Privacy Policy

Last Updated: 12 August 2026

ZiSecOnline is committed to protecting your privacy and handling your personal information safely and responsibly. This Privacy Policy explains how we collect, use, store, and share information when you use the ZiSecOnline website, web application, iOS application, Android application, and related cybersecurity training and certification services (the “Services”).

1. Information We Collect

We may collect the following categories of information:

  • Account and profile information, such as your name, first and last name, username, email address, phone number, profile photo, biography, and the sign-in method you use (email, phone, Google, or Apple).
  • Organization information, such as your company name and the organization or team account you belong to, where you access ZiSecOnline through an employer, school, or other organization.
  • Authentication information, such as account identifiers, session and authentication tokens, and one-time passcodes sent to your phone number or email to verify your identity.
  • Course and learning information, such as courses purchased or enrolled in, course progress, completion status, assessment results, activity responses, and training history.
  • Content you create or upload, such as lesson notes you write, your profile photo, and photos or files you submit as part of an assessment or a learning activity.
  • Certification information, such as certificate name, certificate identifier, issue date, validity or expiry date, and certification status.
  • Purchase information, such as the course purchased, transaction or order identifier, payment status, purchase date, access validity period, expiry date, entitlement status, and renewal purchase history.
  • Usage and technical information, such as IP address, device type, operating system, browser type and user agent, application version, a device identifier used to recognise the devices linked to your account, push notification tokens, login activity, crash reports, security logs, and usage information.

Payment card details. We do not collect or store your full payment card number, expiry date, or security code. Card payments are handled directly by our payment providers (Stripe on the web, and Apple or Google through in-app purchase on mobile). We receive only confirmation of the transaction, such as its status, identifier, and the entitlement it grants.

2. How We Collect Your Information

We collect information through:

  • Information you provide when creating an account, verifying your phone number or email, purchasing a course, completing training, assessments, or activities, writing notes, uploading a photo, or contacting support.
  • Automatic collection through the website or app, including device, usage, security, local storage, and diagnostic information.
  • Information from your organization, where your employer, school, or another organization enrols you in ZiSecOnline or provides access on your behalf.
  • Information from sign-in providers, where you choose to sign in with Google or Apple. We receive only the information those services share with us, such as your name and email address, in accordance with your settings with them.

Camera and photo access. With your permission, ZiSecOnline may access your camera or photo library so that you can set a profile picture and submit photos required by certain assessments and learning activities. You control this permission through your device settings, and you can withdraw it at any time. We access this only when you actively choose to add a photo.

3. How We Use Your Information

We may use your information to:

  • Create, authenticate, and manage your account, including verifying your phone number or email address.
  • Provide cybersecurity courses, assessments, activities, progress tracking, and certifications.
  • Store the notes and uploaded content you create, and make them available to you across your devices.
  • Manage course purchases, access validity periods, expiry, and renewal purchases.
  • Process transactions and confirm payment or entitlement status.
  • Send important account, course, certification, expiry, security, and support communications, including push notifications where you have enabled them.
  • Report your training progress and certification status to your organization, where you access ZiSecOnline through an employer, school, or other organization (see section 7).
  • Protect ZiSecOnline against fraud, misuse, unauthorized access, and security threats.
  • Monitor performance, diagnose crashes, fix errors, and improve our Services.
  • Comply with applicable legal and regulatory obligations.

We do not sell your personal information, and we do not use it for advertising or cross-site tracking.

4. Third-Party Services

ZiSecOnline uses trusted third-party service providers to operate and deliver the Services. These providers process personal information only as necessary to provide their services to us and in accordance with applicable contractual and legal requirements. Each is also governed by its own privacy policy.

We currently rely on:

  • Google Firebase — account authentication and sign-in, push notification delivery, and crash reporting.
  • Google Sign-In and Apple Sign in with Apple — optional sign-in methods, where you choose to use them.
  • Amazon Web Services (AWS) — hosting and storage of our application and learning data.
  • Stripe — payment processing for purchases made on the web.
  • RevenueCat — management of purchases and entitlements. On the web, the RevenueCat browser library is delivered from a public content delivery network, which receives your IP address and browser information as part of loading it.
  • Apple App Store and Google Play — app distribution, in-app purchases on mobile, and checking whether a newer version of the app is available.

