GDPR at Zetra

Zetra is used by businesses in the European Union and the United Kingdom to answer their customers. This page explains how we handle personal data under the EU General Data Protection Regulation (GDPR) and the UK GDPR, and what you get to meet your own obligations.

1. Our role

For the content you add to Zetra (your documents, website pages, and the conversations your agents have with your customers), your business is the controller and Zetra is the processor: we process that data only to provide the service, on your instructions, as set out in our Data Processing Agreement. For your own account details (name, email, billing), Zetra is the controller, as described in our Privacy Policy.

2. Where data is stored

The Zetra application, its database and its backups are hosted by Hetzner Online GmbH in Helsinki, Finland, inside the European Union. Database backups are kept for about 14 days and then rotated out.

3. International transfers

To generate answers, the relevant passages of your content and the visitor's question are sent to the AI model provider your workspace uses (OpenAI by default; Anthropic or Google if you choose their models). These providers process data in the United States. Such transfers rely on the European Commission's Standard Contractual Clauses (and the UK Addendum where relevant), as described in section 6 of the DPA. The full list of providers and what each does is on our Subprocessors page.

4. Data Processing Agreement

Our DPA forms part of the Terms of Service and applies automatically to every customer, so there is nothing extra to sign. It covers the scope and purpose of processing, confidentiality, security measures, subprocessors, international transfers, breach notification within 72 hours, assistance with data subject requests, deletion at the end of the service, and audit rights. If your procurement process needs a countersigned copy, email [email protected].

5. Security

• All traffic to Zetra is encrypted in transit with TLS.
• Every query is scoped to your workspace and agent in the database layer, so one customer's content can never appear in another's answers.
• Stored credentials for your integrations are encrypted with AES-256-GCM.
• Sign-in sessions are signed, httpOnly cookies, with rate limiting on public endpoints. Admin access requires two-step verification.

More detail is on our Security & Trust page.

6. Helping you answer data subject requests

When one of your customers asks to see or delete their data, you can act on it yourself:

• Access and export: every conversation can be viewed in your dashboard, and contacts and collected leads can be exported as CSV.
• Erasure: delete a single conversation, all conversations for an agent, a contact, or an entire agent with all its data.
• Anything else: email [email protected] and we'll help within the time the law requires.

7. Retention and deletion

Your content and conversations are kept until you delete them or your workspace. When you close your account we delete your workspace data within 30 days, apart from copies in short-lived backups (about 14 days). Details are in the Privacy Policy and on the Data Deletion page.

8. Cookies on zetra.chat

Our website uses essential cookies to keep you signed in and secure. Visitors in the EU, EEA, UK and Switzerland are asked before any analytics or advertising cookies are used, and can change their choice any time with “Cookie settings” at the bottom of every page. The chat widget your agent shows on your own website stores only what it needs to continue a conversation.

9. Contact

For any privacy or GDPR question, or to exercise a right, email [email protected].