This Privacy Notice explains how ZenzoLabs ("we", "us", "our") collects, uses, shares, and protects personal data when you visit our website, sign up for an account, or use our AI-powered analytics service ("Service"). It is written to satisfy the UK GDPR, the Data Protection Act 2018, the EU GDPR (Regulation 2016/679), and the Privacy and Electronic Communications Regulations 2003 ("PECR").
1. Who we are
ZenzoLabs is the controller for personal data we collect about visitors to our website and prospective customers. When you use the Service as a paying customer, you are the controller of the business data you upload, and we act as your processor under a separate Data Processing Agreement.
- Trading name: ZenzoLabs
- Privacy contact: privacy@zenzolabs.com
- ICO registration: in progress (number to be added once issued)
2. What personal data we collect
| Category | Examples | Source |
|---|---|---|
| Identification | Name, work email, company, job title | You (sign-up, contact form) |
| Account | Hashed password, API keys, OAuth tokens for connected sources | You / your data-source provider |
| Usage | Pages visited, queries run, feature use, error logs, IP address | Your browser / our servers |
| Marketing | How you found us, message content | You (contact form) |
| Cookies & analytics | See Cookie Policy | Your browser |
We do not intentionally collect special-category data (race, health, religion, etc.). If you upload such data into the Service, you remain its controller.
3. Why we use it (purposes & lawful bases)
| Purpose | Lawful basis (UK GDPR Art. 6) |
|---|---|
| Provide and operate the Service | Contract |
| Respond to enquiries and demo requests | Legitimate interest (responding to your message) |
| Security, fraud-prevention, audit logging | Legitimate interest + legal obligation |
| Service-improvement analytics (only with your consent) | Consent |
| Billing and accounting records | Legal obligation |
| Sending product updates and marketing emails | Consent (you can unsubscribe any time) |
4. Who we share it with
We share personal data only with sub-processors who help us run the Service. A current list, including the data they process and their location, is maintained at Sub-processors. Key categories include:
- Cloud hosting: our VPS provider in the EU
- Large language model providers: OpenAI, Anthropic, xAI, Google (Gemini) — used only when you select that model and only with the metadata/queries needed to answer your question
- Analytics: Google Analytics 4 (only after you accept the cookie banner)
- Source-code & image registry: GitHub (GHCR)
- Email delivery / contact form: our email provider
We never sell personal data and we never use customer-uploaded business data to train AI models.
5. International transfers
Some of our sub-processors (notably the LLM providers and GitHub) are located in the United States. When personal data leaves the UK or EEA we rely on the appropriate transfer mechanism under UK GDPR Chapter V or EU GDPR Chapter V:
- UK International Data Transfer Addendum (IDTA) to the EU SCCs, or
- The EU Standard Contractual Clauses (Commission Decision 2021/914), or
- The recipient's certification under the UK Extension to the EU–US Data Privacy Framework, where available.
You can request a copy of the relevant transfer mechanism by emailing privacy@zenzolabs.com.
6. How long we keep it
- Account data: for the life of your account + 30 days after deletion.
- Billing records: 6 years (UK statutory requirement).
- Marketing contact data: until you unsubscribe or 24 months of inactivity.
- Server & security logs: 90 days (rolling).
7. Your rights
Under UK GDPR / EU GDPR you have the right to: access, rectify, erase, restrict or object to processing, data portability, and to withdraw consent at any time. To exercise any of these, email privacy@zenzolabs.com. We respond within one month.
You can also delete your account at any time using our Data Deletion procedure.
If you believe we have mishandled your personal data you have the right to complain to:
- UK: Information Commissioner's Office — ico.org.uk/make-a-complaint
- EU: your local supervisory authority — edpb.europa.eu
8. Security
We use TLS in transit, encryption at rest where supported by our hosting provider, role-based access control, audit logging, and a privacy-firewall design that never sends raw business data to third-party LLMs. See our Security Policy for detail.
9. Children
Our Service is a B2B product and is not directed at anyone under 16. We do not knowingly collect personal data from children.
10. Changes to this Notice
We will post material changes here and, for paying customers, notify them by email at least 30 days in advance.
Email privacy@zenzolabs.com. We reply within 2 business days.