ZABTA™

Privacy notice

Contributor portal at this subdomain. Last reviewed 1 September 2026.

Who this covers

Anyone invited to the Zabta contributor portal: the confidentiality agreement, the contributor agreement, and the account, sign-in and access records that go with them. Faiz Patel, trading as Zabta, is the controller of this data.

What is collected

• Your name, email address and postal address, as given on the confidentiality agreement and contributor agreement.
• Your signature, as an image if drawn or as typed text if typed.
• Records of your account: when it was created, when you set a password, when you enrolled an authenticator app, sign-in attempts and their outcome.
• A record of what you accessed and when, including which documents you were shown and when each agreement was signed.

Why, and the lawful basis

Before any agreement is signed, this is processed under legitimate interests: protecting confidential material that has not been published, and deciding whether to proceed with a contribution. Once the contributor agreement is signed, processing continues under contract, as necessary to carry out that agreement.

None of this is used for marketing, profiling, or shared with any third party analytics or advertising service. This page and every page in the portal loads no fonts, scripts or trackers from any third party domain.

How long it is kept

Your name, address, email and signature are kept for as long as the confidentiality or contributor agreement could reasonably need to be relied on or defended, which given the terms of those agreements may be a long period. This is reviewed periodically rather than left indefinite by default.

The record of what you accessed and when is kept indefinitely. It exists specifically to answer, from a query rather than from memory, who saw what and when, which is the entire purpose of this system. It contains no personal data once a deletion request below has been acted on, only an account reference, an event type, and a timestamp.

Asking for deletion

You can ask, at any time, for your name, address, email and signature to be removed. When that happens:

• Those fields are overwritten and cannot be recovered.
• The cryptographic hash of the document you signed is kept, so the fact that a specific, unaltered document was signed on a specific date remains provable.
• The access record described above is kept, with your personal data now removed from it.

Deletion does not undo the confidentiality obligations you already agreed to regarding material you were shown, and does not reopen or cancel any intellectual property assignment that took effect on signing, those are terms of the agreement itself, not personal data.

To ask for this, email fp@faizpatel.com. Requests are handled by hand, this is a small system with a single administrator, expect it to be actioned within 30 days.

Where it is stored

Google Cloud, via Firebase, in a single project operated by Faiz Patel. Documents you sign are never publicly accessible, access to them is always a short-lived link generated after your account's access level is checked.