Privacy Policy

1. Information We Collect

1.1 Information You Provide Directly

• Account information: Your email address and, where you register via a third-party authentication provider (such as Google), your name and profile picture as provided by that provider. Passwords are never processed or stored by Zalcro — authentication credentials are handled entirely by our authentication provider.
• Conversation inputs: The plain-language descriptions, project details, and constraints you provide during elicitation conversations.
• File uploads: Where you upload a file to the Service, its contents are processed solely to extract relevant constraints. The raw file contents are discarded immediately after extraction and are not retained.
• Support communications: Messages you send via our support channels.

1.2 Information We Collect Automatically

• Usage data: Records of your activity on the Service, including conversations initiated, documents generated, and features accessed. This includes generation counts used to enforce plan quotas.
• Billing data: Subscription status, billing period, and payment event records. Raw payment card details are never processed or stored by Zalcro — these are handled entirely by our payment processor.
• Session and analytics data: Mouse movements, clicks, and in-app interactions captured via session recording and analytics tools to understand how users interact with the Service. Text you type into input fields is masked and is not recorded. Content displayed on screen, such as generated documents, may appear in recordings.
• Log data: Standard server logs including IP address, browser type, referring URLs, and timestamps.

1.3 Information From Third Parties

Where you authenticate via a third-party provider such as Google, we receive the profile information that provider makes available under your account permissions.

2. How We Use Your Information

We use the information we collect to:

• Provide, operate, and maintain the Service
• Process your inputs and generate planning outputs
• Enforce plan entitlements and quota limits
• Send transactional emails, including account confirmations, billing notices, and security alerts
• Respond to support requests
• Detect, investigate, and prevent abuse or violations of our Terms of Service
• Analyze usage patterns to improve the Service
• Comply with applicable legal obligations

Anonymized and aggregated data: We may use anonymized, aggregated, and de-identified data derived from your inputs and generated outputs — in a form that does not identify you — to develop and improve the Service and its underlying systems.

We do not use your conversation inputs, project descriptions, file uploads, or generated outputs to train, fine-tune, or otherwise improve any AI model, whether operated by us or by any third-party AI model provider. The anonymized and aggregated data reservation above applies solely to product analytics and service improvement at the platform level, not to AI model training.

3. Legal Basis for Processing (GDPR)

If you are located in the European Economic Area (EEA) or United Kingdom, we process your personal data on the following legal bases:

• Contract performance: Processing necessary to provide the Service you have signed up for, including account management, generation of outputs, and billing.
• Legitimate interests: Analytics and product improvement, abuse detection, and security monitoring, where these interests are not overridden by your rights.
• Legal obligation: Retention of billing and transaction records as required by applicable law.
• Consent: Session recording and non-essential analytics cookies, where consent is required. You may withdraw consent at any time via our cookie preferences settings.

4. Cookies and Tracking Technologies

4.1 What We Use

The Service uses cookies and similar tracking technologies to operate and improve the platform. These include:

• Essential cookies: Required for the Service to function, including session management and authentication state. These cannot be disabled.
• Analytics cookies: Used to collect data about how you interact with the Service, including session recordings that capture mouse movements, clicks, and in-app interactions. These are set by our analytics provider.
• Google Analytics: We use Google Analytics 4 to measure traffic sources, referring sites, and which pages visitors land on. It loads when you open the Service, before you answer the cookie banner, and sets first-party cookies (_ga and _ga_*) to recognize repeat visits. It stops, and its cookies are cleared, when you choose Decline on the cookie banner.
• Cookie-free analytics: Page views, clicks, and usage events are collected without cookies, before and regardless of your cookie choice, except that declining stops click tracking. For visitors who use the preview chat, we derive a one-way hash of the IP address to count usage and limit abuse. If you create an account, page views from the same browsing session may be linked to it.

4.2 Your Choices

Where required by applicable law, we will request your consent before setting non-essential cookies. Google Analytics is the exception: it runs from your first page view so that we can see how visitors find us, and it turns off once you decline. You can manage your cookie preferences at any time via the cookie preferences banner within the Service. Note that disabling analytics cookies does not affect your ability to use the core features of the Service.

4.3 Third-Party Cookies

Some cookies are set by third-party providers operating on our behalf. These providers are listed in Section 5 below and are bound by their own privacy policies.

