Privacy Policy

1. Scope and our role

This policy applies to Zayloft public websites, account and developer experiences, support interactions, and communications, verification, identity, email, voice, AI/NLP and related services that reference it.

Zayloft may act as a controller or business for website, account, billing, security, support and business-operations data. When a customer submits recipient details, message content, contact records, verification data or other Customer Content for processing under the customer’s instructions, Zayloft generally acts as a processor, service provider or contractor. The customer remains responsible for its own collection, notices, permissions and lawful use.

2. Information we may collect

Depending on the service, we may process account and contact details; organization and professional information; billing and transaction metadata; device, IP, browser and access-log information; API, webhook, usage, error and performance telemetry; support correspondence; approximate location inferred from network information; and Customer Content such as phone numbers, email addresses, messages, templates, verification data, contact attributes, AI prompts and outputs.

Payment credentials may be handled directly by payment providers depending on the payment method. Customers should not submit sensitive or regulated data unless it is necessary for the configured service and they have an appropriate legal basis and safeguards.

3. Sources and purposes

Information may come directly from you or your organization, automatically from service use, from integrations you configure, from customers instructing us to process data, from payment or identity providers, communications networks and channel providers, security services, and appropriate public sources.

We use information to provide and troubleshoot services; administer accounts, projects, credentials and roles; authenticate users and applications; prevent fraud and abuse; calculate usage and billing; provide support; maintain reliability and security; comply with law; enforce agreements; and send permitted service or marketing communications.

4. Legal bases where required

Where law requires a legal basis, Zayloft relies on the basis appropriate to the purpose and relationship, which may include contract, legitimate interests, legal obligation, consent or another basis allowed by applicable law. Consent may be withdrawn where the law permits without affecting processing that was lawful before withdrawal.

5. Customer Content and AI/NLP data

Customers control the data they submit and are responsible for ensuring that Customer Content is lawfully collected, authorized and appropriate for the intended recipients and use case.

When AI or NLP functionality is used, prompts, inputs, outputs, retrieved documents, embeddings and related metadata may be processed to provide and secure the requested functionality, subject to applicable product settings and contractual terms.

6. When we disclose information

We may disclose information to cloud, hosting, storage, monitoring, security, support and software providers; telecommunications networks, carriers and channel providers needed to complete requested communications; payment and billing providers; professional advisers; authorized customer administrators; regulators or authorities where required; and a successor in a corporate transaction subject to appropriate safeguards.

We do not publicly expose customer credentials, private provider credentials or unnecessary infrastructure details as part of ordinary user-facing service delivery.

7. Cookies and similar technologies

Our websites may use cookies, local storage and similar technologies for essential operation, security, preferences, localization, analytics and purposes described in the applicable cookie notice or settings. Where consent is required for non-essential technologies, the applicable choice mechanism should be provided before use.

Zayloft does not sell Customer Content or account credentials for monetary consideration. If a website practice is treated as a sale, sharing or targeted advertising under an applicable privacy law, the legally required notice and opt-out mechanism will apply to that practice.

8. Cross-border processing

Zayloft and providers used to operate communications and technology services may process information in more than one country. Where applicable law restricts cross-border transfers, Zayloft uses an available lawful transfer mechanism appropriate to the relationship, such as an adequacy decision, contractual safeguards, approved standard clauses or another mechanism recognized by the relevant law.

9. Retention and security

We retain personal information for no longer than reasonably necessary for the disclosed purpose, taking into account service configuration, contracts, security needs, disputes, legal obligations, billing and accounting requirements, and backup or deletion cycles. Retention therefore differs by data type and service.

We use administrative, technical and organizational safeguards intended to protect information from unauthorized access, use, alteration, disclosure, loss or destruction. No system can be guaranteed completely secure, and customers remain responsible for protecting their own credentials, endpoints, devices and integrations.

10. Privacy rights and choices

Depending on where you live and how Zayloft handles your information, you may have rights to request access, correction, deletion, restriction, portability, objection, withdrawal of consent, information about processing, or other rights provided by law. Some laws also provide rights concerning sale, sharing, targeted advertising, sensitive information, certain profiling and appeals.

We may verify identity, account relationship and authority before completing a request. Authorized agents may act where law permits. For data Zayloft controls directly, email support@zayloft.com with “Privacy request” in the subject. For Customer Content controlled by a Zayloft customer, contact that customer first.

11. Regional notices

EEA, United Kingdom and Switzerland: where applicable, individuals may have rights including access, rectification, erasure, restriction, portability, objection and rights relating to certain automated decisions, subject to legal conditions and exceptions. A complaint may also be made to the competent data-protection authority.

California and other U.S. states: depending on the interaction, categories handled may include identifiers, customer-record information, commercial information, device and network activity, professional information, approximate location, communications or Customer Content, and sensitive information where supplied. Applicable laws may provide rights to know or access, correct, delete, obtain a portable copy, opt out of certain sale, sharing, targeted advertising or profiling activities, limit certain uses of sensitive information, and appeal. Zayloft does not sell Customer Content or account credentials for monetary consideration.

Brazil: where the LGPD applies, data subjects may have rights concerning confirmation and access, correction, anonymization, blocking or deletion in applicable circumstances, portability, information about sharing, consent-related choices and other rights provided by law. Other jurisdictions may provide similar or additional rights.

12. Children and customer use involving minors

Zayloft’s public website and business services are not directed to children as independent consumer users. A customer may use Zayloft in a context involving minors only where the customer has the legal authority, notices, permissions and safeguards required for that use.

13. Changes and contact

We may revise this Privacy Policy when services, processing practices or legal obligations change. The updated policy will show a new “Last updated” date, and additional notice will be provided where legally required.

For privacy questions or rights requests, contact support@zayloft.com with “Privacy request” or “Privacy question” in the subject line. For suspected security issues, use “Security report”. If your request concerns data controlled by a Zayloft customer, identify the customer or organization involved.