Legal
Privacy Policy
Last updated: 4 October 2026
This Privacy Policy explains how Zain Stack LLC (“Zain Stack”, “we”, “us”) collects, uses, stores, and shares personal data when you visit https://www.zainstack.com, submit an enquiry, or become a client.
We provide custom software development services to businesses. We do not sell physical goods on this website, and we do not take payment on this website. This notice describes our actual practices. It does not try to give you fewer rights than applicable law allows.
It is intended to meet disclosure duties under the California Online Privacy Protection Act (CalOPPA); the UK GDPR, the Data Protection Act 2018, and the Data (Use and Access) Act 2025; UAE Federal Decree-Law No. 45 of 2021 (PDPL); India’s Information Technology Act, 2000 and the Information Technology (Reasonable Security Practices and Procedures and Sensitive Personal Data or Information) Rules, 2011 while they remain applicable; and the Digital Personal Data Protection Act, 2023 and DPDP Rules, 2025 as those provisions come into force (core processing, notice, and rights obligations are scheduled to apply from 13 May 2027).
1. Who we are
The controller (and, in Indian terms, the data fiduciary for website enquiry data) is Zain Stack LLC (زين ستاك ذ م م), a limited liability company registered in Sharjah Media City, Sharjah, United Arab Emirates. It operates this website. Website: https://www.zainstack.com. Contact: hello@zainstack.com, or the enquiry form on this website.
Registered address: Sharjah Media City, Sharjah, United Arab Emirates. Email is the official contact channel for privacy and complaints.
2. What we collect
Information you choose to give us:
- Name
- Email address
- A description of your project or requirements
- Anything else you type into the enquiry form
Information collected automatically:
- Technical logs created by our hosting provider as part of running and securing the site (typically IP address, date and time, requested URL, and browser user agent)
- Cookieless, aggregated usage analytics via Vercel Web Analytics (page views and a short-lived request hash used to measure traffic — not an advertising profile)
- Tags loaded by Google Tag Manager (container GTM-PQJKGF6P). Tags configured in that container can set cookies and send usage data to their providers
- Usage analytics via Google Analytics (measurement ID G-BDPETBD2CX), installed directly and possibly also through Tag Manager: pages viewed, device and browser details, and an approximate location derived from IP address. Google sets analytics cookies described in section 9
- Google Ads conversion measurement (Ads ID AW-931515354), sent through that same Google tag when an enquiry is saved from the form, so we can tell whether an ad led to that enquiry. The event does not include your name, email, or project description, and we do not use it for retargeting
- Language and region preference, stored in your browser’s localStorage if you set them (keys zs-language and zs-region)
We do not currently collect, through this website: payment card details, government identity numbers, passwords, precise geolocation, biometric data, or health data. Google sets the analytics and conversion cookies described in section 9. Please do not send secrets, payment cards, or other sensitive personal data through the enquiry form.
3. How we collect it
- When you submit the enquiry form (name, email, project description)
- Automatically when your browser loads the site
- Later by email or contract if you become a client (invoicing and project communications). Client-confidential project data is also governed by your service agreement
4. Why we use it
We use personal data only for these specified purposes:
- To respond to your enquiry and discuss whether we can help
- To create or update a CRM contact so we can follow up
- To operate, secure, debug, and prevent abuse of the website
- To understand aggregated traffic and improve the site
- To measure whether our advertising led to an enquiry. That measurement does not include the contents of your enquiry
- To remember the language and region you selected
- To comply with law (including tax, accounting, and lawful requests)
- If you become a client: to perform the contract, invoice, and keep required records
Legal bases, depending on where you are:
- United Kingdom: UK GDPR Article 6(1)(b) (steps at your request before a contract) for enquiry handling, and Article 6(1)(f) legitimate interests for operating the site, security, B2B follow-up, site analytics, and measuring whether our ads led to an enquiry (including Google Analytics, Google Ads conversion measurement, and cookieless Vercel analytics). You may object to legitimate-interests processing. We do not rely on consent for the enquiry itself because you initiated the request. If we ever send unsolicited electronic marketing to an individual, we will do so only as PECR allows.
- United Arab Emirates: processing that is necessary to fulfil a request you initiated, and/or consent where PDPL requires it. We process enquiry data to reply to you.
- India: you voluntarily provide the data for the specified purpose of receiving a reply about our services (a legitimate use under the DPDP Act once in force). Submitting the form is also an affirmative indication that you want us to use those details for that purpose. We do not seek Sensitive Personal Data or Information through this website under the SPDI Rules, 2011.
- United States: we collect the categories above to provide the site and respond to you. We do not sell personal information.
We do not use enquiry data for third-party advertising, and we do not sell personal data.
