Privacy Policy

Who we are

Zero Sum Solutions (“Zero Sum”, “we”, “us”) is a business systems studio in Los Angeles, California. This policy covers:

• this website, zerosumsolutions.com;
• our booking page at api.zerosumsolutions.com;
• Zero Sum Hub, our business software for client businesses, and its Shopify app ZS Business Connections.

Questions about this policy or your data go to devin@zerosumsolutions.com.

This website

The website has no analytics, no advertising pixels and no tracking cookies. It does not build a profile of you. Our hosting provider processes standard request data (IP address, browser type, the page requested and the time) to deliver the site and protect it from abuse. We do not use that data to identify you.

If you email us, we receive your email address and what you write, and we use it to reply. If you ask to join the People programme list, we keep your email address (and anything else you choose to send) separately from business enquiries and use it only to tell you when the programme starts.

Because the site does not track you, there is nothing for a Do Not Track or Global Privacy Control signal to switch off. We treat both as a request not to sell or share your information, which we do not do in any case.

Booking a call

The calendar on the Book page is our own booking page, shown inside this site. When you book, we collect your name, email address, the time you choose and anything you write about what you want fixed. We use it to hold the call, send the invite and reminders, and prepare for the conversation. The booking is added to Devin's calendar.

ZS Business Connections (Shopify app)

ZS Business Connections lets a business that uses Zero Sum Hub connect its Shopify store, so the Hub can read the store's orders when someone at that business asks it to (for example, to look up an order or follow up with a customer). The business is the owner of its store data; we process it on the business's behalf.

What the app can access

• One Shopify permission: read_orders. Shopify shows it on the consent screen as “View customer data” and “View store data: Orders”.
• The app does not request customer-list access, and it cannot create, change or delete anything in the store.

What it reads, and when

Only when a person at the business, or a Hub tool that business has turned on, asks for orders. Each request returns at most 50 orders from a period of at most 92 days. For each order the app reads: the order ID and name, when it was created and updated, its payment and fulfilment status, currency, totals, line items (title, quantity, price), and the customer's ID, name and email address.

What we store

• The store's name, numeric store ID and shop domain, and the identifiers of the connection.
• We do not store order data or customer data from the store. Order details are fetched for the request and shown to the person at the business who asked; the Hub does not save the request or the result.
• Our logs record which business and connection made a request, which action ran, our error code if any, and how long it took. They never contain order contents, customer details, store names or messages from Shopify.

Composio

The connection runs through Composio, a service that manages the Shopify authorization and relays each request. Composio is our subprocessor. It may keep logs of requests and results under its own retention policy, which can be up to one year. We set the shortest log retention our Composio plan allows. The Hub shows this before a business confirms the connection.

Disconnecting and uninstalling

When a business disconnects the store in the Hub, we uninstall the app from the store, delete the connection at Composio and clear the store name from the connection record. Uninstalling the app from the Shopify admin also ends our access.

Shopify privacy requests

• Customer data request.Because the app stores no customer or order data, we hold nothing about a store's customer beyond what Shopify holds. We confirm this to the store within 30 days.
• Customer erasure request. There is no stored customer data to erase. We confirm this to the store within 30 days.
• Shop erasure request.After a store uninstalls the app, we delete that store's remaining connection records within 30 days of Shopify's request.

Who processes data for us

• Vercel: hosting for this website and parts of Zero Sum Hub.
• Supabase: the database behind Zero Sum Hub and the booking page.
• Google (Workspace): email and Devin's calendar.
• Resend: booking confirmations, reminders and other transactional email.
• Composio: the Shopify connection, as described above.

We do not sell personal information, and we do not share it for cross-context behavioural advertising. We disclose it only to these processors, to the business it belongs to, or where the law requires it.

How long we keep data

• Enquiries and bookings that do not become a client project: deleted after 24 months.
• Client project records: kept for the length of the engagement and as long as tax and contract law require after it.
• People programme list: kept until you ask to be removed or the programme closes.
• Shopify connection records: kept while the connection is active. On disconnect the store name is cleared; the remaining identifiers are deleted when the business closes its Hub account or on a shop erasure request.

Your choices and rights

You can ask for a copy of the personal information we hold about you, ask us to correct it, or ask us to delete it. Email devin@zerosumsolutions.com from the address the data relates to, and we reply within 45 days. We will not treat you differently for asking. If you are a customer of a business that uses Zero Sum Hub, we may pass your request to that business, because it controls that data.

California residents have these rights under the California Consumer Privacy Act and CalOPPA. People elsewhere can use the same process.

Security

Access to systems is limited to the people who need it. Data in the Hub is separated per business, connections are read-only by default, and credentials are held by the connection provider, not in our logs. No system is perfectly secure; if we learn of a breach that affects you, we will tell you as the law requires.

Children

This site and our services are for businesses. They are not directed at children under 16, and we do not knowingly collect their data.

Changes and contact

If this policy changes, the new version appears here with a new date. For a material change to how the Shopify app handles data, we also tell the businesses that use it. Contact: Zero Sum Solutions, Los Angeles, California, devin@zerosumsolutions.com.