Product privacy information

1. Who handles the information

For customer workspace records, the customer decides what information to provide and how it will be used. Zen & Zen processes that information to provide the requested service. The customer is responsible for its notices, lawful instructions, and permissions.

For account administration, billing, security, and our own communications, Zen & Zen decides the necessary processing purposes. The applicable controller, processor, or service-provider role depends on the information and the law.

If your information was added by a business using Zen & Zen, contact that business first about its use of your records. We will help the business handle requests that apply to data processed for it. Contact us directly about information we handle for our own account or billing purposes.

2. Information the product handles

Workspace data may include leads and contacts, company details, notes, tickets, messages, activity history, files, and call content or transcripts when those features are enabled. We receive it from the customer, authorized users, and connections the customer chooses.

Account information includes names, business contact details, verified email addresses, membership and permission settings, subscription details, transaction references, and support correspondence. Payment providers handle payment-method information needed for billing or verification.

Service information may include sign-in and security events, IP addresses, device/browser details, timestamps, error reports, and usage measurements needed to run the product and calculate charges. The product may use essential session storage or cookies for sign-in and preferences.

3. What the information is used for

We use information to provide the requested workspace, authenticate users, enforce access permissions, deliver enabled features, manage subscriptions and usage charges, respond to support requests, maintain recovery capability, and protect against abuse or security incidents.

We also use necessary information to comply with applicable legal obligations and communicate about the service.

4. Optional AI and connected agents

When you enable an AI feature, the information needed for that feature may be sent to its provider—for example, call content for transcription or lead context for a follow-up. Keep the information shared appropriate for the task and review the feature’s setup.

Your own agents and integrations can read or update data within the access you grant. You control those connections and are responsible for their independent handling of exported or retrieved information.

5. Service providers and disclosures

Providers process information needed to supply hosting, backups, email delivery, billing, AI, or phone services enabled for your workspace.

We may disclose necessary information when legally required or to address fraud, a serious security issue, or threats to rights or safety. We will not treat this as permission to disclose an entire customer database for unrelated purposes.

Services you connect independently operate under their own terms. Ask us for the current product provider list and any processing agreement needed for your use case.

6. Where workspaces are housed

Customer workspaces are housed in data centers in the United States. We also maintain encrypted backups and recovery checks.

A US workspace location does not by itself establish the location of every independently connected service or optional provider’s processing. Discuss any processing-location, contractual, or international-transfer requirements with us before enabling the relevant connection.

7. Ownership, export, and deletion

Your workspace data belongs to you. You can download your full database and request that all of your workspace data be removed from our servers. We do not hold your own data hostage to keep you subscribed or resolve a billing dispute.

After verifying that the request is authorized, we remove customer workspace data and retained copies under our control, including backups. Once deletion is complete, we do not retain that workspace data. Export anything you wish to keep before deletion. Canceling a renewal alone is not a request to erase the workspace.

Copies held by an independent service you connect are managed under that service’s terms. Contact that service to request removal of those copies.

8. Access and protection

The platform supports verified-email sign-in, owner-managed workspace membership, staff permissions, and encrypted backups with restore checks.

Protect your sign-in access and agent credentials, review member permissions, and report suspected unauthorized activity. If a security incident requires notification under applicable law or an agreed contract, we will provide that notification. No system can promise absolute security.

9. Requests and choices

Depending on the law that applies, you may have rights to access, correct, delete, or receive a copy of personal information, object to or limit certain processing, withdraw consent, opt out of certain uses, and complain to a relevant authority. We will respond as applicable law requires and will not penalize you for exercising protected rights.

Use our contact page to make a request. We may need enough information to verify your identity and authority without collecting unnecessary data. A person named in a customer’s records should usually ask that customer first; the customer can ask us to assist.

Contact our white-glove support team through the contact page for privacy, export, or deletion requests.

10. Changes and contact

We will communicate material changes to affected customers and obtain consent where required before expanding the purposes for which customer workspace data is used.

Contact Zen & Zen through the contact page with questions about your product data. The separate website privacy notice explains information sent through marketing website forms.