Skip to main content

Privacy Policy

This Privacy Policy explains how Zation AG processes personal data across our public services — including zation.io, docs.zation.io, and the Zation FinOps Platform.

It covers data we process as a controller — meaning data we collect for our own purposes, such as visiting our website or contacting us. Customer content processed on behalf of our customers in the Platform is covered by the DPA and the Security & Trust statement.

Controller​

Zation AG Suurstoffi 18b CH-6343 Rotkreuz Switzerland

Contact for privacy matters: info@zation.io

What we process and why​

When you visit our websites (zation.io, docs.zation.io)​

We process IP address, user-agent, requested URL, and timestamp in our server logs. Purpose: operate and secure the site, troubleshoot, detect abuse. Legal basis: legitimate interest (Art. 31 para. 2 lit. c revDSG).

When you contact us by email​

We process your email address, name, and the content of your message. Purpose: reply to your enquiry and follow up if needed. Legal basis: pre-contractual or contractual (Art. 31 para. 2 lit. a revDSG).

When you send a contact request through our website​

If you use the contact form on zation.io (book a call, ask for a call back, or send a message), we process your name, email address, company, phone number (if you give it), and your message. We create a lead with this data in Microsoft Dynamics 365, our customer relationship management (CRM) system, so that our sales team can reply and follow up. Purpose: answer your request and follow up on it. Legal basis: pre-contractual steps at your request (Art. 31 para. 2 lit. a revDSG). The data is kept as described under Data retention. You can object to follow-up at any time at info@zation.io.

When you request trial access to the Licensing Guide​

The Microsoft Licensing Guide at licensing.zation.io is open to Zation customers and to prospects whom we approve for a limited trial. If you request trial access, we process the data you enter in the request form and the data needed to check your access.

  • What we record. Your work email address, your company (if you enter it), the topics you select, your Microsoft Entra tenant ID (which we derive from your email domain and confirm when you sign in), the time of your request, and the access we grant. We do not record the content you read or any search terms.
  • Reading activity, only with your consent. If you tick the box on the request form, or choose Share in the banner at your first sign-in, we record which chapters and which selected sections you open during your trial (price increases, true-up, and CSP end of term). We store the chapter or section and the day, nothing else. Without your consent, we record no reading activity.
  • Purpose. Handle your access request, and follow up with you about it. With your consent, a licensing specialist can also follow up on the topics that matter to you.
  • Legal basis. Pre-contractual steps at your request (Art. 31 para. 2 lit. a revDSG) for the access request and the follow-up. Your consent (Art. 31 para. 1 revDSG; Art. 6 para. 1 lit. a GDPR, where applicable) for reading activity.
  • Recipients. Zation sales. We store your request as a lead in Microsoft Dynamics 365. With your consent, the reading activity is added to the lead as a summary note. See Recipients of personal data and Data location.
  • Retention. Raw reading events are deleted after 90 days. Request data is deleted 24 months after your access ends, unless a business relationship develops, in which case the retention rules for business records apply.
  • Withdrawal. You can turn reading activity off at any time with the Reading activity link in the footer of the Licensing Guide, or by writing to info@zation.io. Withdrawal applies from then on and does not affect the processing that took place before. It also deletes the reading activity notes in Dynamics 365.
  • Scoring. We rank follow-ups by fixed rules, for example how often a topic was opened. This is rule-based scoring only. We use no AI-based profiling and make no automated decisions about you.

When you sign in to the Platform​

We process identity data from your Microsoft Entra ID account (email, name, tenant). Purpose: authenticate and authorize you. Legal basis: contract with your organization.

When you use the Platform​

We record your actions in the Platform — including security-relevant actions such as scheduling or approving optimisations — per user in the audit trail (see Security & Trust). Purpose: security, accountability, compliance, and incident investigation. Legal basis: legitimate interest and legal obligation.

When the Platform personalises your start page​

We record which Platform pages you open: your Entra object ID, your organisation, the page address and the day. We do not record your name, your email address, page content, or search terms. Purpose: improve the Platform (product analytics within Zation), and show you suggestions on your start page for the areas you use most.

Your suggestions are calculated by fixed rules from your own page visits of the last 90 days, with recent visits counting more. Only you see them: they are not shown to your organisation's administrators or to other users, and they are never sent to an AI. You can hide any suggestion. Within Zation, usage data is accessible only to staff who operate the Platform. Legal basis: legitimate interest (Art. 31 para. 2 revDSG). Raw page-view records are deleted after 90 days; daily aggregates are kept for product analytics. You can object at any time at info@zation.io.

When we work with you, and AI assists us​

Our everyday business communication — emails, meeting summaries, documents — runs through Microsoft 365 Copilot and Claude (Anthropic) under enterprise and commercial agreements. That communication can include your name, contact details, and the content of our correspondence. Purpose: carry out our own work efficiently. Legal basis: legitimate interest (Art. 31 para. 2 revDSG).

