Legal
Privacy Policy
Last updated:
Zeplo Studio is a one-person email marketing studio operating from Bangladesh and working with clients internationally. This policy explains what personal information is collected through zeplostudio.com, why it's collected, and what rights you have over it.
Zeplo Studio is the data controller for information collected through this website. Any question about this policy can be raised through the contact form.
What is collected
When you fill in the contact form
Your name, email address, and the details of your project. Optionally your WhatsApp number and budget range, if you choose to provide them.
When you book a call
Bookings are handled by TidyCal. When you book, TidyCal collects your name, email address, and your answers to the intake questions — your website, email platform, list size, and what you're trying to solve. TidyCal also records your timezone so the call can be scheduled correctly.
When you browse the site
Standard analytics data via Google Analytics 4: pages viewed, approximate location (city level, derived from IP address), device and browser type, how you arrived at the site, and how long you stayed. This is aggregated and is not used to identify individual visitors.
What is not collected
Nothing is sold on this website, so payment card details are never collected here. Special category data — health information, political opinions, religious beliefs, biometric data, or anything similar — is not collected, and should not be sent through the contact form.
Why it's collected, and the legal basis
| What | Why | Legal basis (UK/EU GDPR) |
|---|---|---|
| Contact form submissions | To reply to your enquiry and quote for work | Legitimate interest / steps prior to a contract |
| Booking details | To schedule and prepare for our call | Steps prior to a contract |
| Email correspondence | To communicate with you about a project | Legitimate interest / contract |
| Analytics | To understand which pages are useful and improve the site | Consent |
Your contact details are not used for marketing. Submitting the form will not add you to a mailing list. You will receive nothing other than a reply to your enquiry and messages relating to work we discuss or carry out together.
Who else handles your information
A small number of third-party services are used to run this site and the work behind it. Each is a separate company with its own privacy policy, which is worth reading if you have concerns.
- TidyCal — call booking and calendar management
- Google Analytics 4 (Google LLC) — website analytics
- Google Workspace (Google LLC) — email and calendar
- Mailchimp (Intuit Inc.) and Klaviyo — used in client work, not for this website's visitors
This website runs on a self-managed hosting setup. Server logs, which may include IP addresses and request timestamps, are generated automatically as part of normal operation and are retained only as long as needed for security and troubleshooting.
Your personal information is never sold, rented, or traded. It is not shared with advertisers or data brokers.
If you're a client
During client work, access is required to your email platform — including subscriber names, email addresses, engagement history, and sometimes purchase data. In that relationship you are the data controller and Zeplo Studio acts as a data processor on your instructions.
- Your data is accessed only to carry out the work you've asked for
- Subscriber lists are not copied, exported, or retained beyond what the work requires
- Your subscribers' data is never used for any other purpose
- Working copies are returned or deleted when a project ends, on request
- A Data Processing Agreement (DPA) or NDA can be signed on request
Client account credentials are stored in an encrypted password manager and are not shared with anyone.
International transfers
Zeplo Studio operates from Bangladesh, and the services listed above store data in the United States and elsewhere. This means your information will be transferred outside the UK, EU, and EEA.
For US-based providers, reliance is placed on their published transfer safeguards, including Standard Contractual Clauses and, where applicable, the EU-US Data Privacy Framework. Specifics on any single provider are available on request through the contact form.
How long it's kept
- Enquiries that don't become projects — up to 12 months, then deleted
- Client project records and correspondence — up to 6 years after the engagement ends, for tax and accounting purposes
- Client subscriber data — only for the duration of the work, unless you request retained access for an ongoing retainer
- Analytics — retained by Google according to the retention period set on the property
You can request earlier deletion at any time. See Your rights below.
Cookies and analytics
This site uses Google Analytics cookies to measure traffic. These are set only if you consent via the cookie banner. If you decline, no analytics cookies are set and no analytics data is collected.
You can also block cookies through your browser settings, or install Google's browser opt-out add-on. Blocking cookies will not affect your ability to use the site or get in touch.
Essential cookies — those needed for the site to function and to remember your cookie choice — do not require consent and cannot be turned off.
Your rights
Depending on where you live, you may have the right to:
- Access the personal information held about you
- Correct anything inaccurate
- Delete your information (right to erasure)
- Restrict or object to how it is used
- Portability — receive your data in a machine-readable format
- Withdraw consent at any time, where consent is the basis
- Complain to your local data protection authority
In the UK, that authority is the Information Commissioner's Office (ico.org.uk). In the EU, it is your national supervisory authority.
If you're in California, you additionally have the right to know what personal information is collected and to opt out of its sale. Personal information is not sold, and no one is treated differently for exercising their rights.
To exercise any of these, use the contact form and describe your request. A response will follow within 30 days. Confirmation of your identity may be requested first — usually a reply from the email address in question is enough.
Security
Reasonable steps are taken to protect your information: the site runs over HTTPS, credentials are stored in an encrypted password manager, two-factor authentication is enabled on every account used, and access to client platforms is limited to what each project needs.
No system is completely secure, and no such claim is made here. If a breach occurs that affects your personal information, you and the relevant authority will be notified as required by law.
Children
This site is aimed at businesses and is not intended for anyone under 16. Information is not knowingly collected from children. If you believe a child has submitted information through this site, get in touch and it will be deleted.
Changes to this policy
This policy may be updated as the site or the services change. The "last updated" date at the top always reflects the current version. Material changes affecting how your information is used will be communicated directly where contact details are held.
Get in touch
For any question about this policy, or to exercise any of the rights described above, use the contact form. Postal address available on request.
Contact formZeplo Studio · Bangladesh · zeplostudio.com
← Back to zeplostudio.com