Privacy Policy

For the purposes of GDPR Article 4(7), the data controller of personal data processed about you when you visit our website or hold an Account is Zenith Intelligence Technologies Inc., registered in the State of Maryland, United States.

For personal data processed within a workspace on behalf of a customer (for example, data submitted by a workspace owner about their own contacts, customers, or employees), the customer is the controller and we act as the processor under our Data Processing Agreement.

Privacy contact: [email protected]. Data Protection Officer: [email protected].

Account information. When you create an Account, we collect your name, email address, password (hashed using Argon2id), workspace name, organization role, and locale preference.

Billing information. For paid plans, our third-party payment processor collects your payment method details. We do not store full card numbers on our systems; we retain only a last-four reference and an expiry month for receipt purposes.

Content. We process the Content you submit to the Service, including contacts, calendar events, emails, deals, documents, and any other data you store in your workspace. Content is processed under the customer's instructions as described in Section 1.

Usage data. We collect logs of how you interact with the Service, including IP address, browser type, referrer, pages visited, timestamps, and feature usage. This data is used to operate, secure, debug, and improve the Service.

Cookies and similar technologies. We use a small number of strictly necessary cookies for authentication and session management. We do not set advertising or cross-site tracking cookies. See Section 9.

Communications. If you contact us by email or through the Service, we keep a record of the correspondence to address your request.

Provide the Service. To create and maintain your Account, process workspace data, deliver notifications, render search results, and operate every module you activate.

Secure the Service. To detect, prevent, and respond to fraud, abuse, security incidents, and violations of our Terms of Service.

Comply with law. To meet legal obligations, including responding to lawful requests by public authorities, and to enforce our Terms.

Communicate. To send transactional emails (for example, password resets, invoices, security alerts), service announcements, and, only with your consent or where otherwise permitted, product updates.

Improve the Service. To analyze aggregated, de-identified usage trends in order to design better features. We do not analyze the content of individual workspaces for product-improvement purposes.

Where the GDPR applies, we rely on the following lawful bases under Article 6: (a) performance of a contract with you, to provide the Service you have requested; (b) compliance with a legal obligation; (c) our legitimate interests in operating, securing, and improving the Service, where those interests are not overridden by your rights; and (d) your consent, where we ask for it (for example, optional marketing communications), which you may withdraw at any time.

We do not sell personal information. We do not share personal information for cross-context behavioral advertising. We disclose information only as described below.

Service providers (sub-processors). We use a limited set of vetted sub-processors to host infrastructure, process payments, send transactional emails, and provide error monitoring. A current list is maintained at https://zisquare.app/legal/dpa and updated when sub-processors change. Each sub-processor is bound by data-protection terms equivalent to those we offer you.

Workspace administrators. Information you submit within a workspace is visible to other authorized members of that workspace, subject to the access controls configured by the workspace administrators.

Legal and safety. We may disclose information if required to do so by law, in response to valid legal process, or where we believe in good faith that disclosure is necessary to protect rights, property, or safety.

Business transfers. If we are involved in a merger, acquisition, financing, or sale of assets, your information may be transferred as part of that transaction. We will provide notice before personal information becomes subject to a different privacy policy.

We retain Account information for as long as your Account is active and for a reasonable period afterwards to comply with legal obligations, resolve disputes, and enforce our agreements.

Content is retained for as long as it remains in your workspace. When your Account is terminated, we make Content available for export for thirty (30) days and then delete it from active systems within sixty (60) days, except where retention is required by law.

Usage logs are typically retained for ninety (90) days, after which they are aggregated and de-identified.

Customers using the Document Vault module can configure custom retention policies and legal-hold flags that override these defaults for documents stored in their workspace.

We are headquartered in the United States. If you access the Service from outside the United States, your information will be transferred to and processed in the United States and in any country where our sub-processors operate.

Where we transfer personal data from the European Economic Area, the United Kingdom, or Switzerland to a country that has not received an adequacy decision, we rely on the European Commission's Standard Contractual Clauses, the UK International Data Transfer Addendum, or equivalent safeguards, as applicable.

Customers may select EU-resident hosting where offered for that workspace. Contact [email protected] for details.

Subject to applicable law, you have the right to: (a) request access to the personal data we hold about you; (b) request correction of inaccurate or incomplete data; (c) request deletion; (d) object to or restrict certain processing; (e) request portability of data you provided to us in a machine-readable format; and (f) withdraw consent at any time where processing is based on consent.

California residents have additional rights under the CCPA/CPRA, including the right to know what categories of personal information we have collected, the right to delete personal information, the right to correct inaccurate information, the right to opt out of "sales" or "sharing" (we do not engage in either), and the right not to be discriminated against for exercising these rights.

To exercise any of these rights, contact [email protected]. We will respond within the timeframes required by applicable law. You also have the right to lodge a complaint with your local supervisory authority.

We use strictly necessary cookies and equivalent local-storage entries to authenticate your session, remember your locale, and protect against cross-site request forgery. We do not use third-party advertising cookies and do not participate in cross-site tracking. Because all cookies we set are strictly necessary, no consent banner is required under the EU ePrivacy Directive.

We apply industry-standard administrative, technical, and physical safeguards designed to protect personal information against unauthorized access, alteration, disclosure, and destruction.

Specifically: passwords are hashed using Argon2id; designated sensitive fields are encrypted at rest using our ZI² Hybrid scheme (AES-256-GCM on ingestion combined with Kyber, a post-quantum cipher, for at-rest storage); transport security uses TLS 1.3; time-based one-time-password (TOTP) multi-factor authentication is available; per-tenant database isolation is available on request for Enterprise customers; and an audit log records administrative actions. WebAuthn passkeys and SAML/OIDC SSO are on our published roadmap and are not yet shipped.

No method of transmission over the Internet or method of electronic storage is 100% secure. While we strive to use commercially acceptable means to protect your information, we cannot guarantee its absolute security. Suspected security incidents should be reported to [email protected].

The Service is not directed to children under 16. We do not knowingly collect personal information from children under 16. If you believe that a child under 16 has provided us with personal information, please contact [email protected] and we will take steps to delete that information.

We do not use personal data to make decisions about you that produce legal or similarly significant effects without human involvement.

We may update this Policy from time to time. Where changes are material, we will provide notice by email, in-app notification, or a prominent notice on our website at least thirty (30) days before they take effect. The "Last updated" date at the top of this Policy reflects the most recent revision.

For questions or requests related to this Policy, contact [email protected].

Zenith Intelligence Technologies Inc., State of Maryland, United States of America.