Privacy Policy - how Zene handles your data

This policy explains how Zene (“Zene”, “we”, “us”) handles personal data when you visit tryzene.com or use the Zene app. We've tried to write it the way we'd want one written for us: short, specific, and free of dark patterns.

The short version

We collect the data needed to run your account, your visibility scans and your billing - and little else.
We do not sell your data, and we don't run third-party advertising or tracking pixels in the app.
Your account and workspace data is stored in the EU, on a server we run ourselves.
Payments are handled by Polar as merchant of record - we never see or store your full card details.
You can export or delete your account and its data at any time from Settings.

What we collect

Account data. Your name and email, and a password (stored only as a salted hash by our authentication service). If you sign in with Google, we receive your name, email and profile photo from Google.
Workspace data. The brands, competitors, questions and settings you add, plus the scan results, scores, cited sources and actions Zene generates for you.
Billing data. Your plan, subscription status and invoices. Card processing is performed by Polar; we receive the status of your subscription, not your card number.
Technical data. Essential session cookies, your theme preference, and basic server logs (IP, timestamp, error traces) used to keep the service secure and working.

How we use it

To provide the service (run scans across AI engines, compute your visibility score, generate recommendations), to authenticate you, to bill you, to send service email you've asked for or that's essential to your account, and to debug, secure and improve the product. We process this data to perform our contract with you and on the basis of our legitimate interest in operating a secure, reliable service.

The AI engines we query

To measure your visibility, Zene sends your buyer questions (which may include your brand and competitor names) to third-party AI engines - OpenAI (ChatGPT), Anthropic (Claude), Google (Gemini), Perplexity and xAI (Grok). These prompts are about brands and categories, not about you personally. Each provider processes them under its own terms.

The AI traffic snippet on customer websites

Zene customers can add a small script (tryzene.com/t.js) to their own website to measure visits that arrive from AI assistants. If you visit such a site and you came from an AI assistant (for example ChatGPT, Perplexity, Gemini or Claude), the script sends Zene the AI service's domain, the page path you landed on and the site's public key. Visitors who didn't come from an AI assistant are never reported.

If the website owner also reports conversions (for example a purchase or a signup) with the script, an AI-referred visit keeps one flag in that browser tab's session storage (cleared when the tab closes). A conversion is only sent from a tab with that flag - with its type and, if the site provides one, its value and currency - and is linked on our side to the AI-referred visit through the same daily visitor hash. Conversions of visitors who didn't come from an AI assistant are never sent.

The script sets no cookies, uses no local storage, and honours Do Not Track and Global Privacy Control. Our server derives a coarse device type and country from the request and stores a hashed visitor identifier that changes daily and can't be reversed to your IP address or browser. We don't store the IP address or the browser identifier (User-Agent) itself. The website owner is the controller of this data; Zene processes it on their behalf.

Google Search Console and Google Analytics connections

Workspace owners and admins can connect a Google account to a brand so Zene can read that website's Search Console and Google Analytics 4 reports (read-only access). Zene stores the Google account's email address, an encrypted refresh token and daily per-page aggregates (search clicks, impressions and position; sessions, key events and revenue from GA4's AI Assistant channel). No data about individual visitors is read from Google. Disconnecting revokes the access at Google and deletes the synced data; synced data is otherwise kept for 16 months.

Email we send

Account and service email (sign-in codes, receipts, invitations, alerts you switched on) is part of providing Zene. In your first week we also send a few getting-started emails (a welcome, a setup reminder, quick wins and, on the Free plan, a first-week summary); every one of them has a one-click unsubscribe, and you can manage all notification email in Settings.

Marketing email (product updates and GEO tips, about twice a month at most) is sent only with your consent: the optional, unticked box at signup, the setting in Settings → Account, or a newsletter signup that you confirm from the email we send you (double opt-in). Every marketing email has an unsubscribe link, and withdrawing consent removes you from our marketing list. If you delete your account, your contact is deleted from it too.

If an email to you bounces permanently or is reported as spam, we record the address on a suppression list and stop emailing it.

