Privacy Policy

1. Information we handle

Account and profile information includes your account identifier, email address, sign-in information provided by your identity provider, display name, selected avatar, and membership or administrator status. Authentication is provided through Clerk; using Google sign-in also involves Google’s own privacy practices.

Community information includes discussions, replies, issue reports, reactions, solutions, profile details displayed with posts, and moderation records. Service records include credit balances and transactions, earned rewards, plan selections, subscription identifiers, billing status, and payment-related records.

We also handle IP addresses, session identifiers, recent activity times, and counts of actions such as executions, reviews, and specifications. Administrators can inspect recent activity, including user identifiers or names, IP addresses, and approximate country inferred locally from an IP address—not precise device location.

2. Your ABAP source and generated documents

Diagnostic Reports are a separate paid, source-only assessment: Pro 10/month and Teams 20/month per user, independent of specifications and credits. Private reports, local evidence excerpts and a source fingerprint are stored by account to reopen and export the same report. If you explicitly enable diagnostic AI, only controlled finding signals and anonymized rule summaries are shared, never those evidence excerpts or raw source. The 32,000-character, 9,000-token and 180-second request limits apply; no automatic retry is made. Failed generation consumes no report allowance, but attempts are retained for operational safeguards: up to three per source and AI choice, a two-minute failure cooldown, and up to twice the monthly report limit (100 attempts for administrators). Static and AI assessments are not production authorization.

Source code, selection values, and related inputs are sent to our backend when needed to check, execute, debug, review, or generate specifications. These features use server-side runtime and source analysis. By default, ABAP source and source-derived specification content are not sent to an external generative-AI service. Raw ABAP source, comments, names and identifiers, literal values, table rows, and private records are never sent to an AI provider.

Only if you tick the optional AI assist box when generating a specification or PDF, we send an anonymized summary of business rules, calculations, controlled business concepts and static effect boundaries inferred from the program to our AI provider. A reasoning model uses it to produce scenario-focused functional and technical design interpretations. This shares abstract program behavior with that provider, not raw source, names, comments, literal values or table rows. Requests are limited to 32,000 input characters, 9,000 completion tokens, a 180-second timeout and no automatic retries. One explicit recovery attempt for an older failed request is allowed after the deadline fix, within the monthly AI limit. The AI output is cached privately per source/analysis revision and scoped to your account. Monthly AI attempts are capped at Free 1, Pro 30, Teams 50, and Admin 50, separately from your specification allowance; failed attempts count only against the AI budget. Privacy-safe operational diagnostics record fixed failure categories and duration, not source, prompts or provider response bodies.

Free editor sessions are temporary and reset on refresh. Pro, Teams and administrator accounts can save private program source, program names, open tabs, breakpoint definitions and a working data catalog to our backend database. Execution results, analyses, generated selection screens and their entered values are temporary session state and are not restored on refresh; execute or request analysis again to display fresh results. Saved programs are linked to the account and are not shared with other users by default. You can delete saved programs in the program tree. Saved source and data are not automatically deleted when a paid subscription ends. Refreshing does not delete account or service records. Keep your own copies of source files and generated documents.

Only submit code and data you are authorized to share with this service. Avoid credentials, private keys, customer records, production banking or payment information, and other sensitive or confidential data. If you place source code in a public forum post, that post is subject to the community and translation practices below.

3. How and why information is used

We use information to authenticate users, operate the playground and community, maintain credits and rewards, administer subscriptions, answer support requests, moderate content, prevent misuse, investigate failures, and understand usage and registration trends.

Anonymous credit allowances are associated with an IP-based identity. Visitors sharing an IP address may share the same monthly allowance. Registered credit balances are associated with their accounts rather than being reset by refreshing the browser.

Where privacy law requires a legal basis, the relevant basis may include providing the service under our agreement with you, legitimate interests in security and service operation, compliance with legal obligations, or consent where required. Your rights and the applicable basis depend on the processing and your location.

4. Public community and translation

Forum discussions, replies, guidelines, issue reports, and associated public profile details can be viewed by guests. Guests may report issues even without a forum account. Do not include private contact details or sensitive data in a report: reporting an issue is not a confidential support channel.

Forum content may be translated to match the selected English or Spanish language. Translation can send relevant public text to an external translation service, currently OpenAI. Provider processing is governed by its applicable terms and privacy practices. Translations may be inaccurate; retain and consult the original content for important decisions.

Administrators can edit, classify, resolve, hide, or delete community content. A soft deletion can retain content in service records even when it is no longer publicly visible.

5. Service providers and disclosures

We use infrastructure and database providers to host and operate Zed Frame, Clerk for authentication, Stripe for payments and subscription management, and an external provider for forum translation. These providers may process information in countries different from yours, subject to their applicable contractual and legal safeguards.

Stripe collects payment details through its checkout and billing interfaces. Zed Frame receives the billing information needed to administer your subscription, rather than asking you to enter full payment-card details into our editor or forums.

We may disclose information where required by law, to respond to lawful requests, protect users and the service, or facilitate a business transfer subject to applicable protections. Public community content is disclosed by its publication.

6. Cookies, storage, retention, and security

Cookies and browser storage support sign-in sessions, request security, activity identification, and preferences such as language. Blocking necessary storage can prevent sign-in or other features from working. Our own usage analytics include service activity and aggregate action counts.

Retention depends on the purpose and record type. Account, forum, credit, moderation, and billing records may remain while needed to provide the service, resolve disputes, prevent abuse, or meet legal obligations. Some records may persist in backups or with providers after removal from the active service; refreshing the editor is not an account-deletion request.

We use technical and organizational measures to protect information, but no online service is completely secure. Do not rely on the playground as a secure vault for confidential material.

7. Your choices and privacy requests

You can adjust your display name and avatar in Edit Profile and manage paid subscriptions through Subscription & Billing. Depending on applicable law, you may also have rights to request access, correction, deletion, portability, restriction, or objection, and to withdraw consent for processing that relies on consent.

In Mexico, applicable rights include access, rectification, cancellation, and opposition (ARCO) under the Federal Law on Protection of Personal Data Held by Private Parties (LFPDPPP). To exercise these rights, email support@zedframe.com describing the right you wish to exercise and the information concerned. We will explain any identity-verification steps through a private channel. Cancellation of personal data is distinct from cancellation of a paid subscription.

Send privacy requests to support@zedframe.com. We may need to verify your identity before acting. Some requests may be limited by legal, security, billing, or other permitted retention requirements; cancelling a subscription does not automatically delete an account or public posts. Where applicable, you may complain to your local data-protection authority.

8. Children, updates, and contact

Zed Frame is intended for people legally able to use the service and is not directed at children. If you believe a child has provided information without required authorization, contact us.

We may update this policy as the service or legal requirements change. The date above identifies the current version. Where required, we will provide additional notice of material changes.

For privacy questions, contact support@zedframe.com. Do not post passwords, identity documents, or sensitive personal information in the public issue-reporting forum.