Privacy
Last updated 16 September 2026
legals_reviewed to true in config.php to hide this.This explains what happens to personal information when you use ZAREXO. It is written to be read, not to be survived.
Who is responsible
D G Croxton T/A Croxton Media, of 11 Willow Close, Spratton, Northampton NN6 8JH, provides ZAREXO. You can reach me at hello@zarexo.co.uk.
[ICO registration number, once you have one — most businesses that process personal data on a computer need to register and pay the data protection fee. Check at ico.org.uk.]
Two different kinds of information
This is the part that usually gets muddled, so it is worth being plain about.
1. Information about you, my customer
Your name, business name, email address, phone number and anything you type into the enquiry form or send me in an email. For this I am the controller — I decide what happens to it.
2. Information inside your books
Your clients' names and addresses, what you invoiced them for, your receipts and your bank transactions. This is your data about your customers. You are the controller of it. Where I can reach it at all — because you have asked me to fix something — I act as your processor, on your instructions and nobody else's.
It also lives on your hosting, in your database. I do not hold a copy, and there is no central server with everybody's books on it.
What I do with your information, and why
| What | Why | On what basis |
|---|---|---|
| Name, business, email, phone from the enquiry form | To reply to you and work out whether the software suits you | Legitimate interests — you asked me a question and expect an answer |
| Email address and account details once you are a customer | Running your account: sign-in codes, password links, support, notices about updates that affect you | Performance of our contract |
| Invoices I raise to you, and what you paid | Because I have to keep proper records | Legal obligation — HMRC requires it |
| Emails between us | Remembering what was agreed and what went wrong | Legitimate interests — and for tax records, legal obligation |
How long I keep it
- Enquiries that come to nothing — deleted within 12 months.
- Customer account details — while you are a customer, and for 12 months afterwards in case you come back.
- Anything with a tax consequence — invoices, payments, the emails that explain them — six years after the end of the tax year they fall in, because HMRC can ask for them for that long.
- Your books — for as long as you keep them. They are on your hosting; deleting them is your decision and yours to carry out.
Who else sees it
No advertising networks, no analytics companies, nobody buying or selling anything. The short list is:
- IONOS — the hosting and email for my own site and mail. Data stays in the UK or the EEA.
- My accountant, for the invoices I raise to you.
- HMRC or another authority, where the law requires it.
Your own install talks to nobody but your hosting and, if you switch it on, whichever mail service you choose. There is no telemetry in it. Nothing phones home.
Where it is
My own records are held in the UK or the EEA. Your books are wherever you host them — that is your choice, and worth knowing if your clients ask you the same question.
Keeping it safe
- Everything goes over HTTPS.
- Passwords are stored as bcrypt hashes and cannot be read back, by me or anybody else.
- Signing in takes a password and a code sent to your email.
- I do not ask for your password and will never have a reason to.
- If I need to get into your install to fix something, I ask first, and you can take the access away afterwards.
If something goes wrong and personal data is exposed, I will tell you as soon as I reasonably can, and the ICO within 72 hours where the rules require it.
What you can ask me to do
You can ask for a copy of what I hold about you, ask me to correct it, ask me to delete it, object to what I am doing with it, or ask for it in a portable form. Email hello@zarexo.co.uk and I will answer within a month.
There is nothing to pay, and you do not need a reason.
If you think I have got it wrong, tell me first — but you can complain to the Information Commissioner's Office at ico.org.uk or on 0303 123 1113, and you do not have to come to me first.
Cookies
This site does not set any. The app sets one when you sign in, and that is all it sets. The details are here.
Changes
If this changes in a way that matters, I will email customers rather than quietly editing the page and hoping.