Sub-processors

We rely on a small set of vendors to run Zene. Each handles only the data needed for its role:

Contabo GmbH (Germany) - hosting: the server in Contabo's EU data centre that runs the Zene app, database, authentication, file storage and background functions. We operate this software ourselves (built on the open-source Supabase stack); Contabo provides the server and data centre.
Cloudflare - CDN, DNS and proxy in front of tryzene.com: it carries requests to and from Zene (including your IP address) and protects the site against abuse. Cloudflare AI Gateway also relays our requests to the AI engines below (the scan prompts built from your brand, competitors and questions, and the engines' answers).
Polar - billing and payments (merchant of record).
Google - optional sign-in (OAuth / One Tap), and Google Ads conversion measurement on our website (see Cookies).
OpenAI, Anthropic, Google, Perplexity, xAI (Grok) - running your visibility scans (reached through Cloudflare AI Gateway).
SerpApi - search-result data for question discovery (the search phrases derived from your brand category and questions).
Resend - sending our email (account, notification and, only with your consent, marketing email) and holding the marketing contact list (email address, first name and subscription status).

Cookies

We use cookies that are strictly necessary to keep you signed in and to remember your theme.

We advertise Zene on Google, so our website loads the Google tag (Google Ads) to measure which ads lead to sign-ups. It may set Google advertising cookies and tells Google when a visitor who clicked one of our ads creates an account. Visitors in the EEA, the UK and Switzerland get this tag with advertising and analytics storage switched off by default (no advertising cookies are set; Google receives only cookieless signals). Browsers that send Do Not Track or Global Privacy Control never load it. We don't use other third-party advertising or analytics pixels.

To understand how the product is used (for example, whether new users finish setup or reach their first scan), Zene records first-party usage events in its own database. No third-party analytics service receives them, no extra cookies are set, and browsers that send Do Not Track or Global Privacy Control are not tracked from the client side.

Data retention

We keep your data for as long as your account is active. When you delete your account, we delete or anonymize your personal data within a reasonable period, except where we're required to retain certain records (for example, invoices for tax purposes).

Some operational and event data is deleted automatically, even while your account is active:

AI-traffic visits recorded by the website snippet, and product usage events: 13 months (395 days).
AI crawler counts from the server or CDN logs you connect (per day, crawler, page and status class - we never store IP addresses or full user agents from those logs): 13 months (395 days).
Raw AI engine requests and responses kept for troubleshooting: 90 days. We keep the cost and usage record of each call, without its content.
Superseded AI answers that none of your results link to anymore: 180 days.
Integration delivery logs (Slack, Microsoft Teams, webhooks, Zapier): 30 days.
API usage counters: 7 days.
Resolved error reports: 90 days after they're resolved.
Processed billing webhooks from our payment provider: 180 days. Invoices and subscription records are kept as the law requires.
In-app notifications you've read: 1 year. Unread notifications stay until you read or delete them.
Email delivery events we receive from our email provider (unsubscribes, bounces, spam reports): the event identifiers 30 days; the suppression list is kept while it is needed to stop emailing an address.
Rate-limit counters, which hold a keyed hash of your IP address and never the address itself: deleted within about 15 minutes.

Your rights

Depending on where you live (including under the GDPR and CCPA), you may have the right to access, correct, export or delete your personal data, and to object to or restrict certain processing. You can do most of this yourself in Settings, or contact us and we'll help. We won't discriminate against you for exercising these rights.

Data location, transfers & security

Where your data is stored: Zene's database, authentication, file storage and application run on a server in the EU, in a Contabo GmbH data centre, operated by us. We don't use a US-hosted database provider.

Some of the sub-processors listed above - for example the AI engines, Polar, Resend, SerpApi, Google and Cloudflare - are based in, or may process data in, countries outside the EU, including the United States. Where required we rely on appropriate safeguards for those transfers. We protect data with encryption in transit, row-level access controls and the practices described on our security page.

Children

Zene is a business tool and isn't directed at children under 16. We don't knowingly collect their data.

Changes

If we make material changes to this policy we'll update the date above and, where appropriate, notify you. Continuing to use Zene after a change means you accept the updated policy.

Contact

Questions, or want to exercise a data right? Email privacy@tryzene.com. See also our Terms of Service.