Skip to content
Get my estimate

Privacy Notice

Last updated: 27 October 2026

1. Who we are

Reific, Inc. (“Reific”, “we”, “us”), a Delaware corporation with its registered office at 251 Little Falls Drive, Wilmington, Delaware 19808, United States, operates Zeds (zeds.app). We are the controller of the personal data described in this notice, and the purchaser of any data you later license to us under a Contributor Agreement.

Our establishment in the European Union is our affiliate Reific, UAB, company code 308114457, A. Jakšto g. 6A-22, LT-01105 Vilnius, Lithuania. You can contact either company about anything in this notice at zeds@reific.co.

2. What we collect

  • The request form. If you send the form that follows the check: the tally your browser computed from your export file, and your contact details (your email address, your phone number if you give it, the boxes you ticked, the version of the Contributor Terms you accepted and when you sent it). The tally is consumer health data; our Consumer Health Data Privacy Policy describes it in full.
  • The contact form. Your email address and your message, if you write to us through the form in our Imprint.
  • Emails you send us. Your address, what you write and any attachments.
  • Server logs. Our host, Google Cloud, records each request to the site: your IP address, your browser’s user agent, the address requested and the time. These logs are kept for up to 30 days. Our forms also hold your IP address briefly in memory to limit abuse; it is not stored with what you send.
  • Usage statistics. Which pages are viewed and a few interactions from a fixed list, without cookies; section 3 explains.

3. Analytics, our one cookie, and what we don’t collect

Analytics

We use PostHog, Inc. as our processor to count how the site is used. PostHog keeps these statistics in its EU Cloud, hosted in Frankfurt, Germany. Your browser sends them to our own domain, which passes them on to PostHog with nothing else from your browser but its user agent and IP address: never your cookies or the address of the page you were on.

What is recorded: the pages you view and how long each stays open, the website that referred you (its domain only), and a few interactions from a fixed list: pressing a button that leads to the check, opening the export guide and moving through it, choosing a file, whether the check finished with a result or with an error, starting the request form, whether sending it worked, and opening a question. With each, your browser, operating system and type of device, which PostHog’s code reads from your browser’s user agent. Page addresses are recorded without their query string, apart from campaign tags such as utm_source; an address that is not one of our pages is recorded as “not found”.

What is never sent to PostHog: the tally, the estimate, anything read from your file, the file’s name or size, the boxes you tick, your email address, phone number or anything else you type, or any consumer health data. Events that happen while your file is being read are held back until the check has finished.

How: analytics stores nothing on your device (no cookies, no local or session storage), builds no profile of you, and makes no recording of your screen or of what you type. PostHog receives your IP address and your browser’s user agent with each request. It combines them with our domain and a random value that changes every day and is then deleted, to work out a code that counts visitors, and their visits, for that one day. It deletes the IP address and the user agent before it stores anything, and does not work out your location. The code changes every day, so PostHog cannot recognise you from one day to the next.

Why, and for how long: our legitimate interest in knowing, in aggregate, how the site is used, so we can improve it (Art. 6(1)(f) GDPR). PostHog keeps the statistics for one year, the retention period of the PostHog plan we use. We never combine them with the details you send us in the form.

Your choice: turn analytics off below or at the foot of any page. If your browser sends Global Privacy Control or Do Not Track, analytics stays off without you doing anything.

Analytics:

Our one cookie

The site sets a single cookie, and only if you turn analytics off: zeds_analytics, with the value “off”, which remembers that choice for a year. It is strictly necessary to respect the choice you made. Turning analytics back on deletes it. If you never use the switch, the site sets no cookie at all.

What we don’t collect

We use no advertising and no session recording, and the site loads no third-party scripts, fonts or other resources: everything, analytics included, goes to and from our own domain. Nothing about your export file is uploaded to produce the estimate. The check runs in your browser, and we receive the tally only if you send it.

