Privacy Policy
1. Who is responsible
Zana is operated by Ezana Kavuma (“we”). Contact: ekkavuma@gmail.com.
2. What we collect
- Account data: your email, name, and sign-in method (Google sign-in or access code).
- What you give Zana: chat messages, files you attach, voice input you choose to use, goals, plans, questions and answers, and preferences.
- Connected account data (only if you connect it, and only the access you allow): from Google — Gmail messages and metadata, drafts, Google Calendar events, Contacts, Drive files and Docs/Sheets/Slides; from GitHub — repositories, issues and pull requests. Zana reads or changes these only to do what you asked or what an accepted plan allows.
- Memory: things Zana learns about you and your goals, stored so it can help you later. Personal memory is private to you. Workspace memory belongs to that Workspace.
- Workspace content: messages, Capsules, and profile details (your name and the role you say you hold) that you add to a shared Workspace.
- Technical data: basic logs (time, errors, usage and cost counters) needed to keep the service secure and working. We store settings in your browser’s local storage; we do not use advertising or cross-site tracking cookies.
3. How we use it
- To provide Zana: answer you, plan, and carry out accepted plans (for example, send an email or create an event as you).
- To write replies and drafts in your voice we may look at a few of your recent sent messages as style examples. They are used for style only, for that reply.
- To keep Zana safe, fix problems, and enforce limits.
- We do not sell your personal data, do not show ads, and do not use your private content to train our own AI models.
4. Google user data (Limited Use)
Zana’s use and transfer of information received from Google APIs to any other app adheres to the Google API Services User Data Policy, including the Limited Use requirements. Specifically: we use Google user data only to provide and improve the features you see in Zana; we do not transfer it to others except to provide those features (for example, to the AI model provider that processes your request), to comply with law, or as part of a merger with notice to you; we do not use it for advertising; and no one at Zana reads your Google data except with your consent, for security or support you ask for, or to follow the law. You can remove Zana’s access any time at myaccount.google.com/permissions.
5. Who we share data with
Only service providers that run Zana, under their own terms, and only what is needed:
- AI model providers (currently OpenAI) process the text of your requests, and the parts of your connected data needed to answer them.
- Hosting and database providers (currently Render) store and serve Zana and its data.
- Google and GitHub, when you connect them, because Zana acts through their APIs.
- Other people you choose: members and administrators of a Workspace see what you add to it; people you email through Zana receive those emails from you.
- Authorities or others when the law requires, or to protect rights and safety.
6. How long we keep it
We keep your data while your account is open and for as long as needed to run Zana. You can delete chat history in the app, disconnect accounts (which removes Zana’s stored access tokens), and ask us to delete your account and data. Some records (for example, security logs and receipts of actions taken) may be kept for a limited time where needed for safety, accounting, or the law.
7. Security
We use encryption in transit, access controls, and, for your Personal Vault, protection with a passphrase only you know. Stored sign-in credentials for websites you ask Zana to use are encrypted and are never shown to the AI model. No system is perfectly secure; if we learn of a breach that affects you we will tell you as the law requires.
8. Your choices and rights
Depending on where you live (for example under the GDPR/UK GDPR or California law) you may have the right to access, correct, delete, or export your data, to object to or restrict some use, and to withdraw consent at any time. To use a right, write to ekkavuma@gmail.com. We will respond within the time the law requires. You can also complain to your local data-protection authority. We do not discriminate against you for using these rights.
9. Children
Zana is not for anyone under 18. If you think a child has given us data, contact us and we will delete it.
10. Where data is processed
Zana and its providers may process data in the United States and other countries. Where required, we rely on appropriate safeguards for transfers.
11. Changes
If we change this policy in a significant way we will tell you in the app or by email before it applies.