1. Who We Are and What This Policy Covers
This Privacy Policy explains how ZenML GmbH, Schellingstrasse 36, 80799 Munich, Germany ("ZenML", "we", "us" or "our") handles personal data as the controller under the EU General Data Protection Regulation (GDPR). ZenML Labs is a brand of ZenML GmbH. It covers our website at zenml.io and related web properties (the "Site"), your account and its use of ZenML Pro, including Kitaru features and Bots (the "Services"), and our marketing, events and sales contacts.
For privacy questions and to exercise your rights, contact security@zenml.io.
Our security certifications, reports, policies and data processing agreement are in our Trust Center.
This policy is a notice about how we handle personal data. It is not a contract and does not change our Terms of Service or any agreement with your organization.
2. Data You Process in the Services
This policy does not cover the data you or your organization put into the Services, such as repositories, agent traces, prompts, attachments, secrets and call content ("Customer Data"). For that data, your organization is the controller and we act as its processor under our data processing agreement (DPA). If your organization's traces or files include information about you, please contact your organization first. Section 12 of our Terms of Service lists the service providers that power features such as sandboxes, language models and voice calls, and the data each one handles. Your organization is responsible for having a legal basis for the data it submits, for informing the people concerned, and for handling their requests. If we receive such a request directly, we may pass it to your organization.
3. Data We Collect, Why, and Our Legal Basis
- Visiting the Site. Your browser sends us technical data such as IP address, device and browser type, pages viewed and time of access. We use it to deliver and secure the Site. Legal basis: our legitimate interest in running a secure website (Art. 6(1)(f) GDPR).
- Forms, demos and contact. Name, business email, company, your message, and booking details when you contact us, request or book a demo, or download a resource. We use them to respond and to discuss a possible business relationship. Legal basis: steps prior to a contract (Art. 6(1)(b) GDPR) and our legitimate interest in answering business inquiries (Art. 6(1)(f) GDPR).
- Sales and customer calls. Notes about our conversations and, if we tell you in advance and you agree, a recording or transcript of a call. Legal basis: legitimate interest in managing business relationships (Art. 6(1)(f) GDPR) and, for recordings, your consent (Art. 6(1)(a) GDPR).
- Accounts and billing. Name, email, organization, role, login data, and billing and payment information. We use them to provide the Services, manage your subscription, provide support and send service messages. Legal basis: performance of a contract (Art. 6(1)(b) GDPR) and, where you act for your employer, our legitimate interest in performing our contract with it (Art. 6(1)(f) GDPR). We keep billing records because the law requires it (Art. 6(1)(c) GDPR).
- Product usage. How accounts use the Services, such as features used, errors and performance. We use it to operate, secure, support and improve the Services and to understand how customers use them. Legal basis: legitimate interest in running and improving our product (Art. 6(1)(f) GDPR).
- Voice calls with agents. If you start a voice call, we process your name, your phone number if you give one, call audio, transcripts and call metadata to provide the call, as described in Section 12 of our Terms of Service. Legal basis: performance of a contract (Art. 6(1)(b) GDPR) and, where applicable, your consent to recording (Art. 6(1)(a) GDPR).
- Marketing and newsletters. Your email and interactions with our messages. We send newsletters with your consent (Art. 6(1)(a) GDPR). We may send existing customers information about similar products where the law allows it (Art. 6(1)(f) GDPR, Section 7(3) of the German Unfair Competition Act). Each message lets you unsubscribe. We may also combine business contact details from public or commercial sources to identify companies who may benefit from our products, based on our legitimate interest in direct marketing (Art. 6(1)(f) GDPR). You can object at any time.
- Security and legal needs. Logs and records needed to detect abuse, enforce our agreements, and meet legal duties. Legal basis: Art. 6(1)(c) and (f) GDPR.
If you give us personal data about someone else, such as a colleague, please make sure you are allowed to do so and that they know about it.
You do not have to give us personal data to browse the Site. Without your account details, we cannot provide the Services. We do not make decisions producing legal or similarly significant effects on you based solely on automated processing.
4. Cookies, Analytics and Marketing Tools
We use strictly necessary cookies and local storage to run the Site and remember your choices. These do not need consent (Section 25(2) of the German TDDDG). All other tools that store or read information on your device only run if you consent through our cookie banner (Section 25(1) TDDDG, Art. 6(1)(a) GDPR). You can change or withdraw your consent at any time through the cookie settings on the Site, with effect for the future.
