Security and your data

Last updated October 12, 2026

Your leads and your clients' details are yours. Here is what we keep, who can see it and how we protect it, in plain words.

Your data stays yours

• We never sell or share your data, and we don't use your leads for our own marketing.
• Download everything in one file any time: Settings, “Download all my data”.
• Delete your account whenever you like. When a plan ends, the account's data is deleted 30 days later.
• We collect as little as we can. Zallant never texts or calls anyone, and has no advertising trackers or session recording.

How it's protected

• No passwords to steal. You sign in with a one-time link or code sent to your email, and sign-in attempts are limited.
• Encrypted. Every page and email link uses HTTPS. The database is encrypted where it's stored, and sign-in links and sessions are saved only as one-way hashes.
• Each business kept apart. Every request is checked against your own account, so no other business can see your leads. On a team, members see their own leads; the team lead sees the team's.
• Bots kept out. Sign-up, sign-in and public forms have a “Verify you are human” check.
• Backed up. The database can be restored to any minute in the last 30 days.
• Few hands. Only Zallant's founder can reach the live database. Real customer data is never copied to laptops or test copies.
• Checked before it ships. Every change runs automated tests, a secret scan and a dependency check, and goes to a private test copy before it goes live.
• Card numbers never touch Zallant. Payments go straight to our payment provider.

Outside services that handle data

Zallant uses as few outside services as possible. These are all of them:

• Cloudflare: Hosting, database, backups, email sending and the "Verify you are human" check. Data: Everything Zallant stores, and emails while they are sent.
• Stripe: Subscriptions and payments. Data: The account holder's name, email, billing details and card (Zallant never sees card numbers).
• Your browser's push service: Delivers alerts to your phone, only if you turn them on. Data: Encrypted alerts it can't read, and your phone's push address.

Before we add one, we tell account holders by email at least 30 days ahead.

If something goes wrong

If a problem ever affects your data, we email you as soon as we know, with what happened and what to do. Problems you could notice are listed on the status page.

Report a security problem

Found a weakness? Email neeraj@zallant.com with the details. Please don't look at other people's data or disrupt the service while testing. We reply to every report. (Also in our security.txt.)

More: Privacy Policy · Terms · Help