Steeplestack ("we", "us", or "our") operates steeplestack.org and the Zonal software product. This policy explains what information we collect, how we use it, and your rights regarding that information.

Information we collect

Account and billing information

When you purchase a subscription we collect your name, email address, and payment details. Payment processing is handled by Stripe — we never see or store your full card number. We store your Stripe customer ID and subscription status to manage your license.

License activation data

When you activate a license key, the Zonal controller sends a machine identifier and your email address to our license server (licensing.steeplestack.org). This is used solely to bind the key to your machine and prevent unauthorized sharing.

Sound level data

Zonal measures sound pressure levels (SPL) on your premises. This data is processed entirely on your local network by the Zonal controller. We do not receive, store, or transmit SPL readings from your facility.

Contact form

When you submit the contact form we collect your name, email address, and message. This information is used only to respond to your inquiry and is not shared with third parties.

Website analytics

We use Cloudflare Web Analytics to understand aggregate site traffic. It is cookieless: it does not set cookies, does not fingerprint your device, and does not track you across sites. We see only anonymous, aggregated counts of page views and referrers. Server access logs (IP address, page, timestamp) are retained for up to 30 days for security purposes and then deleted.

How we use your information

To provision and manage your Zonal license
To process payments and send receipts via Stripe
To respond to support requests
To send product update announcements (you may opt out at any time)

Data sharing

We share data only with the following sub-processors, each under a data processing agreement:

Provider	Purpose
Stripe	Payment processing and subscription management
DigitalOcean	Cloud hosting for our website, license server, and mail relay
Google Workspace	Transactional email delivery via SMTP relay

We do not sell your personal data.

Data retention

We retain your account and license data for the duration of your subscription plus 90 days, after which it is permanently deleted. You may request deletion at any time.

Your rights

You have the right to:

Access the personal data we hold about you
Request correction of inaccurate data
Request deletion of your data
Export your data in a machine-readable format

To exercise these rights, email [email protected].

Security

Data in transit is encrypted using TLS 1.2 or higher. Our license server uses mutual TLS for all monitor-to-controller communication. We apply the principle of least privilege across all systems.

Changes to this policy

We will notify you by email before making material changes to this policy. The effective date at the top of this page reflects the date of the most recent revision.

Contact

Questions about this policy? [email protected]

Privacy Policy