Privacy Policy

Zetra ("we", "us") provides a platform for building AI agents trained on a business's own content and deploying them on websites and messaging channels. This policy explains what personal data we collect, why, who we share it with, how long we keep it, and the choices you have. It applies to zetra.chat, the Zetra dashboard, and the agents deployed with it.

The short version

• We collect what we need to run your account, operate your agents, bill you, and keep the service secure.
• We do not sell personal data, and we do not use advertising or cross-site tracking cookies.
• We do not use your workspace content to train AI models of our own.
• When you deploy an agent, the conversations your visitors have with it belong to you; we process them on your behalf.
• You can delete your content at any time, and contact us to exercise any privacy right.

1. Who is responsible for your data

Our role depends on whose data it is. For workspace users (people with a Zetra account) we are the controller: we decide why and how your account data is used. For end users (people who chat with an agent a customer of ours has deployed) the customer who owns the workspace is the controller and we act as their processor, handling that data only on their instructions and under our Data Processing Addendum. If you are an end user and want to access or delete your conversation data, please contact the business whose agent you spoke with; we will help them respond.

2. Data we collect from workspace users

Data you give us

• Account data: your name, company or workspace name, email address, and a salted, one-way hash of your password. If you sign in with Google we receive your Google account identifier, verified email address and name — never your Google password (see Google user data below).
• Workspace content: the documents, web pages, videos, spreadsheets, text snippets and Q&A pairs you add to train an agent; agent instructions and settings; custom fields, procedures and templates you create.
• Integration credentials: API keys, tokens and webhook URLs you enter to connect services such as Twilio, Slack, Zendesk or Shopify. These are stored so the integration can work on your behalf.
• Team data: the names and email addresses of teammates you invite and the role you assign them.
• Billing data: your plan, add-ons, message-credit balance and invoices. Card details are collected and stored by our payment processors, Paystack or PayPal (if you pay with PayPal); we never see or store your full card number or PayPal login.
• Communications: anything you send us through the contact form or by email (name, email address, and your message), and support requests.

Data collected automatically

• Security and audit records: the time, action and IP address of security-relevant events such as sign-ins, invitations, and API-key and integration changes.
• Rate-limiting records: your IP address (and the email address you are signing in with) is recorded briefly to block automated abuse such as password guessing and form spam. These records are short-lived and are routinely deleted, generally within a day.
• Usage metering: counts of messages, message credits consumed, storage used and similar figures needed to enforce plan limits and bill accurately.
• Server logs: our hosting infrastructure and our network provider record standard request information (IP address, browser type, pages requested, timestamps) for reliability and abuse prevention.

3. Data we process for end users of your agent

When someone chats with an agent deployed through Zetra we process, on the workspace owner's behalf:

• Conversation content: the messages the visitor sends and the replies generated, including the sources cited, any thumbs-up/down feedback, and messages written by a human teammate who takes over.
• Channel identifiers: depending on the channel, this can be a phone number (WhatsApp or voice), an email address (email and helpdesk), or a conversation ID (website widget).
• Lead and ticket details: whatever the visitor submits in a lead-capture form (typically name and email) or in a support ticket, plus the ticket's message history and contact record.
• Voice: for phone calls, the call audio is handled by our telephony provider, Twilio, and converted to text so the agent can respond. Call recording only happens if the workspace owner turns it on.

Visitors should not be asked to share sensitive information (such as health data, government IDs or payment card numbers) in a chat, and workspace owners are responsible for telling their visitors that they are speaking to an AI agent and for providing their own privacy notice to them.

4. How we use data

Where the law requires a legal basis, we rely on: performing our contract with you (providing the service); our legitimate interests in operating, securing and improving it; compliance with legal obligations; and your consent where we ask for it (for example, optional product emails), which you can withdraw at any time.

5. AI processing

To answer a question, Zetra searches your indexed content for the most relevant passages and sends those passages, the conversation so far and your agent's instructions to an AI model provider to generate a reply. We use OpenAI to create the embeddings that power search, and OpenAI, Anthropic or Google to generate replies, depending on the model your workspace selects. We use these providers through their commercial APIs, which by default do not use submitted content to train their general-purpose models. Replies are generated automatically and may be inaccurate, and we do not use them for automated decisions that have legal or similarly significant effects on individuals.

6. Who we share data with

We share personal data only in these situations:

• Service providers (subprocessors) that help us run the service — AI model providers, payment processing, email delivery, network and DNS, and hosting. The current list, with what each does, is on our Subprocessors page.
• Integrations you choose to connect (for example Twilio, Slack, Zendesk, Shopify or Notion). Data flows to them using credentials you supply, under their own terms.
• Your teammates, who can see the workspace content their role permits.
• Legal and safety reasons, where we are required by law or legal process, or need to protect the rights, safety or property of Zetra, our users or others.
• Business transfers: if we are involved in a merger, acquisition or sale of assets, personal data may be transferred, and we will notify you before it becomes subject to a different privacy policy.

We do not sell personal data or share it for cross-context behavioral advertising.

7. Google user data (Sign in with Google)

Zetra offers "Sign in with Google" through an OAuth application named Zetra Chat, operated by Zetra. This section describes exactly how we handle the information we receive from Google when you use it. It is in addition to the rest of this policy.

