Privacy Policy

1.Information we collect

Depending on how the Service is used, we may collect:

• Account information such as name, work email, company, and role.
• Documents and knowledge sources uploaded by your organization.
• Questions and conversations employees have with the assistant.
• Screenshots of the shared screen, captured at the moment a question is asked and kept as part of that conversation.
• Usage and device information, such as log data and general diagnostics.

2.How we use information

We use personal information to:

• Provide, maintain, and improve the Service and its guidance.
• Authenticate users and secure accounts.
• Respond to support requests and communicate about the Service.
• Meet legal, security, and compliance obligations.

3.Screen sharing and employee privacy

Screen sharing is always initiated by the employee and can be revoked at any time. The shared video stream itself is not recorded and cannot be replayed.

When an employee asks a question, a single still frame of the shared screen is captured at that moment and kept as part of that conversation, because it is what the answer was based on. These screenshots are stored with the same protections as the rest of the conversation and are deleted with it.

An employee's conversations, including those screenshots, are visible to their company's admins, and admins can watch an employee's live screen, so that they can support their people. Every such access is recorded in an audit log.

Zekara does not access employee conversation content — including screenshots — under any circumstances, including when assisting a customer with support. What Zekara can see is limited to the topic and volume of questions the assistant could not answer, so that we can improve the product, and any single answer a company explicitly chooses to report to us.

Conversations and screenshots are never used to train foundation models.

4.How we share information

We do not sell personal information. We share it with service providers (subprocessors) who help us operate the Service, subject to appropriate contractual protections, and where required by law or to protect rights and safety. Our subprocessors are:

• OpenAI — generating answers and indexing your documents for search.
• Gladia — converting employee speech to text during a voice conversation.
• Amazon Web Services — storing uploaded documents and screenshots, and generating the assistant's spoken voice.
• Supabase — the primary database.
• Render — application hosting.
• Upstash — sessions, rate limiting, and short-lived operational caches.
• Cloudflare — network delivery and bot protection.
• Resend — transactional email such as invitations and password resets.

5.Where we process information

Your account data, conversations, screenshots, and uploaded knowledge sources are stored in the European Union and the United Kingdom.

Each time the assistant answers a question, that question, the relevant extracts from your organization's own documents, and the screenshot are transmitted to OpenAI in the United States in order to generate the answer. We disable provider-side retention on these requests, so this content is not stored by OpenAI after the answer is returned, and it is contractually prohibited from being used to train their models.

6.Model training

Your documents and your employees’ conversations are not used to train foundation models. They are used only to provide guidance to your organization.

7.Data retention

We retain personal information for as long as needed to provide the Service and for legitimate business or legal purposes. Customer Data is deleted or returned on request in accordance with our customer agreements.

8.Security

We use administrative, technical, and organizational measures designed to protect personal information, including encryption in transit and at rest and role-based access controls. No method of transmission or storage is completely secure.

9.Your rights

Depending on your location, you may have rights to access, correct, delete, or port your personal information, or to object to or restrict certain processing. Where we process information on behalf of a customer, please direct requests to that organization.

10.International transfers

As described in “Where we process information”, providing the Service involves transferring information across borders, including to the United States. Where required, we use appropriate safeguards, such as standard contractual clauses, for those transfers.

11.Changes to this policy

We may update this Policy from time to time. Material changes will be communicated through the Service or by other reasonable means.

12.Contact

Privacy questions and requests can be sent to privacy@zekara.ai.