Privacy policy

1. Who is responsible

We are the controller for data about our customers (businesses and their users), website visitors and people who contact us.

When a business uses Zembraa AI to answer its own customers (chat, email, SMS and bookings), that business is the controller for its customers' data and we are its processor, under the data processing agreement between us. If you are a customer of a business that uses Zembraa AI, contact that business about your data. We help the business respond to you.

2. What we process, and why

• Accounts and users: name, email address, role and sign-in history. To provide the service (contract, GDPR Art. 6(1)(b)).
• Billing: company name, organisation number, invoice and payment details. Card details are processed by Stripe and never stored by us. To invoice (contract) and meet bookkeeping obligations (legal obligation, Art. 6(1)(c)).
• Content our customers add: knowledge base, rules, settings and conversations with their customers. To provide the service on the customer's behalf (as processor).
• Demo requests and enquiries: name, email, company and your message. To reply to you (legitimate interest, Art. 6(1)(f)).
• Technical data: IP address, browser type and error logs. For security, abuse prevention and troubleshooting (legitimate interest).

3. Artificial intelligence

Zembraa AI uses language models (Claude by Anthropic) to draft replies, and a text analysis service (Voyage AI) to search the business's knowledge base. Messages and relevant knowledge are sent to these providers only to produce the reply. They are bound by data processing agreements and do not use the data for other purposes.

The business decides what is sent automatically and what a person must approve. Customers are always told they are talking to an AI assistant and can ask for a person.

4. Where data is stored, and who we share it with

The database and the application run in the EU (Ireland). We use these sub-processors: Supabase (database and sign-in, EU), Vercel (hosting, EU), Anthropic (AI model, USA), Voyage AI (text analysis, USA), Inngest (background jobs, USA), Resend (email, EU/USA), Stripe (payments, EU), Twilio (SMS if used, EU/USA), Cloudflare (bot protection in the chat, EU/USA) and Sentry (error monitoring, EU).

Transfers outside the EU/EEA rely on the European Commission's Standard Contractual Clauses. We never sell personal data.

5. How long we keep data

• Conversations and bookings are deleted automatically after the retention period the business chooses (default 365 days, between 30 days and 10 years).
• Account data is kept for as long as the customer relationship lasts and deleted at the latest 90 days after the account is closed.
• Accounting records are kept for 5 years, as Norwegian bookkeeping law requires.
• Demo requests and enquiries are kept for up to 24 months.

6. Cookies

We only use necessary cookies: sign-in (so you stay signed in), language choice, and a short-lived security cookie when you connect an email account. The chat widget stores a random conversation ID in the browser so the conversation continues if the page reloads, and Cloudflare may set a cookie to stop bots. We use no analytics or advertising cookies.

7. Your rights

You can ask for access, correction, deletion, restriction and a copy of your data (portability), and you can object to processing based on legitimate interest. Write to support@zembraa.com and we will reply within 30 days.

You can also complain to the Norwegian Data Protection Authority, Datatilsynet (datatilsynet.no).

8. Security

Data is encrypted in transit, access tokens for email and calendars are stored encrypted, and each business only sees its own data. We log important actions and will notify you without undue delay of a security breach that affects you.

9. Changes and contact

We may update this policy. We notify our customers by email of material changes.

Privacy questions: support@zembraa.com. ZEMBRAA JOMAA DIGITAL (sole proprietorship, org. no. 938 705 739, Kristiansand, Norway).