Privacy Policy

Last updated: May 27, 2026 · Applies to all ZionLink users

ZionLink ("we," "us," or "our") is committed to protecting the personal data of our users and their contacts. This Privacy Policy explains what data we collect, how we use it, who we share it with, and your rights under applicable data protection laws, including the EU General Data Protection Regulation (GDPR), Brazil's Lei Geral de Proteção de Dados (LGPD), and Israel's Protection of Privacy Law.

1. Who We Are

ZionLink is a B2B SaaS platform that deploys AI agents on behalf of business clients. For data protection purposes, ZionLink acts as a data controller for account and billing data, and as a data processor for contact data processed on behalf of our clients.

Contact: support@zionlink.io

2. Data We Collect

Category	Data	Purpose	Legal Basis (GDPR)
Account data	Name, email, company, password hash	Authentication & account management	Contract performance
Commercial records	Agreed scope, access period, payment channel, invoice or agreement reference	Contract administration and access activation	Contract performance
Gmail OAuth tokens	Access token, refresh token (database access controls)	Sending/receiving email on your behalf	Explicit consent (OAuth grant)
Lead / contact data	Names, emails, companies, titles, LinkedIn URLs	AI agent outreach on behalf of client	Legitimate interest (client's B2B prospecting)
Email content	Threads processed by inbox agent	Generating AI replies; stored in logs	Contract performance
Agent logs	Actions, inputs, outputs (truncated to 2,000 chars)	Audit trail, debugging	Legitimate interest
Usage & technical data	Server logs, IP addresses, session identifiers	Security, fraud prevention	Legitimate interest

We do not collect or store payment card numbers, bank account numbers, IBANs, SWIFT codes, routing details, or online-banking credentials. Payments for the standard Intelligence System are completed through the private payment link sent by Tamara. ZionLink stores only the operational payment channel and payment reference needed to administer access.

3. AI Processing & Third-Party Sub-processors

When your AI agents process email threads or generate outreach messages, the content is sent to Anthropic, PBC (Claude API) for inference. This means email content and lead information may be processed by Anthropic's infrastructure. We rely on Anthropic's data processing agreement and enterprise terms to ensure appropriate protections.

Our key sub-processors are:

Anthropic, PBC: AI inference (US) | Privacy Policy
Google LLC: Gmail API (US/EU) | Privacy Policy
Hostinger International Ltd.: Hosting & database (EU/LT) | Privacy Policy
Apollo.io, Inc.: Lead enrichment (US, optional) | Privacy Policy
Resend / Plus Five Five, Inc.: Transactional email delivery (US, when enabled) | Privacy Policy

4. How We Use Your Data

To provide, maintain, and improve the ZionLink platform.
To administer agreed scope, manual payment confirmation and workspace access.
To operate AI agents on your behalf (sending emails, processing inboxes, enriching leads).
To send transactional emails (password reset, account notifications).
To comply with legal obligations and respond to lawful requests.
To detect and prevent fraud, abuse, or security incidents.

We do not sell your data or your contacts' data to third parties. We do not use your data to train AI models.

5. AI Disclosure to Your Recipients

Every email sent by a ZionLink agent on your behalf includes a disclosure footer stating that the message was generated by an AI and offering an unsubscribe option. This is a mandatory feature of the Service and cannot be disabled. It reflects our commitment to transparency and compliance with AI disclosure requirements (including the EU AI Act).

6. Data Retention

Account data: retained while your account is active and for 90 days after deletion to support dispute resolution.
Agent logs: retained for up to 12 months.
Email content in logs: stored truncated (2,000 characters max) and retained for up to 12 months.
Password reset tokens: expire after 1 hour and are deleted upon use.
Lead data: retained until you delete it from your account or close your account.
Billing records: retained for 7 years as required for tax and accounting compliance.

7. Data Security

We implement industry-standard security measures, including:

HTTPS (TLS) for all data in transit.
Passwords stored as bcrypt hashes (cost factor 12).
OAuth tokens stored in the database, restricted to authorized backend processes.
HTTP-only, same-site session cookies.
Access to production databases restricted to authorized personnel only.

No security system is 100% guaranteed. If you believe your account has been compromised, contact us immediately at support@zionlink.io.

8. International Data Transfers

Some of our sub-processors, such as Anthropic and Resend, are based in the United States. Transfers to these sub-processors are subject to the safeguards described in their own data processing terms. By using the Service you acknowledge these transfers.

9. Your Rights

Depending on your jurisdiction, you may have the following rights regarding your personal data:

Access: request a copy of the data we hold about you.
Correction: ask us to correct inaccurate data.
Deletion: request erasure of your account and associated data.
Portability: receive your data in a machine-readable format.
Objection / Restriction: object to certain processing or ask us to restrict it.
Withdraw Consent: revoke your Gmail OAuth grant at any time via your Google account settings; this will disconnect your Gmail integration.

To exercise any of these rights, email support@zionlink.io. We will respond within 30 days. You also have the right to lodge a complaint with your local supervisory authority (e.g., the Israeli Privacy Protection Authority, or your EU DPA).

10. Cookies & Session Data

ZionLink uses a single session cookie (zl_sess) to maintain your login state. This cookie is HTTP-only, same-site (Lax), and expires after 30 days. We do not use advertising cookies or third-party tracking pixels.

11. Children's Privacy

The Service is intended for business use only and is not directed at individuals under the age of 18. We do not knowingly collect personal data from minors.

12. Changes to This Policy

We may update this Privacy Policy as the Service evolves. We will notify you of material changes by email or via a notice in your dashboard. The "Last updated" date at the top reflects the most recent revision.

13. Contact Us

For any privacy-related questions or requests: support@zionlink.io