Privacy Policy

Last updated: May 27, 2026 · Applies to all ZionLink users

ZionLink ("we," "us," or "our") is committed to protecting the personal data of our users and their contacts. This Privacy Policy explains what data we collect, how we use it, who we share it with, and your rights under applicable data protection laws, including the EU General Data Protection Regulation (GDPR), Brazil's Lei Geral de Proteção de Dados (LGPD), and Israel's Protection of Privacy Law.

1. Who We Are

ZionLink is a B2B SaaS platform that deploys AI agents on behalf of business clients. For data protection purposes, ZionLink acts as a data controller for account and billing data, and as a data processor for contact data processed on behalf of our clients.

Contact: privacy@zionlink.ai

2. Data We Collect

Category	Data	Purpose	Legal Basis (GDPR)
Account data	Name, email, company, password hash	Authentication & account management	Contract performance
Billing data	Stripe customer ID, subscription plan, invoices	Payment processing	Contract performance
Gmail OAuth tokens	Access token, refresh token (encrypted)	Sending/receiving email on your behalf	Explicit consent (OAuth grant)
Lead / contact data	Names, emails, companies, titles, LinkedIn URLs	AI agent outreach on behalf of client	Legitimate interest (client's B2B prospecting)
Email content	Threads processed by inbox agent	Generating AI replies; stored in logs	Contract performance
Agent logs	Actions, inputs, outputs (truncated to 2,000 chars)	Audit trail, debugging	Legitimate interest
Usage & technical data	Server logs, IP addresses, session identifiers	Security, fraud prevention	Legitimate interest

We do not collect or store payment card numbers. All payment data is handled directly by Stripe, Inc.

3. AI Processing & Third-Party Sub-processors

When your AI agents process email threads or generate outreach messages, the content is sent to Anthropic, PBC (Claude API) for inference. This means email content and lead information may be processed by Anthropic's infrastructure. We rely on Anthropic's data processing agreement and enterprise terms to ensure appropriate protections.

Our key sub-processors are:

Anthropic, PBC: AI inference (US) | Privacy Policy
Google LLC: Gmail API (US/EU) | Privacy Policy
Stripe, Inc.: Payment processing (US) | Privacy Policy
Hostinger International Ltd.: Hosting & database (EU/LT) | Privacy Policy
Apollo.io, Inc.: Lead enrichment (US, optional) | Privacy Policy

4. How We Use Your Data

To provide, maintain, and improve the ZionLink platform.
To process your subscription and send billing-related communications.
To operate AI agents on your behalf (sending emails, processing inboxes, enriching leads).
To send transactional emails (password reset, account notifications).
To comply with legal obligations and respond to lawful requests.
To detect and prevent fraud, abuse, or security incidents.

We do not sell your data or your contacts' data to third parties. We do not use your data to train AI models.

5. AI Disclosure to Your Recipients

Every email sent by a ZionLink agent on your behalf includes a disclosure footer stating that the message was generated by an AI and offering an unsubscribe option. This is a mandatory feature of the Service and cannot be disabled. It reflects our commitment to transparency and compliance with AI disclosure requirements (including the EU AI Act).

6. Data Retention

Account data: retained while your account is active and for 90 days after deletion to support dispute resolution.
Agent logs: retained for 12 months, then purged automatically.
Email content in logs: stored truncated (2,000 characters max) and retained for 12 months.
Password reset tokens: expire after 1 hour and are deleted upon use.
Lead data: retained until you delete it from your account or close your account.
Billing records: retained for 7 years as required for tax and accounting compliance.

7. Data Security

We implement industry-standard security measures, including:

HTTPS (TLS) for all data in transit.
Passwords stored as bcrypt hashes (cost factor 12).
OAuth tokens stored encrypted in the database.
HTTP-only, same-site session cookies.
Access to production databases restricted to authorized personnel only.

No security system is 100% guaranteed. If you believe your account has been compromised, contact us immediately at security@zionlink.ai.

8. International Data Transfers

ZionLink's infrastructure is hosted in the European Union (Hostinger, Lithuania). However, sub-processors such as Anthropic and Stripe are based in the United States. Transfers to the US are covered by applicable Standard Contractual Clauses (SCCs) or equivalent frameworks. By using the Service you acknowledge these transfers.

9. Your Rights

Depending on your jurisdiction, you may have the following rights regarding your personal data:

Access: request a copy of the data we hold about you.
Correction: ask us to correct inaccurate data.
Deletion: request erasure of your account and associated data.
Portability: receive your data in a machine-readable format.
Objection / Restriction: object to certain processing or ask us to restrict it.
Withdraw Consent: revoke your Gmail OAuth grant at any time via your Google account settings; this will disconnect your Gmail integration.

To exercise any of these rights, email privacy@zionlink.ai. We will respond within 30 days. You also have the right to lodge a complaint with your local supervisory authority (e.g., the Israeli Privacy Protection Authority, or your EU DPA).

10. Cookies & Session Data

ZionLink uses a single session cookie (zl_sess) to maintain your login state. This cookie is HTTP-only, same-site (Lax), and expires after 30 days. We do not use advertising cookies or third-party tracking pixels.

11. Children's Privacy

The Service is intended for business use only and is not directed at individuals under the age of 18. We do not knowingly collect personal data from minors.

12. Changes to This Policy

We may update this Privacy Policy as the Service evolves. We will notify you of material changes by email or via a notice in your dashboard. The "Last updated" date at the top reflects the most recent revision.

13. Contact Us

For any privacy-related questions or requests: privacy@zionlink.ai