1. Introduction
This Privacy Policy explains how Zybo AI ("we", "us", "our"), operated by Zyfolks Technologies LLP (a limited liability partnership registered in Kerala, India), collects, uses, and shares information when you use our customer-support platform at zybo.ai and the related dashboard at app.zybo.ai.
Zybo AI is a multi-tenant SaaS product. Your organization (the customer) is the data controller for the conversations and content your AI agents process; we are the data processor. This policy covers our role as a controller (account data, billing, marketing) and as a processor (your end-users' chat data).
tl;dr — We collect what we need to run the product, never sell your data, and scope every record to your workspace with a tenant identifier on every row.
2. Information we collect
We collect a few categories of information, each for a specific purpose:
- Account data — name, email, password hash (bcrypt cost 12), organization name, role. Used to authenticate you and scope access.
- Billing data — plan, subscription status, billing currency (USD or INR), invoice history, and any pending plan or currency changes. Card numbers and UPI handles themselves are processed by Razorpay; we never see or store them.
- Usage data — pages viewed, features used, API request counts, model token counts, message counts. Used for product analytics, debugging, and billing accuracy (per-query overage above your plan quota is calculated from these counts).
- End-user / chat data — messages exchanged with your AI agents and human agents, attachments you accept on conversations, and any context you provide (uploaded knowledge-base documents, crawled website content). Stored on your behalf as a processor.
- End-user identity (operator-controlled) — for end-users who chat through your widget, we may collect: an opaque visitor token (stored in their browser's localStorage), name / email / phone if your pre-chat form collects them, IP address, MaxMind-derived geolocation (country, region, city), device type, browser, OS, referrer URL, current page URL, UTM parameters, and the pages they visit in a session. See section 6 for the optional pre-chat visitor map.
- Transactional emails — we send transactional emails (sign-in magic links, email verification, password resets, OAuth identity-linked confirmations, workspace invites, scheduled-deletion warnings, ownership transfers, payment-failed alerts, subscription downgrades). All are sent via Resend.
- Communications with us — support tickets, demo requests, contact-form submissions.
- Audit log — every authentication event and every state-changing API call (records actor, action, affected resource, source IP, timestamp). See Security § 5.
3. How we use information
We use the information above to:
- Provide the service. Authenticate users, route messages, generate AI responses, deliver attachments, send notifications, calculate billing.
- Improve the product. Aggregate, anonymized metrics — e.g. average response latency, feature adoption rate, model cost per tier. We do not train shared AI models on your data. See section 11 for how prompts are forwarded to LLM providers.
- Security & abuse prevention. Detect prompt-injection attempts, throttle abusive traffic, investigate suspected unauthorized access, and maintain audit + security-event logs.
- Legal compliance. Respond to lawful requests, enforce our Terms, prevent fraud, and comply with tax and accounting obligations.
- Marketing. Send transactional and (with your consent) product-update emails. You can unsubscribe from non-transactional emails at any time.
6. Visitor map (operator-controlled)
Zybo AI offers an optional "visitor map" feature that aggregates anonymized location data about visitors to your site. It is off by default on every workspace; the customer (your organization) enables it per AI agent in the dashboard.
When enabled, we record for each visit:
- Country, region, and city (derived server-side from the visitor's IP via our local MaxMind GeoLite2 database).
- Device type (desktop / mobile / tablet), referrer URL, current page URL, and UTM parameters.
- The visitor's opaque token (a browser-local UUID; not tied to any account).
We do not store the visitor's raw IP address or full User-Agent string in the visitor-events table. (Raw IP + User-Agent are retained on end_user_profiles for visitors who actually start a chat — used by your agents for fraud / support context.)
Retention is tiered: raw events 48 hours; hourly aggregates 90 days; daily aggregates 365 days. Aggregates contain only geographic and device buckets, no individual visitor identifiers.
If you are an end-user and want to opt out of being counted by a site's visitor map, contact that site's operator (the data controller) directly.
7. Data retention
We retain data for as long as you have an active account, with the following specifics:
- Conversations & messages — retained for the lifetime of your workspace. Deleting an individual AI agent removes its knowledge base, API keys, and widget settings, but conversation transcripts are kept for audit and analytics. Deleting your workspace cascades to all conversations and messages.
- Documents & embeddings — retained while the source document is live in your knowledge base. Re-ingestion replaces the previous version; deletion is immediate.