5. How We Share Your Information

We do not sell your personal information. We share information only in the following circumstances:

5.1 Service Providers

We share information with third-party providers that perform services on our behalf. These providers are contractually bound to use your data only as directed by us and not for their own purposes:

• Supabase — Database hosting and user authentication
• Stripe — Payment processing and subscription management
• Anthropic, Google, and OpenAI — These providers supply the AI models that process your conversation inputs to generate planning outputs. Your inputs are transmitted to these providers solely to deliver the Service and are subject to each provider's applicable data processing terms. None of these providers are permitted to use your inputs to train their models under their API terms of service.
• PostHog — Product analytics and session recording
• Google Analytics — Website traffic measurement (referrers and landing pages)
• Sentry — Error tracking and performance monitoring
• Resend — Transactional email delivery
• Vercel — Application hosting and infrastructure

5.2 Legal Requirements

We may disclose your information where required by law, regulation, legal process, or governmental request, or where we believe disclosure is necessary to protect the rights, property, or safety of the Company, our users, or others.

5.3 Business Transfers

In the event of a merger, acquisition, or sale of all or substantially all of the Company's assets, your information may be transferred as part of that transaction. We will provide notice before your information is transferred and becomes subject to a different privacy policy.

6. International Data Transfers

Zalcro is operated from the United States. If you access the Service from outside the United States, your information will be transferred to and processed in the United States, where data protection laws may differ from those in your jurisdiction.

For users in the EEA or United Kingdom, where we transfer your personal data to the United States or other countries not recognized as providing an adequate level of data protection, we rely on appropriate transfer mechanisms including Standard Contractual Clauses as approved by the European Commission. You may request a copy of applicable transfer mechanisms by contacting us at support@zalcro.ai.

7. Data Retention

We retain your information for as long as your account is active or as necessary to provide the Service. Specifically:

8. Your Rights

Depending on your location, you may have the following rights with respect to your personal information:

• Access: Request a copy of the personal information we hold about you
• Correction: Request that we correct inaccurate or incomplete information
• Erasure: Request that we delete your personal information, subject to our legal retention obligations
• Restriction: Request that we restrict processing of your information in certain circumstances
• Portability: Request a machine-readable copy of the information you have provided to us
• Objection: Object to processing based on legitimate interests
• Withdraw consent: Where processing is based on consent, withdraw it at any time without affecting the lawfulness of prior processing

California residents have additional rights under the California Consumer Privacy Act (CCPA), including the right to know what personal information is collected, the right to delete personal information, the right to opt out of the sale of personal information (we do not sell personal information), and the right not to be discriminated against for exercising these rights.

To exercise any of these rights, please contact us using one of the methods in Section 10. We will respond within 30 days. We may need to verify your identity before processing your request.

9. Data Security

We implement technical and organizational measures designed to protect your information against unauthorized access, loss, or misuse. These include:

• Encryption of data in transit using TLS
• Encryption of data at rest within our database infrastructure
• Access controls limiting data access to authorized personnel only
• Infrastructure-level security provided by our hosting and database providers, whose facilities are located in the United States

In the event of a personal data breach that poses a risk to your rights and freedoms, we will notify the applicable supervisory authority without undue delay and, where feasible, within 72 hours of becoming aware of the breach, in accordance with applicable law. Where required, we will also notify affected users directly.

No method of transmission or storage is completely secure. We cannot guarantee absolute security and are not responsible for unauthorized access resulting from circumstances beyond our reasonable control.

10. Account Deletion and Data Removal Requests

We do not currently offer a self-serve account deletion feature. To request deletion of your account and associated personal data, please contact us through one of the following channels:

• Email: support@zalcro.ai
• In-app support form: Available at /support

We will process verified deletion requests within 90 days, subject to our legal retention obligations set out in Section 7.

11. Children's Privacy

The Service is not directed at individuals under the age of 18. We do not knowingly collect personal information from minors. If you believe we have inadvertently collected information from a minor, please contact us at support@zalcro.ai and we will take steps to delete it promptly.

12. Changes to This Policy

We reserve the right to update this Privacy Policy at any time. When we make material changes, we will notify you by email or by a prominent notice within the Service at least 14 days before the changes take effect. The "last updated" date at the top of this Policy reflects the most recent revision. Your continued use of the Service after the effective date constitutes acceptance of the revised Policy.

13. Contact Us

If you have questions, concerns, or requests relating to this Privacy Policy or our data practices, please contact us:

For EEA users: If you are not satisfied with our response, you have the right to lodge a complaint with your local data protection authority. A directory of EU supervisory authorities is available at edpb.europa.eu.