Privacy policy

Zazor is operated by [company legal name], [registered address] ("we"). This policy says what information we hold about the people who use Zazor, why, who else handles it, and how long we keep it. Questions and requests go to [contact email].

What we hold

• Your account. Your name, work email address, and a one-way hash of your password. We never store the password itself.
• Your organization. Its name, its members and their roles, pending invitations (an email address and a role), and its settings.
• What you ask us to research. The company and product names you enter, the competitors you choose, and the capability lists you edit.
• Research results. Claims about products, the passages they rest on, and copies of the public web pages those passages came from.
• Product Knowledge. Extracted text, filenames, document classifications and upload metadata from product documents you choose to upload. Hosted uploads temporarily store encrypted original-file parts. They expire after 15 minutes and are deleted on successful completion, cancellation or a later cleanup pass; physical deletion can be delayed while cleanup is unavailable. After staging is cleaned, the library retains extracted text rather than original files or embedded images. Database backups and logs of database changes may retain encrypted staging according to infrastructure retention. The library is scoped to your product workspace and document audience.
• What your team writes. Decisions, notes, corrections, verifications, saved reports and schedules.
• Records of use. An activity log of who did what in your organization, the number of AI requests and their estimated cost, and records of errors.
• Sign-in security. A session cookie, and sign-in attempts with the network address they came from.
• Connections you add. The address of any source you connect and its access token, which is stored encrypted.

We do not ask for, and you should not enter, personal information about your customers or other people. Zazor researches products, not people.

Cookies

We set one cookie, gs_session, which keeps you signed in. It is required for the service to work. We use no advertising or analytics cookies and no third-party trackers.

How we use it

• To provide the service: sign you in, run the research you ask for, and show the results to your organization.
• To keep it secure and working: prevent abuse, investigate errors, and enforce spending limits you set.
• To contact you about your account: confirmation, password reset and invitation emails. We send no marketing email from the product.

We do not sell personal information, and we do not use your organization's data to train AI models.

How AI is involved

Research is done with AI models provided by Anthropic. To do it we send the model the product and company names you entered, the capabilities being checked, and passages from public web pages. If you connect your own sources, content from them may be sent to the model as part of research on your behalf. We do not send your password, your team's email addresses, or your notes and decisions. [Confirm against the provider's current commercial terms: retention of prompts and use for training.]

When you explicitly request a category proposal, bounded excerpts of your uploaded documents are sent to the AI provider configured for your organization. Uploading alone does not make that AI request. Deleting a document removes its stored text and pending proposals and retires an approved knowledge map; completed research results and audit metadata remain subject to their separate retention rules.

AI can be wrong. Zazor shows the source and quoted passage for each claim so a person can check it; see the Terms of service.

Who else handles it

These companies process data for us, under contract, only to provide their part of the service:

• Neon (United States). Database hosting. Stores all account, organization and research data.
• Vercel (United States and its global network). Application hosting. Processes requests and keeps short-lived server logs.
• Anthropic (United States). AI model provider. Receives the research prompts described in the privacy policy.
• Resend (United States). Sends account emails: confirmation, password reset and invitations.

We may also disclose information if the law requires it, or to a successor if the business is sold, on the terms of this policy.

Where it is kept

Data is stored in the United States (AWS us-west-2). If you use Zazor from elsewhere, your information is transferred to and processed in that country. [If you will serve customers in the EU or UK: state the transfer mechanism, e.g. Standard Contractual Clauses, and offer a data processing agreement.]

How long we keep it

• Account and organization data, research results and what your team writes: for as long as the organization exists. An admin can delete individual runs at any time; each organization also keeps only its most recent runs, up to a number it sets.
• Activity log: 2 years. Usage records: about 13 months. AI run log: 12 months.
• Copies of public web pages: the latest 3 versions of each page, and pages not used for 6 months are removed, except copies a kept claim still points at.
• Sign-in attempts: 2 days. Sessions: 30 days. Error records: 30 days. Read notifications: 90 days.

An admin can delete the whole organization from Settings; everything in it is deleted at once. Anyone can delete their own account from Settings. Copies in database backups are overwritten as backups expire. [State the backup retention period of your database plan.]

How we protect it

• Passwords are stored only as salted hashes. Session identifiers and one-time links are stored only as hashes.
• Access tokens for connected sources are encrypted before they are stored.
• Each organization's data is separated from every other organization's in every request.
• Connections to the service and to the database are encrypted in transit.

No system is perfectly secure. If we learn of a breach affecting your information we will tell you without undue delay.

Your choices and rights

You can ask us for a copy of your personal information, ask us to correct or delete it, or object to how we use it, by writing to [contact email]. Depending on where you live you may have further rights under local law, including the right to complain to a data protection authority. If your account belongs to your employer's organization, we may refer your request to that organization's admin.

Children

Zazor is a business tool and is not directed at children. We do not knowingly collect information from anyone under 16.

Changes

If we change this policy in a way that matters, we will tell organization admins by email or in the product before the change takes effect.