1. Who we are and what this covers
This policy covers personal data ZetSuite handles as a controller: your account, sign-in and billing details, and visits to our website and sign-up pages. The ZetSuite company for your region is responsible:
- India: ZetSuite Technologies Pvt. Ltd., HSR Layout, Bengaluru 560102, India
- Netherlands and EU: ZetSuite B.V., Keizersgracht 120, 1015 CW Amsterdam
- UAE: ZetSuite FZ-LLC, Dubai Internet City, Dubai, UAE
Data your company puts into ZetSuite (its customers, leads, employees, candidates and so on) belongs to your company. For that data we are a processor and follow your company's instructions under the Data Processing Agreement. Questions about it go to your company first.
2. What we collect
- Account: name, work email, password (stored only as a salted hash), phone if you add it, language and time zone.
- Company: company name, country, industry, team size, billing contact, tax ID.
- Payments: handled by our payment providers. We see the card brand and last four digits, never the full number.
- Security and usage: sign-ins, IP address, device and browser, and the actions you take, for security and audit logs.
- Support: what you write to us and the replies.
3. How we use it
| Purpose | Legal basis |
|---|---|
| Create and run your account, sign you in, keep it secure | Contract |
| Bill your company and keep tax records | Legal obligation |
| Support, service emails and important notices | Contract |
| Find and stop fraud and abuse | Legitimate interests |
| Product news and tips | Consent, which you can withdraw any time |
We don't sell personal data and don't use it for third-party advertising.
4. Zed, the AI assistant, and your data
- Your data is never used to train AI models, by us or by our AI providers.
- AI providers keep nothing after each request (zero data retention agreements).
- AI requests stay in your company's data region. We don't fall back to another region.
- Sensitive details such as ID numbers and card numbers are masked or removed before a request leaves ZetSuite.
- AI prompts and answers are kept in audit logs for 30 days, then deleted.
5. Where your data is stored
Your company's data is stored in the region chosen at sign-up and can't be moved without your company's written request:
- India: Mumbai (AWS ap-south-1)
- EU: Frankfurt (AWS eu-central-1)
- UAE: Dubai (AWS me-central-1)
When a sub-processor works outside your region, we use safeguards required by law, such as the EU Standard Contractual Clauses.
6. Sub-processors
These companies help us provide ZetSuite. We give at least 30 days notice before adding or changing one. Subscribe to changes from Settings › Privacy & data.
| Company | Purpose | Where |
|---|---|---|
| Amazon Web Services | Hosting, database and backups | Mumbai, Frankfurt, UAE |
| Anthropic | AI models (Claude) for Zed and AI features | US, EU |
| OpenAI | AI models for Zed and AI features | US, EU |
| Google Cloud (Vertex AI) | AI models (Gemini) in region | Mumbai, Frankfurt |
| Postmark | Email delivery for invites and notices | US, EU |
| Meta (WhatsApp Business) | WhatsApp messages companies send | Global |
| Razorpay | Card and UPI payments in India | India |
| Stripe | Card and SEPA payments in EU and UAE | EU, UAE |
7. How long we keep it
| Data | Kept for |
|---|---|
| Audit logs Sign-ins, roles, settings and data changes | 2 years |
| Deleted records bin Records users delete can be restored for this long | 30 days |
| AI prompts and answers Set in Console › AI › Trust & safety (logging) | 30 days |
| Backups Encrypted backups in the company's region | 35 days |
| Invoices and payments Tax records, kept even after deletion requests | 8 years |
| Closed workspace data After the closure grace period, then deleted | Deleted at once |
| Call recordings Voice agent and calls | 180 days |
Your account data is deleted within 30 days after your company closes, except what tax law requires us to keep.
8. Your rights
You can ask to access, correct, delete or export your personal data, restrict or object to how we use it, and withdraw consent. Ask in Settings › Privacy & data or email privacy@zetsuite.com.
| Law | We reply within | You can complain to |
|---|---|---|
| GDPR | 30 days, up to 90 for complex requests | Autoriteit Persoonsgegevens (NL) |
| India DPDP Act | 30 days, up to 90 for complex requests | Data Protection Board of India |
| UAE PDPL | 30 days, up to 60 for complex requests | UAE Data Office |
9. Security
Data is encrypted in transit and at rest. Staff access needs two-factor sign-in, is limited to what each role needs, and is audit-logged. Customer data is only opened with a support ticket. We tell affected companies and the authority within 72 hours of finding a personal data breach.
11. Children
ZetSuite is for businesses and isn't meant for anyone under 18.
12. Changes
When we change this policy in a way that matters, we tell Owners and Admins by email and in the app before it takes effect. The version and date at the top always show the current one.
13. Contact and complaints
- Privacy questions and requests: privacy@zetsuite.com
- Grievance Officer (India, DPDP Act): grievance@zetsuite.com, HSR Layout, Bengaluru 560102, India
- Data Protection Officer (EU): dpo@zetsuite.com, Keizersgracht 120, 1015 CW Amsterdam
- UAE: privacy@zetsuite.com, Dubai Internet City, Dubai, UAE
If you're not happy with our answer, you can complain to the authority listed in section 8.