Zeno identifies devices to prevent fraud and abuse. This policy sets out what customers may and may not do with it. It's part of your agreement with [Company name].
Permitted use
You may use Zeno to protect your own service and its users: to detect fraud, account takeover, fake or duplicate accounts, bots, abuse of promotions and similar threats, and to secure logins and payments.
You must
- Explain in your privacy policy that you identify devices for fraud prevention, and get consent where the law requires it.
- Have a lawful basis for passing us an external ID or other data about your users.
- Use a pseudonymous internal ID as the external ID, not an email address, name or phone number, and keep personal data out of the action and metadata you attach to events (
action,metadata). - Delete a user's data through the API when they ask and the law requires it.
- Keep your secret API keys secret and use them only on your server.
- Treat a visitor ID, signal or risk score as an indication to review, not as proof. Identical devices can share a visitor ID.
You must not
- Use Zeno to track people across websites that aren't yours, for advertising or to build profiles of individuals.
- Use it to identify, locate, stalk or harass a person, or to discriminate unlawfully against anyone.
- Use it to get around a user's choice to not be tracked, where that choice is legally binding on you. This includes serving the agent through a custom domain to identify users who refused: your consent rules apply the same either way.
- Send us special categories of personal data, such as health or religious data, or data about children under the age of digital consent where you know them to be.
- Resell, sublicense or offer Zeno as a service of your own without our written agreement.
- Probe, overload or attack the service, get around usage limits, or reverse engineer it beyond what the law allows.
- Use it for anything unlawful.
Enforcement
We may investigate suspected violations and suspend or end access to the service, with notice where we reasonably can. Report abuse to [privacy contact email].