- Account & workspace deletion — a 30-day grace period applies. After you schedule deletion you (or any owner) can cancel within those 30 days; after that a daily lifecycle worker hard-purges the account / workspace and all its data. Email reminders are sent at T-7 and T-1 days.
- Visitor map data — see section 6: raw events 48 hours, hourly aggregates 90 days, daily aggregates 365 days.
- Audit logs & security events — retained for the lifetime of your account. Available for review in the dashboard by owners and admins.
- Revoked / expired API keys — periodically purged by the lifecycle worker once they are past their
revokedAt+ grace window. - Billing records — invoices and subscription history are retained for tax and accounting obligations even after account deletion, as required by applicable law.
8. Your rights
Depending on where you live, you have rights over your personal information:
- Access & portability — request a copy of your data. We currently fulfil access requests by email; send a request to support@zybo.ai and we will respond within 30 days.
- Correction — fix inaccurate data via the dashboard (profile, workspace settings) or by emailing us.
- Deletion — close your account or workspace via the dashboard, subject to the 30-day grace period described in section 7. Billing records may be retained as required by law.
- Object & restrict — opt out of non-essential processing such as marketing emails (every marketing email has an unsubscribe link).
- Complain — lodge a complaint with your local data-protection authority.
If you are an EU/UK resident, these rights flow from the GDPR/UK GDPR. If you are a California resident, you also have rights under the CCPA/CPRA, including the right not to be discriminated against for exercising them. Indian residents have rights under the Digital Personal Data Protection Act, 2023.
End users of our customers' AI agents should direct rights requests to the customer (the data controller) in the first instance. We will assist the customer in fulfilling those requests.
To exercise your rights, email support@zybo.ai.
9. International transfers
Zybo AI is operated from India; some sub-processors (OpenAI, Cohere, Resend, Google, Cloudflare) are headquartered in the United States. Using the service involves the transfer of your data to those jurisdictions.
For transfers from the EU/UK/Switzerland to the US, we rely on Standard Contractual Clauses (SCCs) with onward transfer safeguards. Customers can request a signed Data Processing Agreement (DPA) including the SCCs by emailing support@zybo.ai. See also our Data Processing Agreement.
USD billing via Razorpay International Payments: USD subscriptions are routed through Razorpay's International Payments product. Card and billing details for USD subscriptions are processed by Razorpay in India under RBI regulation, and your bank may apply foreign-transaction charges. INR subscriptions are processed within India.
10. Children’s privacy
Zybo AI is a B2B product not directed at children. We do not knowingly collect personal information from anyone under 16. If you believe a child has provided personal information to us, contact support@zybo.ai and we will delete it.
11. AI inference & security
We treat security as a product requirement, not a compliance afterthought. Specifically:
- Tenant scoping. Every database row that holds RAG / chat data carries a
tenant_id; every query filters on it. Vector similarity searches pre-filter bytenant_idin the SQLWHEREclause before any scoring, so a search for one tenant cannot mathematically return another tenant's chunks. - Encryption in transit. TLS 1.2+ for all customer traffic, terminated at the Cloudflare edge.
- Encryption at rest. AES-256-GCM at the application layer for secrets we re-display (AI-agent API keys revealable from the dashboard; OAuth refresh tokens for customer-connected identity providers). Cloudflare R2 encrypts every stored object at rest with AES-256 by default.
- Auth tokens. Passwords use bcrypt (cost 12). Refresh tokens, magic-link tokens, password-reset tokens, and email-verification tokens are stored as one-way SHA-256 hashes; refresh tokens rotate on every use.
- Append-only audit log of every authentication event and state-changing API call (see Security § 5).
- Application hardening. Prompt-injection detection (configurable strictness), output filtering, per-tier rate limiting, per-organization budget enforcement.
How prompts reach the LLM: when one of your end-users sends a message to an AI agent, the message + the relevant retrieved knowledge-base chunks are sent to OpenAI's chat-completion API for inference. OpenAI's API data-use policy applies — OpenAI does not train its models on data submitted via the API (per its API data-usage policy, in effect since March 2023). We do not separately log prompts to a training corpus and we do not fine-tune shared models on your data.
For details, see our Security page. To report a vulnerability, email security@zybo.ai.
12. Contact & changes to this policy
We may update this policy from time to time. When we make material changes, we will notify customers by email and update the "Last updated" date at the top of this page.
Questions, requests, or concerns? Email support@zybo.ai or visit our contact page.
Operator: Zyfolks Technologies LLP, Kerala, India.
Questions about this document? Email support@zybo.ai or visit our contact page.