Privacy Policy

1. Who we are

This policy explains how Zanbase ("Zanbase", "we") handles personal data when you visit zanbase.com or use the Zanbase app and Zanbase Agent (the "Service").

Contact Zanbase, including for data-protection requests, at corporate@zanbase.com.

For account and billing data, and for data from our website, Zanbase decides how the data is used (we are the controller). For content that members put into a workspace, the workspace's organization is the controller and Zanbase processes it on its behalf, under our Terms and, where it applies, the Data Processing Agreement. Questions about a workspace's content should go to its owners.

2. What we collect

• Account data: your name, email address, profile picture, and how you sign in (passkey, email code, single sign-on, or a Google or GitHub account).
• Workspace content: what you and your members create, upload or send in the Service, including messages, docs, files, call recordings and prompts to Zanbase Agent.
• Integration data: when you connect an account such as Google, Microsoft or GitHub, the data that integration needs (for example email messages, calendar events, files or issues), under the permissions you grant.
• Billing data: your plan, billing status and invoices. Card details go directly to our payment provider; we never see or store full card numbers.
• Technical data: IP address, browser and device information, and logs of requests and errors, which we use to run and secure the Service.
• Messages you send us, for example support requests.

3. How we use it

• To provide the Service: sign you in, sync your workspace, deliver notifications, run Zanbase Agent, calls and integrations.
• To keep the Service secure and working: prevent abuse, investigate errors, and enforce our Terms.
• To bill for paid plans.
• To send service emails, such as sign-in codes, invitations, notifications and billing notices. We do not send marketing email without your consent.
• To meet legal obligations.

Where the GDPR applies, we rely on performing our contract with you, our legitimate interests in running and securing the Service, your consent where we ask for it, and legal obligations.

4. Zanbase Agent and AI

When you use Zanbase Agent, your prompt and the workspace content needed to answer it (only content you are allowed to see) are sent to an AI model provider to generate the response. Transcripts send recording audio to a speech provider, and voice features in calls send live audio to speech providers to transcribe and speak.

Zanbase does not train AI models on your content, and we do not sell it. The AI providers we use, and what they receive, are listed under Subprocessors below.

If you connect an outside AI tool to Zanbase over MCP (for example Claude or ChatGPT), that tool can read and change content in the workspace you choose when you authorize it, with your permissions, under your consent and the tool's own terms.

5. Data from Google

If you connect a Google account, Zanbase uses Google user data only to provide the features you turn on, such as showing your Gmail inbox, Google Calendar events or Google Drive files inside your workspace, or creating documents, spreadsheets, calendar events or email drafts when you or your automations ask. Zanbase's use and transfer of information received from Google APIs adheres to the Google API Services User Data Policy, including the Limited Use requirements. We do not use Google user data for advertising, and people at Zanbase do not read it unless you ask us to for support, it is needed for security, or the law requires it.

6. Who we share it with

• Service providers that host and run the Service for us, bound by contract to use the data only for that purpose. They are listed under Subprocessors below.
• Other people in your workspace, as the workspace's permissions allow, and anyone you give a public share link.
• Third-party services you choose to connect, including outside AI tools connected over MCP.
• Services that build link previews in the app: links you add are sent to Microlink and Google's favicon service. Avatars are drawn by Zanbase itself, with no outside service.
• Authorities, when the law requires it, or to protect the rights and safety of our users or others.
• A buyer or successor, if Zanbase is involved in a merger or acquisition, under this policy's protections.

We do not sell personal data, and we do not share it for cross-context behavioral advertising.

7. Subprocessors

These providers support the Service, including connected accounts and public asset services. What they receive depends on the features you use. Connected services and public asset providers also apply their own terms. Locations describe vendor infrastructure or published processing regions, not a promise of workspace data residency.

We update this list at least 30 days before a new subprocessor starts processing customer data. To be notified by email, write to corporate@zanbase.com.

8. Cookies

Our website at zanbase.com sets no cookies. We use PostHog in cookieless mode, without analytics cookies or local storage.

Website analytics include the page path, page views, call-to-action clicks and their location, visits to sign-up, search query length (not search text), and the first interaction with the demo. We do not send the full page URL, its query string or referrer as analytics properties. Sign-up events include campaign tags when present. PostHog also receives the network request, including your IP address.

The website stores only first-touch campaign tags in sessionStorage under zb_campaign for the browser tab. It adds those tags to sign-up links to attribute visits to a campaign.

The Zanbase app sets the cookies it needs to keep you signed in and secure, plus one that remembers whether the sidebar is open. These are strictly necessary or functional, so the app does not ask for cookie consent, and you cannot sign in with them turned off. Public form pages use Cloudflare Turnstile to block spam, which may set its own cookies.

9. How long we keep it

We keep account and workspace data while the account or workspace exists. Items moved to the trash are permanently deleted after 30 days. After a workspace is deleted, we delete its content within 30 days, except copies in backups, which are overwritten on their normal schedule. We keep billing records as long as tax law requires.

To delete your account, email corporate@zanbase.com from the address you sign in with. Deleting an account also deletes the workspaces you alone own; if you own a workspace that has other members, transfer ownership first. A workspace's activity record keeps the name you had when you acted.

10. Security and transfers

Our Security page describes our safeguards. Our providers operate in the United States and other countries, so your data may be processed outside your country. For transfers of personal data from the EU, UK or Switzerland, we rely on the European Commission's Standard Contractual Clauses or another valid transfer mechanism.

11. Your rights

Depending on where you live (for example under the GDPR or US state laws such as the CCPA), you may have the right to access, correct, delete or export your personal data, to object to or restrict some processing, and to withdraw consent. Email corporate@zanbase.com and we will respond within the time the law requires. We will not treat you differently for exercising these rights.

If your data is part of a workspace, we may refer your request to the workspace's owners, who control that content. You can also complain to your local data protection authority.

12. Children

The Service is not meant for anyone under 16, and we do not knowingly collect their personal data. If you think a child has given us data, contact us and we will delete it.

13. Changes and contact

We will post any change to this policy here and update the date above; for material changes we will also notify account holders. Questions or requests: corporate@zanbase.com.