6. International transfers
We serve clients in India, the UAE, the United Kingdom, the United States, and elsewhere. Personal data is processed on systems that may be in India, the United States, the European Economic Area, or other countries where our providers operate.
- United Kingdom: transfers rely on UK adequacy regulations, the UK International Data Transfer Agreement or Addendum, or another UK GDPR-lawful mechanism, as applicable to the provider.
- United Arab Emirates: transfers outside the UAE take place where PDPL allows them, including where the destination has an appropriate protection level or the transfer is needed to fulfil your request to us.
- India: the DPDP Act will restrict transfers to countries that the Central Government notifies as restricted. We will not transfer personal data to a restricted country if that prohibition applies to us.
- United States: recipients are service providers under contract.
7. How long we keep it
- Enquiries that do not become clients: usually up to 24 months after the last meaningful contact, then deleted or anonymised, unless you ask us to delete sooner or we must keep a record of a complaint.
- Client files, invoices, and tax records: for as long as tax and company law require (commonly six to eight years after the relevant financial year, depending on the country).
- Security logs: a short period configured by the host.
- Analytics: Vercel’s request hash is short-lived (on the order of 24 hours). Google Analytics cookies typically last up to two years; Google retains the associated usage data under its own retention settings for our property.
8. Security
We use reasonable technical and organisational measures appropriate to a small professional-services business, including HTTPS, access-limited CRM, and hosted infrastructure. No transmission or storage method is completely secure. If a personal data breach must be notified under applicable law, we will notify the relevant authority and affected people as that law requires.
10. Your rights
To exercise any right below, email hello@zainstack.com from the address we hold, or include enough detail for us to identify the enquiry. We may need to verify that the request comes from you. We will not treat you worse for asking.
United Kingdom. You may request access, rectification, erasure, restriction, objection (including to processing based on legitimate interests, and to direct marketing), and data portability where it applies. Where we rely on consent, you may withdraw it as easily as it was given. Complain to us first; we will handle complaints in line with the Data (Use and Access) Act 2025 rules as they apply. You may also complain to the Information Commissioner’s Office at ico.org.uk.
United Arab Emirates. Under the PDPL you may request access, correction, erasure, restriction of processing, to stop processing, data portability, and to withdraw consent. You may complain to us and to the UAE Data Office.
India. We do not collect Sensitive Personal Data or Information through this website. If we ever hold SPDI, the SPDI Rules give you rights of access and correction. Under the DPDP Act, as those provisions commence, you may request a summary of processing, correction, completion, updating, and erasure (subject to lawful retention), withdraw consent, use our grievance process, nominate another person in case of death or incapacity, and complain to the Data Protection Board of India after exhausting our grievance process. Email hello@zainstack.com. We aim to respond within 30 days, and in any event within the period the law then requires (the DPDP Rules allow up to 90 days once that system applies).
United States, including California. CalOPPA requires a privacy policy that is easy to find; this page is linked from the site footer using the word “Privacy”. The California Consumer Privacy Act (as amended) applies only if we meet statutory “business” thresholds (currently including annual revenue above USD 25 million, or buying/selling/sharing personal information of 100,000 or more consumers or households, or deriving 50% or more of annual revenue from selling or sharing personal information). We do not currently meet those thresholds and we do not sell personal information. If you are a California resident you may still email us to ask what enquiry data we hold and to ask us to delete it; we will consider that in good faith. If we later meet a US state privacy-law threshold, we will update this policy and add any required “Do Not Sell or Share” link before those extra duties apply. We are not using this page to opt into CCPA obligations we do not have.
11. Children
This website and our services are for businesses and adults. We do not knowingly collect personal data from children (under 18, which is the Indian DPDP definition of a child and is stricter than the US COPPA age of 13). If you think a child has submitted data, email us and we will delete it.
12. Automated decision-making
We do not make solely automated decisions that produce legal or similarly significant effects about you (no credit scoring, hiring, or eligibility decisions). Enquiries saved to our CRM are handled by a person.
13. Changes
We will change this page when our practices or the law require it, and we will update the date at the top. Material changes will be visible on this page. The updated notice applies to collection after the change. If we need a new consent for an existing contact, we will ask for it.
14. Contact and complaints
Zain Stack LLC (زين ستاك ذ م م). Registered address: Sharjah Media City, Sharjah, United Arab Emirates. Website: https://www.zainstack.com. Email: hello@zainstack.com. This email is our designated contact for questions about personal data and for service complaints.
You may also complain to the ICO (UK), the UAE Data Office, or, once it is receiving complaints under the DPDP Act, the Data Protection Board of India — after using our process where the law requires that first.