Skip to content

Privacy Policy

Effective date: October 2026
Last updated: October 20, 2026

This policy explains what personal information zakitpro.com (the "site") collects, why, who else handles it, how long it is kept, and the choices and rights you have. It covers only what the site actually does. "We", "us" and "our" mean the controller named below.

1. Who is responsible (the controller)

The controller of personal information collected through the site is ZakitPro, operated by Abderrazak Elbouchikhi (Zak), sole proprietor. Mailing address: PO Box 35260, Denver, CO 80202, United States. Email: hello@zakitpro.com. We have not appointed a data protection officer, and we have not appointed an EU or UK representative because our processing is occasional, low-risk and does not involve special-category data at scale (Article 27(2) GDPR and UK GDPR). EU and UK residents can contact us directly at hello@zakitpro.com.

2. What we collect

Information you give us

  • Email address and signup source. When you enter your email in a signup form (for example the free cheat sheet, the AI Toolkit, the Field Runbook waitlist, the AI certification list or the Intune App Analyzer beta), we receive your email address and a tag showing which form you used. We do not ask for your name.
  • Purchase information. If you buy a digital product, you pay on a Stripe-hosted checkout page. Stripe collects your payment card details, email address, billing details and the purchase. We never see or store your full card number. When you return to our thank-you page, our server asks Stripe only to confirm that the checkout session is paid, which products it included and the email address you paid with. If that address is already on our email list, we add it to a "buyers" group in MailerLite so we stop sending you sales emails for the product. We never add you to our email list just because you bought something.
  • Messages. If you email us, we receive your email address and whatever you include.

Information collected automatically

  • Analytics (Google Analytics 4). GA4 loads on every page. It records pages viewed, referrer, approximate location (derived from IP address), device, browser, and custom events for signup forms (submit, success and error, with form location and download name), file downloads, outbound and affiliate link clicks, and coarse Intune App Analyzer usage (never what you type or paste). Your email address is never sent to Google Analytics. The site's tag is a standard gtag('config') call; it does not turn on Google Signals or ad personalization.
  • Hosting logs. Vercel, which hosts the site and its server functions, processes request data such as IP address, requested URL, time, user-agent and referrer to deliver the site, keep it secure and record errors. Our own server code is written not to log email addresses.
  • Cookies and local storage. See section 6 and the Cookie Policy.

What we do not collect

There are no user accounts and no comments. The in-browser tools (such as the Intune App Analyzer) and site search run in your browser; what you type or paste into them is not sent to us. Fonts are served from this site, not from a third party.

3. Why we use it, and our legal bases

The GDPR and UK GDPR require a legal basis for each use. For visitors elsewhere, these are simply the purposes we use the information for.

  • Delivering the free download or list you signed up for and sending related emails (welcome emails, the download link, launch news, occasional articles): your consent (Art. 6(1)(a)). You can withdraw it at any time with the unsubscribe link.
  • Selling and delivering digital products, handling refunds and support: performance of a contract with you (Art. 6(1)(b)).
  • Keeping tax and accounting records of purchases: compliance with legal obligations (Art. 6(1)(c)).
  • Site analytics, to learn which pages and downloads are useful: for visitors in the EU, EEA, UK and Switzerland, your consent (Art. 6(1)(a)), given through the cookie banner; analytics cookies are not set until you accept. Elsewhere, our legitimate interest in understanding how the site is used (Art. 6(1)(f)), with an opt-out through "Cookie settings" in the footer.
  • Hosting, security, abuse prevention and backups (including the hidden anti-spam field on forms and the signup backup sheet): our legitimate interests in running a secure, reliable site (Art. 6(1)(f)).

We do not use your information for automated decisions that have legal or similarly significant effects on you.

4. Who receives your information

We share personal information only with these service providers, which process it to provide their services to us, and when the law requires disclosure:

  • Google LLC: Google Analytics 4 (analytics) and Google Sheets / Apps Script (a private backup copy of signups, sent through our LEADS_WEBHOOK_URL integration). Google Privacy Policy.
  • MailerLite: stores the email list, groups subscribers by signup (groups: cheat-sheet, runbook-waitlist, ai-cert, copilot-agents, and buyers for subscribers who have bought a product) and sends our emails, including engagement data such as opens and clicks. MailerLite Privacy Policy.
  • Stripe: hosts checkout (Payment Links) and processes payments and refunds. Stripe is also an independent controller for some data, for example for fraud prevention. Stripe Privacy Policy.
  • Vercel Inc.: hosts the site and server functions and keeps request logs. Vercel Privacy Policy.
  • Amazon: if you click an Amazon affiliate link, you leave our site and Amazon collects information under its own policy, including to attribute purchases to us. We receive only aggregated sales reports, not your identity. Amazon Privacy Notice.

