Privacy Policy

Effective date: October 3, 2026

This policy explains how zCube8 LLC ("zCube8," "we," "us") collects, uses and shares information when you visit zcube8.com (the "site"), contact us, use the automation assessment, book a call, or buy a Scoping Sprint or a Software Second Opinion. zCube8 is a small practice run by Mischa Serlin.

1. Who is responsible

zCube8 LLC is responsible for your personal information (the "controller" under laws such as the GDPR). You can reach us at hello@zcube8.com.

2. Information we collect

Information you give us

• Contact form: your name, email address, the service you're interested in, your timeline, your message and, if you choose, how you heard about us.
• Automation assessment: your answers to eight multiple-choice questions. Your answers stay in your browser unless you ask us to email your results. In that case we receive your answers and your email address.
• Email and calls: anything you send us by email or tell us on a call.
• Purchases: if you buy a Scoping Sprint or a Software Second Opinion, our payment processor, Stripe, collects your payment details. We receive your name, your business name, your email and billing address, and confirmation of payment. We never see or store your full bank account or card number.
• Booking a call: if you book a call through our scheduling provider (OneCal), it collects your name, email address and anything you add to the booking, and shares that with us.

Please don't send sensitive information (such as health information, financial account numbers or government ID numbers) through our forms. If a project involves regulated data, we'll agree how to handle it before you share any.

Information collected automatically

• Analytics (PostHog): when analytics is on, we collect how you use the site: pages viewed, clicks, scrolling, the site that referred you, the campaign details in the link you followed (for example utm_source, or an ad click identifier), your browser and device type, and your approximate location (city and country, estimated from your IP address). PostHog stores a random identifier in a cookie and in your browser's local storage so it can recognize repeat visits.
• Session replay (PostHog): if you accept, we may record how you interact with pages: mouse movements, clicks, scrolling and page content. Everything you type into form fields is masked, and the contact form and the assessment's email field are hidden entirely. We use replays to find and fix parts of the site that are confusing or broken.
• Vercel Web Analytics: when analytics is on, our hosting provider counts page views and measures page performance without using cookies.
• Hosting logs: our hosting provider, Vercel, processes technical data such as your IP address, browser type and the pages you request, to deliver the site and keep it secure.

Linking your visit to your message

If analytics is on when you submit the contact form or ask for your assessment results, we attach your random analytics identifier, a link to your session replay and the campaign that brought you (for example, which ad) to the email we receive, so we can understand how you found us. We never send your name, email address, message or other form text to PostHog.

3. How we use information

• To reply to you, discuss your project and provide the services you ask for.
• To deliver a Scoping Sprint or Second Opinion you buy, including scheduling, invoicing and support.
• To send the emails you ask for (a confirmation of your message, your assessment results) and a personal follow-up about your inquiry. You can ask us to stop at any time.
• To understand how visitors use the site and which campaigns bring them, and to improve the site.
• To protect the site and our business from spam, abuse and fraud.
• To meet our legal, tax and accounting obligations.

We don't sell your personal information, and we don't share it for cross-context behavioral advertising. We don't use advertising cookies or pixels on this site. We don't make decisions about you that have legal or similarly significant effects based solely on automated processing.

4. Cookies and similar technologies

Vercel Web Analytics doesn't use cookies. Our payment processor (Stripe) and our scheduling provider (OneCal) set their own cookies on their own websites when you use them, and their privacy policies apply there.

5. Your choices

• Cookie banner: choose Accept or Decline. If you're in the EU, the UK or another region where we ask first (we estimate this from your browser's time zone), nothing is collected until you accept. Elsewhere, analytics starts when a page loads, together with a notice; session replay starts only if you accept.
• Decline stops analytics and session replay, deletes PostHog's cookie and local storage from your browser, and remembers your choice. Information collected before you declined isn't deleted automatically, but you can ask us to delete it (see "Your rights").
• Cookie settings: you can change your choice at any time with the "Cookie settings" link at the bottom of every page.
• Global Privacy Control: if your browser sends a Global Privacy Control signal, we treat it as a Decline. You can still turn analytics on in Cookie settings.
• Do Not Track: we don't respond to the older Do Not Track signal separately. Use Decline or Global Privacy Control instead.
• Emails: reply "no thanks" or "unsubscribe" to any follow-up and we'll stop.
• Your browser: you can also block or delete cookies and local storage in your browser's settings.

6. Who we share information with

We share personal information only with service providers that help us run the site and our business, under terms that limit how they can use it:

• Vercel: website hosting and Web Analytics.
• PostHog: product analytics and session replay (data stored in the United States).
• Resend: sending and delivering email.
• Stripe: payment processing, only if you buy.
• OneCal: booking calls, only if you book one.
• Our email hosting and business software providers: to receive, store and manage email and records.
• Professional advisers such as accountants and lawyers, when needed.

We may also disclose information if the law requires it, to protect our rights or the safety of others, or as part of a merger or sale of our business, in which case this policy continues to apply to your information.

7. International transfers

We're based in the United States, and our service providers process information in the United States. If you're in the European Economic Area, the United Kingdom or Switzerland, your information is transferred to the United States. Where required, we rely on appropriate safeguards, such as the European Commission's Standard Contractual Clauses or a provider's participation in the EU–U.S. Data Privacy Framework.

8. How long we keep information

• Inquiries and client records: as long as we need them to respond and to work together, and afterward for as long as required for tax, accounting and legal purposes.
• Assessment results you asked us to email: as long as needed to follow up on your inquiry. We delete them on request.
• Analytics and session replays: according to the data retention settings of our PostHog account. On request, we can delete your analytics data sooner where that's technically possible.
• Hosting logs: for the short periods set by Vercel.
• Payment records: as long as the law requires.

9. Security

We use reasonable safeguards, including encryption in transit, access controls and limiting who can access personal information. No method of transmitting or storing information is completely secure, so we can't guarantee absolute security.

10. Your rights

Depending on where you live, you may have the right to:

• know what personal information we have about you, and get a copy of it;
• correct it;
• delete it;
• receive it in a portable format;
• object to or restrict certain uses of it;
• withdraw your consent at any time (this doesn't affect anything we did before you withdrew it);
• opt out of the sale or sharing of personal information (we don't sell or share it), and limit the use of sensitive personal information (we don't use it for purposes that require this);
• not be treated differently for exercising your rights.

To make a request, email hello@zcube8.com. We'll verify your request using information we already have (usually your email address) and respond within the time the law requires (for example, 45 days under California law, or one month under the GDPR). You can use an authorized agent; we may ask for proof that they're authorized to act for you. If we decline your request, you can ask us to reconsider by replying to our response. If you're in the EEA or the UK, you can also complain to your local data protection authority.

Legal bases (EEA and UK). We use your information to take steps you ask for and to perform a contract (for example, replying to your inquiry or delivering a Sprint); for our legitimate interests in running, securing and improving the site, understanding which campaigns work and following up on inquiries, balanced against your rights; with your consent, for analytics, session replay and the cookies they use; and to meet legal obligations.

11. Children

The site isn't directed to children under 16, and we don't knowingly collect their personal information. If you believe a child has given us personal information, contact us and we'll delete it.

12. Changes to this policy

We may update this policy from time to time. When we do, we'll change the effective date above. If the changes are significant, we'll tell you on the site and, where required, ask for your cookie choice again.

13. Contact

zCube8 LLC · hello@zcube8.com