Privacy Policy

Zyra Land is a virtual workspace service operated by Bubilabs ("we", "us"). This policy explains what personal data we collect, why we collect it, and the choices you have. For any privacy question, contact support@bubilabs.com.

• Account data: email address, display name, and a hashed password (we never store your password in readable form).
• Workspace content: notes, chat messages, whiteboard objects, and room activity that you and your team create.
• Presence data: your online status and avatar position while you are using a workspace.
• Push notification subscriptions: a device endpoint, only if you enable notifications.
• Technical logs: IP address, browser type, and error logs used to keep the service running and secure.

We use your data only to provide and improve the service: operating your workspaces, syncing presence, delivering notifications you asked for, securing accounts, and responding to support requests.

We do not sell your personal data. We do not use advertising trackers.

We use a single essential cookie: an httpOnly refresh-token cookie that keeps you signed in securely. We do not use third-party advertising or analytics cookies.

Your data is processed by these infrastructure providers on our behalf:

• Vercel — web hosting
• Railway — API servers and database
• Cloudflare — DNS
• Resend — transactional email (e.g., password reset)

Each provider processes data only as needed to run the service.

Your data is kept while your account is active. If you cancel or delete your account, you have 30 days to export your room notes, history, and workspace data before it is removed from our systems.

To request deletion or export, contact support@bubilabs.com.

All traffic is encrypted in transit (TLS). Access tokens are never stored in browser storage. Passwords are hashed. Rooms can be set to private, and tenant data is isolated per organization.

No system is perfectly secure — if we learn of a breach affecting your data, we will notify you without undue delay.

You may access, correct, export, or delete your personal data at any time. Under Thailand's Personal Data Protection Act (PDPA) and similar laws, you may also object to or restrict certain processing.

Exercise any of these rights by contacting support@bubilabs.com. We respond within 30 days.

We may update this policy as the service evolves. Material changes will be announced on this page with a new effective date. Continued use after changes means you accept the updated policy.