We do not sell personal information, rent our list, or share it with advertisers.

5. International transfers

We are based in the United States, and our providers process data in the United States and other countries. If you are in the EU, EEA, UK or Switzerland, your information is transferred to countries that may not offer the same level of protection as your own. Where required, these transfers rely on the provider's certification under the EU-U.S. Data Privacy Framework (and its UK Extension and Swiss framework) or on the European Commission's Standard Contractual Clauses (with the UK Addendum), as set out in each provider's data processing terms.

6. Cookies and similar technologies

The site uses Google Analytics cookies (_ga, _ga_<container-id>), a functional download cookie (ai_toolkit_access) set only after you sign up, and a local-storage entry for your light/dark theme. Full details, durations and how to control them are in the Cookie Policy. The site does not currently respond to "Do Not Track" or Global Privacy Control signals; since we do not sell or share personal information, there is nothing for those signals to opt you out of.

7. How long we keep it

  • Email list: until you unsubscribe or ask us to delete it. Unsubscribed addresses may be kept on a suppression list so we do not email you again.
  • Signup backup sheet: until you ask us to delete it or unsubscribe; we remove unsubscribed addresses from it when we process the unsubscribe or deletion request.
  • Purchase records: for 7 years after the end of the tax year of the purchase, to meet U.S. tax and accounting record-keeping requirements. Stripe keeps its own records under its policy.
  • Analytics data: our GA4 property keeps event-level data for 2 months and user-level data for 14 months (reset each time you return). Aggregated reports are kept longer but do not identify you.
  • Hosting logs: kept by Vercel for a limited period under its own retention policy; see Vercel's Privacy Policy. If Vercel Web Analytics is enabled, it is cookieless and reports only aggregated data.
  • Emails you send us: as long as needed to deal with your message and any follow-up.

8. Your rights in the EU, EEA and UK (GDPR / UK GDPR)

You have the right to access your personal data, have it corrected, have it erased, restrict or object to its processing (including objecting at any time to direct marketing), receive a portable copy, and withdraw consent at any time (this does not affect processing before withdrawal). You can complain to your local data protection authority, such as the UK Information Commissioner's Office. We would appreciate the chance to deal with your concern first.

9. Your rights in California (CCPA / CPRA)

In the past 12 months we have collected these categories of personal information: identifiers (email address, IP address, cookie IDs); commercial information (products purchased); internet or other electronic network activity (pages viewed, events); and approximate geolocation. Sources, purposes and recipients are described in sections 2 to 4. We disclose these categories to the service providers listed in section 4 for business purposes only.

We do not sell or share your personal information, as "sell" and "share" (for cross-context behavioral advertising) are defined by California law, and we have no actual knowledge of selling or sharing information of consumers under 16. We do not collect sensitive personal information.

You have the right to know what we collect, use and disclose; to access, delete and correct it; and not to receive discriminatory treatment for exercising these rights. Whether California law applies to us depends on thresholds we may not meet, but we honor these requests from anyone.

10. How to make a request

Email hello@zakitpro.com with the subject "Privacy request" and the email address you used with us. To protect you, we may ask you to confirm the request from that address. An authorized agent may make a request with your signed permission. We respond within one month (GDPR/UK GDPR) or 45 days (CCPA), and tell you if we need an extension the law allows. Requests are free unless they are manifestly unfounded or excessive. To stop emails, use the unsubscribe link in any email.

11. Children

The site is written for IT professionals and is not directed to children under 16. We do not knowingly collect personal information from anyone under 16. If you believe a child has given us information, email us and we will delete it.

12. Security

The site is served only over HTTPS. Payment details are handled by Stripe, not by us. Download links are signed and expire. API keys are kept in server environment variables, and access to our provider accounts is restricted. No method of transmission or storage is completely secure, so we cannot guarantee absolute security.

13. Changes to this policy

We will update this policy when the site or the law changes and revise the "Last updated" date above. If a change materially affects how we use information we already hold, we will tell subscribers by email before it takes effect.

14. Contact

Email hello@zakitpro.com or write to PO Box 35260, Denver, CO 80202, United States.