Privacy policy
Updated
What we collect when you use ZiroTV, why, who else receives it, how long we keep it, and how to see or delete it.
1. Who we are
This policy explains how BITVIRE, a sole proprietorship (eenmanszaak) registered with the Netherlands Chamber of Commerce (KvK) under number 97211699, trading as ZiroTV (“we”, “us”) handles personal data when you use the ZiroTV app, this website and the account portal at app.zirotv.com. We are the controller of that data.
For anything about your data, email info@bitvire.com.
2. This website and the account portal
zirotv.com sets no cookies and stores nothing on your device. Its fonts come from our own server, so no font service sees your visit.
We count visits with Ahrefs Web Analytics, which works without cookies. With each page view it receives your IP address, the page, the page you came from and your browser and device type. We only see totals, such as views per page and visitors per country, never data about you as a person.
Our servers log each request with its IP address, its time and the page or file asked for, to keep our systems secure and to find faults. How long we keep logs is in section 12.
app.zirotv.com sets one cookie, which keeps you signed in. It is strictly necessary, so it needs no consent. It expires after 60 days, or when you sign out.
3. The app
When ZiroTV first opens on a device, it registers the device with our server. We store:
- A random identifier the app creates when it is installed. It is not your device’s own ID, and it changes if you reinstall.
- The device code shown on the screen. It stays the same until the app is reinstalled or its data is cleared.
- The pairing key shown with it, as a hash. From version 1.1.10, the app gets a new key for every pairing, and each key stops working after 10 minutes. Version 1.1.9 and earlier show one key that stays the same, and it keeps working after an update to 1.1.10 for a transition period.
- The type of device: TV, Android phone or iPhone
- When your free trial started and ends, and when the device was first and last seen
We use this to run the free trial, to link the device to your account and to check your plan.
Your playlists, favourites, profiles, settings and watch progress are kept in the app on your device. Without an account, none of them leave it.
The app connects straight to your IPTV provider to load your playlist, the TV guide and the streams. That traffic does not pass through us. Your provider receives your IP address and your login, and its own privacy policy applies. A trailer opens on YouTube, where Google’s privacy policy applies.
4. How many people use the app
The app already contacts our server to check your trial or plan. With those requests it tells us its platform (Android TV, Fire TV, Android, iOS or tvOS) and its version. From them, our server keeps one record for each day a device used the app: the device’s random identifier, the date, the platform and the app version.
We store no IP address with these records, no location or country, and nothing about which screens you open or what you watch. They only let us count how many devices use ZiroTV each day, how many are new, and which platforms and versions they run. Only our own admins see those totals.
We do this on the basis of our legitimate interest in knowing how many people use ZiroTV and on which devices, so we can maintain and improve it (art. 6(1)(f)). We share these records with no one, and we do not use them for profiling or advertising. Each record is deleted automatically 16 months after the day it describes, and straight away when the device record or your account is deleted.
5. Adding a playlist from your phone
The QR code your TV shows for this works for 10 minutes. When you enter a playlist on your phone, we hold it on our server until the TV collects it: the playlist’s name and type, the server address, user name and TV guide link, and the password or M3U link, encrypted.
The TV deletes it from our server as soon as it has collected it. A playlist no TV collects is deleted within 24 hours.
6. Your account
When you create an account on app.zirotv.com, we store:
- Your email address, and your name if you give it
- Your password, as a hash that cannot be turned back into the password
- When you confirmed your email address and when you last signed in
- Short-lived codes for confirming your email address and resetting your password
- Your plan: its type, status, renewal date and number of screens
- Which devices are signed in to your account
With an account, the app can sync your playlists to your other screens. Cloud sync is on by default, and you can turn it off on the account screen in the app. While it is on, we store your playlists: their names and settings, with their logins and links encrypted. Your favourites, profiles, settings and watch progress are not synced; they stay on each device.
We email you only about your account: codes to confirm your address or reset your password, and a confirmation when your account is deleted. We send no newsletters or marketing email.
7. Payments
Payments on app.zirotv.com go through Mollie B.V. For a monthly or yearly plan, we register you as a customer at Mollie with your email address and, if you gave one, your name. You enter your card or bank details at Mollie, and we never see them.
We keep a record of each payment: the Mollie payment ID, the plan, the amount, the VAT, the currency, the status and the date. Your account also holds your Mollie customer and subscription IDs. Mollie processes payment data as a controller in its own right, under its own privacy statement.
Purchases in the iPhone app go through Apple. Apple tells us which plan you bought and gives us a transaction ID, which we store to keep your plan active. Apple handles the payment itself, under its own privacy policy.
8. Support email
When you email us, we keep your message, your email address and our reply, so we can help you and handle any follow-up. Please never send us your playlist password.