4. Why we use it, and on what legal basis

Where the GDPR applies, we rely on these legal bases:

  • The tally and your contact details, to assess your data and contact you about licensing it: your consent (Art. 6(1)(a) GDPR) and, because the tally is derived from health data, your explicit consent (Art. 9(2)(a)), given by ticking the box on the form. Occasional updates, only if you ask for them: your consent (Art. 6(1)(a)).
  • Contact messages and emails, to answer you: steps you ask us to take before a possible agreement (Art. 6(1)(b)) or, otherwise, our legitimate interest in answering the people who write to us (Art. 6(1)(f)).
  • Server logs, to keep the site secure and prevent abuse: our legitimate interest in running a secure service (Art. 6(1)(f)).
  • Records of consent, to be able to show what you agreed to: our legitimate interest (Art. 6(1)(f)).
  • Usage statistics, to understand in aggregate how the site is used and improve it: our legitimate interest (Art. 6(1)(f)). You can object at any time with the switch in section 3.

You can withdraw consent at any time by emailing zeds@reific.co; this does not affect processing before you withdraw. You do not have to give us anything: without the form, we simply cannot assess your data or contact you.

The estimate is computed automatically from the tally, but it is not a decision about you: it is not an offer, and a person decides whether to contact you. We make no decisions with legal or similarly significant effects based solely on automated processing.

5. Who receives it

Attio, Inc.
Customer relationship management (CRM). Stores leads and contact messages.
Google LLC (Google Cloud)
Hosting. Runs the site in its Belgium region and keeps its server logs.
PostHog, Inc.
Product analytics. Receives the usage statistics described in section 3 and keeps them in its EU Cloud (Frankfurt, Germany). Never the tally, your contact details or any health data.
Our email provider
Carries and stores the emails we exchange with you.
Reific, UAB
Our affiliate and EU establishment. May handle personal data on our behalf.
Clients
Teams that license de-identified data from us, only after you have signed a Contributor Agreement and a sale authorization. They receive de-identified data, never your contact details.
Public authorities
Only where the law requires it.

Our service providers act on our instructions under data processing agreements.

6. International transfers

The site runs in Google Cloud’s Belgium region, and PostHog keeps the usage statistics in the EU. Our CRM stores leads and contact messages in the United States. If you are in the EU or EEA, transfers to our service providers and to clients that receive de-identified data rest on the European Commission’s Standard Contractual Clauses, which are part of our data processing agreements with them. You can ask us for a copy.

7. How long we keep it

Tally and contact details
12 months after our last contact with you, unless a Contributor Agreement is signed; that agreement then governs.
Contact messages and emails
24 months after our last contact with you.
Server logs
Up to 30 days.
Usage statistics
One year, at PostHog.
The opt-out cookie
A year from when you turn analytics off, on your device, unless you delete it or turn analytics back on.
Signed sale authorizations
At least six years from signing, or from when they were last in effect if that is later.

8. De-identified data

When we license data, we license it de-identified: we take reasonable measures so that it cannot be linked to you, we keep and use it only in that form, and we publicly commit not to try to re-identify it. Clients that receive it are contractually barred from trying to re-identify anyone.

9. Your rights

In the EU and EEA

You have the right to access your personal data, to have it rectified or erased, to restrict or object to its processing, to receive it in a portable format, and to withdraw consent at any time. You can also complain to a supervisory authority: the State Data Protection Inspectorate of Lithuania (VDAI, vdai.lrv.lt), where our EU establishment is based, or the authority where you live or work.

In California

You have the right to know what personal information we collect, use and disclose, to delete it, to correct it, and to limit our use of sensitive personal information, such as the tally. In the terms of the CCPA, we collect identifiers (your email address, phone number and IP address), sensitive personal information (the tally, as health information) and internet activity (server logs and usage statistics), for the purposes in section 4. We do not sell or share personal information as the CCPA defines those terms, so there is nothing to opt out of. We will not discriminate against you for exercising your rights. You may use an authorized agent; we may ask for proof that the agent acts for you.

Consumer health data

Your rights over consumer health data in Washington, Nevada and Connecticut are set out in our Consumer Health Data Privacy Policy.

How to exercise them

Email zeds@reific.co from the address you gave us. We check that the request comes from you, usually by confirming that you control that address, and answer within one month (GDPR) or 45 days (California), extended only where the law allows and with notice to you.

10. Children

Zeds is for adults. We do not knowingly collect personal data from anyone under 18, and we delete any we learn of.

11. Changes

We will post any change here and update the date above. If we want to use data we already hold in a materially different way, we will ask for your consent first.

12. Contact

Reific, Inc., 251 Little Falls Drive, Wilmington, Delaware 19808, United States, or Reific, UAB, A. Jakšto g. 6A-22, LT-01105 Vilnius, Lithuania. Email zeds@reific.co.