What we access

We request only three basic, non-sensitive permissions (scopes): openid, userinfo.email and userinfo.profile. Through them we receive your Google account identifier, your email address and whether Google has verified it, and your name. We do not request or access your Gmail, Google Drive, Calendar, Contacts or any other Google service or data, and we do not keep a long-term connection to your Google account: the temporary access token Google gives us is used once, at sign-in, to read the profile above and is not stored.

How we use it

• To create your Zetra account and sign you in without a password.
• To match you to an existing account that uses the same verified email address, so you don't end up with duplicates. We only link accounts when Google confirms the email is verified.
• To show your name in the dashboard and to your teammates.

We do not use Google user data for advertising (including personalized, retargeted or interest-based advertising), we do not sell it or transfer it to data brokers, and we do not use it to determine creditworthiness or for lending. We do not use it to develop, improve or train generalized or non-personalized artificial-intelligence or machine-learning models.

Who we share it with

We do not share Google user data with third parties except (a) with the service providers that host and run Zetra on our behalf (see Subprocessors), only as needed to provide the service, (b) when required by law or valid legal process, or (c) as part of a merger, acquisition or sale of assets, in which case it stays subject to this policy. No human reads Google user data except with your consent, where necessary for security purposes such as investigating abuse, or to comply with law.

How it is stored, protected and deleted

• Storage: your Google account identifier, email address and name are stored in our database alongside the rest of your account data.
• Protection: data is transmitted over encrypted (HTTPS) connections, access to our database is restricted, and workspaces are logically isolated from one another.
• Retention: we keep this information for as long as your account exists.
• Deletion: email [email protected] to close your account; we delete your account data, including the Google information above, within 30 days, apart from copies in short-lived backups (about 14 days) and records we must keep by law. You can also revoke Zetra's access at any time in your Google Account under Security → Third-party apps & services (myaccount.google.com/permissions); doing so stops future Google sign-in but does not by itself delete our copy, so please contact us as well if you want it erased.

Zetra's use and transfer to any other app of information received from Google APIs will adhere to the Google API Services User Data Policy, including the Limited Use requirements.

8. International transfers

Our providers operate in several countries, so your data may be processed outside the country where you live, including in the United States. Where required, we rely on appropriate safeguards such as standard contractual clauses in our agreements with providers.

9. How long we keep data

• Workspace content and conversations: until you delete them or your workspace. Deleting an agent permanently removes its sources, indexed content, conversations, leads and tickets. You can also delete all conversations for an agent from its Settings.
• Account data: for as long as your account is open. To close your account and delete your workspace, email [email protected]; we will complete the deletion within 30 days and confirm when it is done.
• Backups: we keep database backups for about 14 days. Deleted data can persist in a backup until it rotates out, and is not restored except to recover from a failure.
• Security records: rate-limiting records are kept for about a day; sign-in and audit records are kept as long as needed for security and accountability; password-reset links are single-use and expire quickly.
• Billing records: kept as long as tax and accounting law requires.
• Contact-form messages: kept in our support mailbox for as long as needed to respond and for a reasonable period afterwards.

10. Security

We protect data with measures including encrypted connections (HTTPS) everywhere, hashed passwords, strict separation between workspaces, access controls with roles, rate limiting and bot protection on public forms, restrictions that stop the service being used to reach internal networks, and audit logging. No system is perfectly secure; if we learn of a breach that affects your personal data we will notify you and the relevant authorities as required by law. See Security & Trust for more detail.

11. Your rights and choices

Depending on where you live, you may have the right to access the personal data we hold about you, correct it, delete it, export it in a portable format, restrict or object to certain processing, withdraw consent you gave, and lodge a complaint with your local data-protection authority. You can update your account details from your dashboard and delete workspace content yourself at any time. For anything else, email [email protected] or use our contact page; we will respond within the time required by applicable law (generally within 30 days) and may need to verify your identity first. We will not discriminate against you for exercising a privacy right. If you are an end user of a business's agent, please direct requests to that business.

12. Cookies and similar technologies

We keep this to the minimum needed to make the product work:

• Session cookie: a strictly necessary, HTTP-only cookie that keeps you signed in. It is not readable by scripts and is not used for advertising or tracking.
• Sign-in security cookie: a short-lived cookie (about 10 minutes) used during "Continue with Google" to make sure the sign-in you finish is the one you started.
• Local storage: a small browser flag remembers that you have dismissed the guided product tour.

We do not use advertising cookies, and we do not currently use third-party analytics on the marketing site. Our human-verification puzzle on the contact form runs on our own servers; it briefly analyzes how the slider is moved to tell people from bots, and does not store that movement data or share it with anyone.

13. Children

Zetra is a business product and is not directed to children under 16. We do not knowingly collect personal data from children. If you believe a child has provided us data, contact us and we will delete it.

14. Changes to this policy

We may update this policy as the product or the law changes. When we make material changes we will update the "Last updated" date at the top and, where required, notify you by email or in the dashboard before the change takes effect.

15. Contact us

Questions or requests about this policy or your personal data: [email protected], or through our contact page. You can reach Zetra at the same addresses.