9. Why we use your data
We use personal data only for these purposes, each on the legal basis the GDPR gives for it.
| Purpose | Data | Legal basis |
|---|---|---|
| Running your trial, your account, sync and your plan | Device records, account data, synced playlists | Contract (art. 6(1)(b)) |
| Account email: codes and confirmations | Email address | Contract (art. 6(1)(b)) |
| Taking payments | Payment records, Mollie and Apple IDs | Contract (art. 6(1)(b)) |
| Keeping our books | Payment records | Legal obligation (art. 6(1)(c)) |
| Answering your questions | Support email | Contract, or our legitimate interest in helping you (art. 6(1)(b) and (f)) |
| Security, fixing faults and preventing trial abuse | Server logs, device records | Legitimate interest (art. 6(1)(f)) |
| Counting how many people use the app, and on which platforms and versions | Daily usage records | Legitimate interest (art. 6(1)(f)) |
| Counting visits to this website | Page views, without cookies | Legitimate interest (art. 6(1)(f)) |
Where we rely on our legitimate interest, you may object (section 14). We send no marketing email; if we ever want to, we will ask for your consent first.
10. Who receives your data
We share personal data only with these companies, and only what each of them needs.
| Recipient | What for | Established in | Role |
|---|---|---|---|
| Hetzner Online GmbH | Hosts our servers, the database and its backups, in its data centre in Nuremberg, Germany | Germany | Our processor |
| Our email provider | Sends account email and holds the support mailbox | The EU, or a country with an EU adequacy decision | Our processor |
| Ahrefs Pte. Ltd. | Counts visits to this website, without cookies | Singapore | Our processor |
| Cloudflare, Inc. | Answers DNS lookups for our domain names | United States | Our processor |
| Mollie B.V. | Takes payments on the account portal | The Netherlands | Its own controller |
| Apple Distribution International Ltd. | Takes payments made in the ZiroTV app on iPhone | Ireland | Its own controller |
A processor works only on our instructions, under a data processing agreement. A controller decides for itself how it uses the data it receives, under its own privacy policy. We do not sell personal data, and we do not share it with advertisers. We disclose it to others only where the law requires it, for example to the tax authority.
11. Transfers outside the EU
Ahrefs Pte. Ltd. (Singapore) and Cloudflare, Inc. (United States) are established outside the European Economic Area, and those transfers are covered by the EU standard contractual clauses. Our email provider is in the EU, or in a country the European Commission has found to protect personal data adequately. The other recipients are established in the EU.
12. How long we keep data
- Account data and synced playlists: until your account is deleted. They then leave our database straight away, and our backups within seven days, as we keep each nightly backup for seven days.
- Payment records: seven years, as Dutch tax law requires. When your account is deleted, they are no longer linked to it.
- Device records: as long as the device is linked to an account. A device on no account, including one you removed or one whose account was deleted, is deleted 12 months after it last contacted our server. Device records hold no name or email address.
- Daily usage records: 16 months after the day they describe, or until the device record or your account is deleted, if that comes first (section 4).
- Playlists sent from your phone: until the TV collects them, and never longer than 24 hours (section 5).
- Email and password codes: a code works for 15 minutes. A used code is deleted straight away, and an unused one within a day of expiring, because wrong tries on it count until then.
- Wrong-password counts: for each account email address and the internet address a sign-in came from, the number of wrong passwords and any lock they caused, deleted within 24 hours of the last wrong one.
- Server logs: we keep a fixed amount, so the oldest entries are deleted as new ones arrive.
- Support email: two years after our last reply.
13. How we protect your data
- Every connection to this website, the account portal and our server is encrypted with TLS.
- Playlist passwords and links are encrypted with AES-256-GCM before they are stored.
- Passwords are stored as scrypt hashes, and pairing keys and one-time codes as hashes too.
- The database keeps each account’s data apart with row-level security, so one account cannot read another’s.
14. Your rights
Under the GDPR, you have the right to:
- See the personal data we hold about you
- Have it corrected
- Have it deleted, including your whole account
- Limit how we use it
- Receive it in a portable format. The app’s backup also exports your playlists and settings to a file.
- Object to our use of it on the basis of legitimate interest
To use any of these rights, email info@bitvire.com from the address on your account.
You can also delete your account yourself: sign in at app.zirotv.com, choose Delete account and confirm with your password. Either way, we cancel any payments set up through Mollie, delete the account and confirm by email. Your payment records are kept for seven years, no longer linked to you (section 12). An App Store subscription keeps running until you cancel it with Apple, so cancel that as well.
We answer within one month. If a request is complex, we may take two more months, and we tell you so within the first month.
If you think we handle your data wrongly, please tell us first. You also have the right to complain to the Dutch data protection authority, the Autoriteit Persoonsgegevens, or to the authority in the EU country where you live.
15. Children
ZiroTV is not meant for children under 16, and we do not knowingly collect their data. Kids profiles in the app are a tool for parents; they are kept on the device and send nothing to our server.
16. No profiling, no selling
We do not use your data for profiling or advertising, we make no decisions about you by automated means that have legal or similarly significant effects, and we never sell personal data.
17. Changes to this policy
We update this policy when what we do with personal data changes. The date at the top of this page shows the current version. If a change affects you, we email you at least 30 days before it applies.
18. Contact
Questions about this policy or your data go to info@bitvire.com. For help with the app, email support@zirotv.com. Our full company details are on the contact page.