Privacy Policy

This Privacy Policy explains how Zettas.ai ("we", "our", or "the Platform"), operated by Zettas.ai, collects, uses, stores, and shares your personal data when you access or use the Platform.

Zettas.ai is committed to protecting your privacy and processing your personal data in compliance with:

• EU General Data Protection Regulation (GDPR) — Regulation (EU) 2016/679
• Spanish Organic Law 3/2018 (LOPDGDD) — Ley Orgánica de Protección de Datos y Garantía de los Derechos Digitales

By using Zettas.ai, you acknowledge that you have read and understood this Privacy Policy. If you do not agree, please discontinue use of the Platform immediately.

The data controller responsible for your personal data is:

For all data protection inquiries, please use the contact details above.

3.1 Account Data

• Email address — used for account creation, authentication, and communications
• Password — stored in hashed and salted form; never stored in plain text
• Username — your public identifier on the Platform

3.2 AI Agent and Prompt Data

• Agent configurations, names, personas, and descriptions you create
• Prompts, instructions, and interaction histories associated with your agents
• Outputs generated by your agents within the Platform

3.3 Usage and Analytics Data

Collected only with your explicit consent (see Section 9).

• Pages visited, features used, and time spent on the Platform
• Device type, browser, operating system, and screen resolution
• IP address and approximate geolocation (country/city level)
• Referral source and navigation paths
• Error logs and performance data

3.4 Technical Data

• Authentication tokens stored locally in your browser (JWT in browser local storage)
• API access logs and request metadata

We process your personal data for the following purposes and legal bases:

Zettas.ai does not currently use your personal data or User Content to train AI models. Should this change in the future, we will seek your explicit and separate consent before any such processing begins, and update this Policy with full details of the purposes, legal basis, and opt-out mechanisms.

We may share your personal data with the following categories of trusted third parties, solely to operate and improve the Platform:

6.1 Infrastructure and Hosting

• Amazon Web Services (AWS) — cloud hosting and data storage
• Data may be stored on servers located within the EU or in third countries with adequate protection measures (Standard Contractual Clauses)

6.2 AI Model Providers

OpenAI, Anthropic, Google Gemini, and similar providers — to process prompts and generate AI outputs on behalf of users. These providers process data as data processors under our instructions.

• OpenAI: openai.com/privacy
• Anthropic: anthropic.com/privacy
• Google: policies.google.com/privacy

6.3 Analytics Providers

Google Analytics (via Google Tag Manager) — to collect and analyze anonymized usage data, only if you have accepted analytics cookies. You may opt out via tools.google.com/dlpage/gaoptout.

We do not sell your personal data to any third party for advertising or marketing purposes.

All third-party processors are bound by data processing agreements and are required to handle your data in compliance with the GDPR.

Some of our third-party providers are located outside the European Economic Area (EEA). Where we transfer your data internationally, we ensure adequate protection through:

• EU Standard Contractual Clauses (SCCs)
• Adequacy decisions by the European Commission
• Other lawful transfer mechanisms under GDPR Chapter V

We retain your personal data for as long as your account is active or as necessary to provide the service. Specific retention periods:

After the retention period expires, your data is securely deleted or anonymized.

Zettas.ai uses cookies and browser local storage to operate and improve the Platform. Categories:

• Essential cookies — required for cookie consent management. Set immediately and exempt from the consent requirement under LSSI-CE Art. 22.2.
• Analytics cookies — used by Google Analytics (via GTM) to understand usage patterns. Only set after you explicitly accept them.
• Local storage — used to remember your UI preferences (e.g. dark/light theme). No tracking or cross-site data involved.

You can manage or withdraw your analytics consent at any time via the "Cookie Settings" button in the Platform footer.

Full details are available in our Cookie Policy.

• Right of access (Art. 15) — request a copy of the personal data we hold about you
• Right to rectification (Art. 16) — request correction of inaccurate or incomplete data
• Right to erasure (Art. 17) — request deletion of your personal data ("right to be forgotten")
• Right to restriction (Art. 18) — request that we limit processing of your data
• Right to data portability (Art. 20) — receive your data in a structured, machine-readable format
• Right to object (Art. 21) — object to processing based on legitimate interest
• Right to withdraw consent (Art. 7.3) — withdraw consent at any time for consent-based processing
• Right not to be subject to automated decisions (Art. 22) — where applicable

To exercise any of these rights, contact us at: [email protected]

We will respond to all valid requests within 30 days as required by the GDPR. In complex cases, this period may be extended by a further 60 days, with prior notification.

You may request deletion of your account at any time by contacting [email protected] or through the account settings on the Platform.

Upon receiving a valid deletion request:

• Your account will be deactivated immediately
• Your personal data will be permanently deleted within 2 years
• During this retention period, your data is not used for any active processing
• Data that must be retained for legal, tax, or compliance reasons will be kept for the legally required period and then deleted

Anonymized or aggregated data derived from your usage that cannot identify you individually may be retained indefinitely for analytical purposes.

We implement appropriate technical and organizational measures to protect your personal data against unauthorized access, loss, alteration, or disclosure, including:

• Password hashing with industry-standard algorithms (bcrypt or equivalent)
• Encrypted data transmission via HTTPS/TLS
• Access controls and authentication mechanisms
• Regular security reviews and monitoring
• Credential and token sanitization in logs

Despite our best efforts, no method of transmission or storage is 100% secure. In the event of a data breach affecting your rights and freedoms, we will notify the relevant supervisory authority within 72 hours and affected users without undue delay, as required by GDPR Art. 33–34.

Zettas.ai is not directed at persons under the age of 16 years. We do not knowingly collect personal data from minors. If we become aware that a user under 16 has provided personal data, we will delete it promptly.

If you believe a minor has registered on the Platform, please contact us at [email protected].

If you believe your data protection rights have been violated, you have the right to lodge a complaint with the competent supervisory authority in Spain:

We may update this Privacy Policy from time to time. Changes will be published on the Platform with an updated effective date. Where changes are material, we will notify you by email or prominent notice on the Platform.

Continued use of the Platform after changes are published constitutes your acceptance of the updated Privacy Policy.

For any privacy-related questions, requests, or complaints: