Privacy

Who operates MadeFinal

MadeFinal is owned and operated by zsumz LLC. For privacy questions or requests, contact company@zsumz.com.

Information we handle

• Account and workspace information. Names, email addresses, sign-in and verification information, workspace details, branding, team memberships, invitations, and plan choices.
• Client work and review history. Client contacts, uploaded files and previews, filenames and file details, project information, versions, participants, comments, annotations, approval decisions, confirmation wording, and related dates. Workspaces may provide this information about their clients and reviewers.
• Billing information. Subscription and payment status, plan and capacity choices, billing dates, and Stripe customer, subscription, checkout and event identifiers.
• Support and service communications. Messages you send us, your contact details, relevant workspace information, and records of email recipients, delivery attempts and delivery status.
• Technical and security information. Session identifiers, browser or device information, and, where available, IP addresses. We also maintain error and security records, including operational identifiers and records used to limit abuse.

How we use information

We use this information to provide workspaces and reviews, authenticate users, control access, deliver files and approval records, process subscriptions, send service messages, answer support requests, investigate errors, prevent abuse, and manage exports, retention and deletion.

Review history records what happened to a particular version, including the participant identity associated with feedback or an approval. Information in an approval record may remain part of that project’s history even if a contact or team membership later changes.

Workspaces, reviewers and sharing

Workspace users choose what work to upload and whom to invite. Information you provide in a review can be visible to the workspace team and other participants with access to that review. Owners can export workspace information, including client contacts and review history.

A personal review link grants access without requiring an account. Anyone who receives a valid link may be able to use its access, so keep it private and ask the workspace to revoke it if it is shared by mistake. Client portal access uses an email-verified session. An approval made through a review link records that access method; it is not independent verification of the person holding the link.

If a workspace invited you, contact that workspace about its use of your information and its review records. You can also contact us about information handled by MadeFinal. Downloaded files and exports are outside our control.

Payments and service providers

Stripe provides hosted Checkout and billing management. Payment details you enter there are handled by Stripe. MadeFinal receives the identifiers and billing status needed to manage your subscription; it does not store your full card number. Stripe describes its handling of information in its privacy policy.

Hosting, database, file storage and email services also process information needed to run MadeFinal. Disclosure of information may also be required by applicable law.

TBD — WILL UPDATE. Production hosting, database, storage and email providers; processing locations and any required international transfer arrangements; hosted backup retention and recovery; retention periods for operational logs, support messages and other separately held records; and privacy-request procedures are still to be confirmed. We will update these details before publishing the final policy.

Cookies and preferences

The application uses cookies to maintain sign-in sessions and remember the selected workspace. It uses browser storage to remember your appearance preference. Blocking or clearing these may sign you out, reset preferences, or prevent parts of the app from working.

When analytics is configured, you can choose whether to allow optional visitor measurement on our website and business app. Accepting stores a random visitor identifier in a first-party cookie for up to 90 days so we can understand visits, signup, workspace setup, uploads, draft saves and sending reliability. Declining leaves visitor measurement off. You can change your choice through Analytics preferences; browser privacy signals also disable visitor measurement. Public review and client portal pages are excluded.

An enabled PostHog integration also receives aggregate service outcomes, such as review publication, approval decisions and paid-plan activation. These counts use a shared service identifier, separate from optional visitor measurement; they are not individual user or workspace profiles. We send only defined event details, such as plan, participant count or decision status, and do not send private links, access tokens, names, email addresses, filenames or feedback content. We do not use automatic interaction capture or session replay.

No analytics events are sent until the operator configures PostHog. Its selected US or EU region determines where analytics events are processed. Hosting and service providers may separately maintain operational logs.

Retention, exports and deletion

Workspace recovery windows are 30 days after unpaid trial access ends, or 90 days after previously paid access and any payment grace period end. After the applicable window, workspace data is scheduled for permanent removal. Owners can export their workspace during the recovery window. See Data and billing for the details.

These windows describe workspace availability. They are not a deletion deadline for user accounts, support messages, security or billing records, or backups. Some account and eligibility records, provider event records, and minimal deletion records are handled separately from workspace data.

Owners can permanently delete an archived project. Application access closes when the deletion takes effect, while stored-file removal runs separately and may need retries. Previously issued download links may work until their short expiry or file removal. Deleting a project does not cancel a subscription or delete a user account.

Full account or workspace deletion requests are handled through support. Removing live data does not immediately erase backup copies. We do not currently guarantee a backup erasure deadline.

Your requests

Contact company@zsumz.com to ask about, access, correct or request deletion of your information. Depending on the laws that apply to you, you may have additional rights to object to or restrict processing, receive a copy of information, or complain to a privacy authority.

We may need to verify your identity and authority over a workspace before acting. Requests involving a workspace’s client or review records may need to be coordinated with that workspace. Available rights, exceptions and response deadlines depend on applicable law.

Processing locations

MadeFinal is intended for international use. Service providers may process information in countries other than the one where you live, where data-protection laws may differ. We do not currently offer a data-residency commitment. The provider and transfer details listed above will be updated once those arrangements are confirmed.

Changes and contact

We will update this page when our practices change and show the revised date. Where applicable law requires additional notice, that notice will accompany the change. Questions about this draft can be sent to company@zsumz.com.