5. Legal Basis for Processing

Where required by applicable law, we process personal information based on:

  • Your consent, where consent is required, including for camera and photo library access and for push notifications.
  • The need to provide the Services or fulfil a purchase or contract with you.
  • Our legitimate interests in operating, securing, supporting, and improving ZiSecOnline.
  • Compliance with legal and regulatory obligations.

6. How We Store and Protect Your Information

We use reasonable administrative, technical, and organizational security measures to protect personal information. Information may be stored or processed using Amazon Web Services (AWS), Google Firebase, and the other providers listed in section 4. Security measures may include encryption, access controls, authentication, monitoring, logging, backups, and restricted access to systems and data.

Some information — such as your session tokens, preferences, and cached course data — is stored locally on your own device or browser so that the app works reliably and does not require you to sign in repeatedly. Signing out or deleting the app removes this local information from your device.

No online service can guarantee absolute security.

7. Sharing Your Information

We may share personal information only when reasonably necessary:

  • With the service providers listed in section 4, to operate, secure, support, or process payments for ZiSecOnline.
  • With your organization, where you access ZiSecOnline through an employer, school, or other organization. That organization may be able to see information such as your name, the courses assigned to or taken by you, your progress and completion status, assessment outcomes, and your certification status. Your organization’s own privacy policy governs its use of that information.
  • When required by applicable law, regulation, court order, or lawful government request.
  • To protect the rights, safety, security, and integrity of ZiSecOnline, our users, or others.
  • With your consent or at your direction, including when you choose to share or download a certificate.

8. Data Retention

We retain personal information only for as long as reasonably necessary to provide the Services, maintain course and certification records, process transactions, meet security and legal requirements, and resolve disputes. Different categories of information may have different retention periods. Certification and transaction records are generally kept longer than usage and diagnostic information, because they may be needed to verify a certificate or resolve a payment dispute.

9. Your Privacy Rights

Depending on your location and applicable law, you may have the right to:

  • Access personal information we hold about you.
  • Request correction of inaccurate information.
  • Request deletion of your personal information.
  • Withdraw consent where processing is based on consent.
  • Request restriction, objection, or data portability where applicable.
  • Opt out of marketing communications.

To exercise any of these rights, contact us at [email protected].

10. Managing and Deleting Your Data

You may update your account information, profile photo, and notification preferences in the ZiSecOnline app or website settings.

You may delete your account at any time using the account deletion option in the app’s account settings, or through the equivalent option on our website. Deleting your account removes your profile and associated personal information from our active systems. We may retain limited information where required or permitted by law, including records needed for fraud prevention, transactions, disputes, certification verification, or legal obligations.

You may also contact us at [email protected] for help with any of the above.

11. Cookies, Local Storage, and Similar Technologies

Our website and web application use browser local storage and similar technologies to keep you signed in, remember your preferences, and operate securely. These are necessary for the Services to function.

We do not use advertising cookies, cross-site tracking, or third-party advertising networks. Where required by law, we will obtain consent before using any non-essential cookies or tracking technologies.

12. Children’s Privacy

ZiSecOnline is intended for workplace and organizational cybersecurity training and is not directed at children below the minimum age permitted by applicable law, unless use is appropriately authorized by a parent, guardian, school, or organization. We do not knowingly collect personal information from children without the required authorization or consent. If you believe a child has provided personal information to us, contact us at [email protected] and we will take appropriate steps to delete it.

13. International Data Processing

Because ZiSecOnline uses global technology and cloud service providers, personal information may be processed in countries other than your country of residence. Where required, we use appropriate safeguards for international transfers of personal information.

14. Changes to This Policy

We may update this Privacy Policy from time to time to reflect changes to ZiSecOnline, our data practices, service providers, or applicable law. The updated version will show a revised “Last Updated” date, and we will provide additional notice where required.

15. Contact Us

Zimozi Solutions Pte. Ltd.
Support Email: [email protected]
Website: https://zisec.zimozi.sg/