We are the controller for this processing. Neither tool has access to Platform production data, neither provider may train foundation models on our data, and consumer accounts are not used. The full rules, including our internal safeguard against bulk processing of identifiable personal data, are in the Responsible AI Statement.

What we do not do​

  • No AI decisions about you. No automated decision-making with legal or similarly significant effect, and no AI-based profiling of individuals. AI assists our people; a person reviews and decides. The only personalisation and scoring is rule-based: the start-page suggestion described above and the follow-up ranking for Licensing Guide trials. Neither has a legal or similarly significant effect.
  • No third-party analytics. We do not use Google Analytics, Matomo, Plausible, HubSpot tracking, or similar tools on any of our public properties.
  • No advertising cookies. We do not run advertising on our sites.
  • No data sale. We never sell personal data.

Cookies​

Our sites use only strictly necessary cookies required for operation — for example, to keep you signed in on the Platform or on the protected sections of our docs. We do not use marketing or analytics cookies.

A separate, more detailed Cookie Statement will be published as part of this Privacy Policy when relevant. Until then, the section above describes our full cookie use.

Browser cache in the Platform​

To make pages load instantly when you return, the Zation Platform portal keeps a cache of selected aggregated API responses, such as license counts, cost summaries, and adoption percentages, in the IndexedDB of your own browser.

  • Aggregated figures only. The cache holds no lists of individual users, no names, email addresses, or UPNs, and no purchase prices or margins. Responses that contain such fields are excluded from it.
  • Stays on your device. The cache is bound to the signed-in account, is not shared with Zation or third parties, and is not used for tracking.
  • Short-lived. Entries expire after at most 8 hours and are discarded with every new Platform release. Signing out (in all open tabs), changing the account, or switching the customer deletes the cache.

The cache is not encrypted beyond the storage protection of your browser profile.

Data retention​

  • Server logs are retained for a limited period (typically 90 days) and then deleted automatically. They are part of our audit trail and may be retained longer where required to investigate a security incident.
  • Contact requests and Licensing Guide requests are kept as leads in our CRM while we follow up with you. For Licensing Guide trials, raw reading events are deleted after 90 days and request data 24 months after your access ends (see above).
  • Email correspondence is retained as long as needed to handle your request and to comply with legal retention obligations under Swiss law (typically up to 10 years for business records).
  • Platform-related personal data follows the retention rules in the DPA.

Recipients of personal data​

Personal data we process is generally not shared with third parties, except:

  • within Zation, with our sales team, in Microsoft Dynamics 365 (our CRM), for contact requests and Licensing Guide requests
  • with our sub-processors that operate parts of our infrastructure (see Sub-Processors)
  • where required by Swiss law, court order, or competent authority
  • with professional advisors (legal, tax, audit) under confidentiality

Data location​

All personal data we process as a controller is stored and processed within Switzerland or the EEA, primarily on Microsoft Azure (Switzerland North). Limited operational metadata from identity services may be processed in the EEA under appropriate safeguards.

Two exceptions, both under appropriate safeguards:

  • Sub-processors that operate parts of our infrastructure, under the conditions described in our Sub-Processors statement (e.g. standard contractual clauses where applicable).
  • AI-assisted business communication. Microsoft 365 Copilot processes within our Microsoft 365 tenant boundary (EU). Claude processes under Anthropic's Commercial Terms and the accompanying data processing terms, which may involve processing outside Switzerland and the EEA under standard contractual clauses. Details of services, regions, and retention are provided on request.

Apart from these, we do not transfer personal data to countries outside Switzerland or the EEA.

Your rights​

Under the Swiss Federal Act on Data Protection (revDSG) and, where applicable, the EU GDPR, you have the right to:

  • request access to the personal data we hold about you
  • ask for correction of inaccurate data
  • request deletion of your data, subject to legal retention obligations
  • request restriction of processing
  • object to processing based on our legitimate interest
  • receive your data in a portable format, where technically feasible
  • withdraw consent, where processing is based on consent

To exercise any of these rights, contact info@zation.io. We respond within 30 days. We may need to verify your identity before acting on a request.

You also have the right to lodge a complaint with the Swiss Federal Data Protection and Information Commissioner (FDPIC) — edoeb.admin.ch.

Security​

How we technically and organizationally protect personal data is described in our Security & Trust statement. In short: encryption in transit and at rest, strict access controls, audit logging, and Swiss data residency.

Changes to this Privacy Policy​

We may update this Privacy Policy from time to time. The current version is always available at this URL. Material changes will be communicated on our website and, where appropriate, by email.

Last updated: November 13, 2026