Privacy Policy · Zcardon

This Privacy Policy describes how Zeborg Water Solution Corp. ("Zcardon", "we", "our", or "us") collects, uses, discloses, and protects information about you when you use the Zcardon virtual debit card platform at zcardon.com (the "Service").

1. Information we collect

Information you provide

Account information — name, email address, mobile phone number, date of birth, and a password you create.
Identity verification (KYC) — government-issued ID image, last-4 of SSN (encrypted at rest using AES via Fernet), and home address. We collect this only where required by US financial regulations or by our card-issuing partners.
Payment information — bank account details (for ACH funding) and card details, processed via Stripe. We never store full card numbers on our servers.
Recipient information — when you issue a virtual card to a receiver, you provide their name and (optionally) their phone number so we can deliver the card link.
Agent application data — driver's license images (front + back), SSN, and contact information, encrypted at rest.

Information collected automatically

Device information (browser type, OS, IP address) and basic usage logs, used for fraud detection and rate-limiting.
Cookies and similar technologies for session management. We do not use third-party advertising cookies.

2. How we use your information

To create and maintain your account and issue virtual cards.
To send transactional SMS — verification codes (2FA), password-reset codes, card-delivery links, and account-event notifications. See our SMS Policy for details.
To process payments via Stripe and ACH partners.
To comply with anti-money-laundering (AML), Bank Secrecy Act (BSA), and OFAC sanctions-screening requirements.
To detect, prevent, and investigate fraud, abuse, or violations of our Terms of Service.

3. SMS and phone-number handling

Phone numbers collected at sign-up, password reset, agent application, or card-delivery are used exclusively for the transactional message types listed in our SMS Policy. We do not send marketing or promotional SMS, and we do not sell, rent, or share mobile phone numbers with third parties for their own marketing.

Phone numbers are stored encrypted. You may opt out at any time by replying STOP to any Zcardon SMS, which removes you from all SMS lists immediately (a confirmation will be sent).

4. Third-party service providers

We share information only with the processors that power our Service:

Stripe, Inc. — payment processing, card issuing (planned), Stripe Identity for KYC.
Twilio Inc. — SMS delivery, two-factor authentication codes (Verify), MMS for card-image delivery.
Resend — transactional email delivery.
MongoDB Atlas / cloud database providers — encrypted data storage.
Wise (TransferWise) / Nium — international payouts (where applicable).

Each processor is contractually bound to use your data only to provide services to Zcardon.

5. Data retention

We retain account data for as long as your account is active, and for up to 7 years after closure to comply with US financial record-keeping requirements (BSA §1010.430). Audit logs and AML-related records may be retained longer where legally required.

6. Your rights

Depending on your state of residence, you may have the right to access, correct, delete, or port your personal information; to opt out of certain processing; and to non-discrimination for exercising these rights. To exercise any right, email privacy@zcardon.com. California residents — see our CCPA notice below.

California (CCPA / CPRA)

In the prior 12 months we collected: identifiers (name, email, phone), commercial information (transactions), internet activity (usage logs), geolocation (approximate, from IP), and financial information (bank / card data via Stripe). We do not sell personal information and we do not share it for cross-context behavioral advertising.

7. Security

We use TLS 1.2+ in transit, AES-128 at rest for highly sensitive fields (SSN, driver's license imagery), bcrypt for password hashing, and least-privilege access controls. No system is perfectly secure — please use a unique, strong password and enable 2FA.

8. Children

Zcardon is not directed to anyone under 18. We do not knowingly collect data from minors. If you believe a minor has provided us information, contact privacy@zcardon.com and we will delete it.

9. Changes to this policy

We may update this Privacy Policy from time to time. Material changes will be announced via email and on this page at least 30 days before taking effect.

10. Contact us

Zeborg Water Solution Corp.
2223 Arundel Crossing Dr, Sugar Land, TX 77479
Privacy questions: privacy@zcardon.com
General support: hello@zcardon.com · /support