- Analytics: Google Analytics, Segment and Hotjar help us understand how visitors use the Site.
- Marketing: HubSpot, Reo, Ortto and Apollo help us understand which companies are interested in our products, identify business visitors, and run our marketing.
- Personalization: GitHub buttons show our star count. HubSpot provides our chat.
We also use Plausible, a cookieless analytics tool that does not store information on your device, based on our legitimate interest in understanding overall use of the Site (Art. 6(1)(f) GDPR).
5. Who Receives Your Data
We share personal data only as needed for the purposes above, with:
- Service providers who process it for us under our instructions, in categories such as hosting and cloud infrastructure, customer relationship management, email and newsletters, scheduling, meeting recording, analytics, support and payment processing, and the tools named in Section 4.
- Professional advisors, such as lawyers, auditors and accountants.
- Parties to a business transaction, such as a merger, acquisition, financing or sale of assets, under appropriate confidentiality terms.
- Authorities and others where the law requires it, or where needed to establish, exercise or defend legal claims.
We do not sell your personal data.
6. International Transfers
Some recipients are outside the European Economic Area, including in the United States. Where a country does not have an EU adequacy decision, or a recipient is not certified under one such as the EU-US Data Privacy Framework, we rely on the European Commission's standard contractual clauses and additional safeguards as needed (Art. 44 to 46 GDPR). You can ask us for a copy of the safeguards at the address in Section 1.
7. How Long We Keep Data
We keep personal data only as long as needed for the purposes above. Account data is kept for the life of the account and deleted afterward, subject to the periods in our Terms of Service and any legal duty to retain it. Commercial and tax records are generally kept for six to ten years under German law. We may also keep data as long as needed to establish, exercise or defend legal claims, and to document that we met our legal duties, such as records of consent or opt-out. Inquiries and sales contacts are deleted when they are no longer relevant, unless you become a customer. Data we process based on consent is kept until you withdraw consent, unless another legal basis applies. Cookie lifetimes are shown in the cookie settings or the provider's documentation.
8. Your Rights
Under the GDPR, and subject to its conditions, you have the right to access your personal data (Art. 15), to correct it (Art. 16), to have it erased (Art. 17), to restrict its processing (Art. 18), and to receive it in a portable format (Art. 20). Where processing is based on consent, you can withdraw consent at any time, with effect for the future (Art. 7(3)).
Right to object (Art. 21 GDPR). Where we process your personal data based on legitimate interests, you can object at any time for reasons arising from your particular situation. You can object to direct marketing at any time, without giving a reason, and we will then stop using your data for it.
To exercise your rights, write to security@zenml.io. We may ask you to confirm your identity first. We generally respond within one month. These rights have legal limits, for example where we must keep data by law or need it for legal claims. We may refuse or charge a reasonable fee for requests that are manifestly unfounded or excessive (Art. 12(5) GDPR).
You also have the right to complain to a data protection supervisory authority (Art. 77 GDPR), in particular in the EU Member State where you live or work or where the alleged violation took place. The authority responsible for us is the Bavarian State Office for Data Protection Supervision (Bayerisches Landesamt für Datenschutzaufsicht, BayLDA), Promenade 18, 91522 Ansbach, Germany.
9. Children
The Site and Services are for businesses and are not directed to children under 16. We do not knowingly collect their personal data. If you believe a child has given us personal data, please contact us and we will delete it.
10. Links to Other Websites
The Site and Services link to and connect with websites and services that we do not control, including social media services and tools you connect yourself, such as GitHub, Slack or your tracing provider. Their own privacy policies apply, and we are not responsible for how they handle data.
11. Security
We use appropriate technical and organizational safeguards to protect personal data. Details are in our Trust Center. No system is completely secure, and we cannot guarantee absolute security. Please tell us at security@zenml.io if you suspect a problem.
12. Changes to This Policy
We may update this policy when our practices or the law change. We will post the new version here with a new date, and tell you directly if the law requires it or a change materially affects you.
13. Contact Us
If you have questions about this policy or how we handle personal data, please contact us at security@zenml.io or write to ZenML GmbH, Schellingstrasse 36, 80799 Munich, Germany.