the chance to put it right.

You may also complain to the data-protection authority with jurisdiction over you or over us. XKC Trading FZ-LLC is established in Ras Al Khaimah, United Arab Emirates, and clause 0 explains the privacy laws this policy is built on.

22. We do not sell your data and we do not advertise to you

We do not sell your personal data. We do not share it with anyone for their own marketing, and we do not run advertising.

There is no mailing list, no marketing-email tool, no advertising account and no affiliate arrangement.

Website analytics is a different subject. Clause 12 describes the visit counting we use when it is enabled. It is not advertising, it builds no profile of you, and no data from it is sold or shared.

If this changes, we will update this policy as described in clause 23.

23. Changes to this policy

We may change this policy. Each version is separately identified, and the version you accepted is recorded.

Before a material change takes effect, we will give you notice by email and in your Zenk account, at least 30 days before it takes effect. If the law requires a change sooner, or a change is needed sooner to protect the security of your data, we will give you as much notice as we reasonably can.

We will request explicit re-acceptance only where it is legally required or materially necessary. Otherwise, notice and versioning apply.

Continued use is not treated as blanket acceptance of every change.

A change does not apply retroactively and does not affect rights that accrued before it took effect.

Clause 30 of the Terms of Service states how changes to the Terms are communicated.

24. Data incidents and legally required notifications

If we become aware of a security incident affecting personal data we are responsible for, we look into what happened, take reasonable steps to address it, and record what we found and what we did.

Where the law that applies to an incident requires us to notify a regulator or other authority, or to notify the people affected, we do so as that law requires.

Not every security incident requires notification. Whether it does depends on what happened and what the applicable law requires of us.

---

XKC Trading FZ-LLC FDCW1185, Compass Building, Al Shohada Road, Al Hamra Industrial Zone-FZ, Ras Al Khaimah, United Arab Emirates support@zenktrading.com · +1 281 800 9865