Privacy Policy

This Privacy Policy explains how zenogate ("we", "us") collects, uses, and shares information when you use zenogate.com and related services (the "Service"). If you do not agree with this policy, do not use the Service.

1. Who we are

Our Service and the data you submit are hosted with a third-party cloud infrastructure provider on servers located in the United States, and are subject to US law. If you are located outside the United States, by using the Service you consent to the transfer and processing of your data in the United States.

For privacy questions or requests, contact us at contact@zenogate.com.

2. Information we collect

Account information

We use a third-party identity provider for authentication. When you sign up or sign in, it provides us with your email address, display name, avatar URL, and a stable subject identifier. We store these fields in our database so we can identify you across sessions.

Content you create

We store workspaces you create, their names and slugs, board columns, board items (titles, descriptions, due dates, labels, assignees, custom fields), comments, activity history, and agent API keys you provision. This content is visible to you and to members you invite.

AI prompts and generated output

When you use the Kickstart feature or other AI-powered actions, the text you submit (project descriptions, item content) is transmitted to a third-party AI provider that runs the model we have selected for that feature. We store the AI-generated output in your workspace along with your other content.

Agent activity

If you create an agent API key, every call that agent makes to our API is logged with the timestamp, tool name, and identifier of the affected resource. This log is stored in your workspace's activity feed for auditability.

Telemetry

We use operational monitoring tools to collect telemetry: request paths, response status codes, error traces, and performance timings. Telemetry may include your user ID and workspace ID so we can diagnose issues tied to your account. We do not use telemetry for advertising.

Cookies

Our identity provider sets cookies on its own domain (not ours) to maintain your login session. We do not set advertising or cross-site tracking cookies. Our own domain uses only a small amount of browser storage (local storage / session storage) required to keep you signed in.

3. How we use information

• Provide, operate, secure, and improve the Service.
• Generate AI-powered suggestions when you explicitly invoke AI features.
• Send transactional emails required to use your account (e.g., email verification, password reset).
• Enforce rate limits, quotas, and abuse prevention.
• Respond to support requests and communicate operational notices.
• Comply with legal obligations and enforce our Terms of Service.

We do not sell your personal information. We do not use your content or prompts to train general-purpose machine learning models.

4. Who we share information with (subprocessors)

To operate the Service, we rely on a small set of third-party providers:

• Identity and authentication provider: sign-in, session management, and auth-flow emails (email verification, password reset).
• AI provider(s): running the models behind our AI-powered features on the prompts you submit.
• Cloud infrastructure and hosting provider: hosting, storage, and operational monitoring in the United States.

We share information with these providers only as needed to operate the Service, under contractual obligations of confidentiality and data protection. A current list of the specific subprocessors behind these categories is available on request at contact@zenogate.com.

We may also disclose information if required to comply with a lawful government request, subpoena, or court order, or to protect the rights, property, or safety of zenogate, our users, or the public.

5. Data retention

We retain your account and content for as long as your account is active. If you delete your account, we delete your personal information within 30 days, except that append-only activity logs tied to other users' workspaces (e.g., comments you posted in a teammate's workspace) remain in those workspaces for audit continuity. Operational telemetry is retained for up to 90 days.

6. Your rights

You can:

• Access your account information at any time via the Profile page and the Workspaces hub.
• Correct your display name and avatar in Profile; content you authored is directly editable in the Service.
• Delete your account by emailing us at contact@zenogate.com.
• Export your content. Email us to request a JSON export.

California residents (CCPA / CPRA)

If you are a California resident, you have the right to know what personal information we collect, to request deletion, to request correction, and to not be discriminated against for exercising these rights. You also have the right to opt out of the sale or sharing of personal information. We do not sell or share your personal information, so no opt-out is required. You may exercise these rights by emailing contact@zenogate.com. We will verify requests using the email on file for your account.

7. Children

The Service is not directed to children under 13. We do not knowingly collect personal information from children under 13. If you believe a child has provided us information, contact us and we will delete it.

8. Security

We use industry-standard measures: TLS in transit, encryption at rest via our cloud provider's defaults, SHA-256 hashing of agent API keys (plaintext never stored), and least-privilege access to production systems. No system is perfectly secure; we cannot guarantee absolute security.

9. AI-specific disclosures

Content you submit for AI generation (project descriptions, board items, chat-style prompts where applicable) is sent to our third-party AI provider and the selected model. Outputs from AI models may be inaccurate, incomplete, or inappropriate. Review before acting on them. Our AI providers handle prompt data under their own policies; we can share details on request.

10. International users

By using the Service, you understand that your information will be transferred to and processed in the United States, which may not offer the same data protection as your home country.

11. Changes to this policy

We may update this Privacy Policy from time to time. If we make material changes, we will notify you via email or an in-app notice before the change takes effect. The "Last updated" date at the top of this page always reflects the current version.

12. Contact

Questions about this policy or your privacy rights? Email us at contact@zenogate.com.