Privacy Policy

Who handles your data

Zintara operates a business email outreach service. The operator’s legal name, registered address, applicable representative, and jurisdiction must be confirmed before this notice is finalized. Use Contact for privacy requests and identify your message as a privacy inquiry.

For account administration, billing, security, and support, the service operator determines why and how information is used. For lead lists, campaigns, and mailbox content processed on a customer’s instructions, the customer generally determines the purpose of processing. The applicable agreement establishes the parties’ responsibilities.

Information processed

Account information includes name, email, authentication records, and workspace membership. Customer content can include imported lead details, public research sources, campaign messages, templates, mailbox connection information, synchronized replies, and attachments.

Service records can include sending events, replies, bounces, unsubscribe events, configured open or click tracking, diagnostic logs, IP addresses and request information, subscription identifiers and billing status. Payment providers handle information submitted on their checkout pages under their own notices.

Contact submissions include your name, email, optional company, selected topic, message, submission time, and administrative read status. We receive information directly from you, your workspace users, connected mailboxes, configured providers, public research sources, and operation of the service.

Purposes and legal bases

We use information to create and secure accounts, deliver requested features, send and synchronize email, provide support, administer subscriptions, investigate abuse, and comply with legal obligations. We do not sell customer lead lists.

Where GDPR applies, processing may rely on performance of a contract with an individual, legitimate interests in operating and securing a business service, compliance with legal obligations, or consent where required. The applicable basis depends on the activity and relationship. Customers remain responsible for the legal basis for their outreach and for required transparency to recipients.

AI features

AI research and writing may send relevant lead fields, public website content, and instructions to a configured AI provider. Requesting an AI reply may send the selected conversation as context. Avoid unnecessary sensitive information and review generated output before sending.

Provider identities, processing locations, retention, and contractual data-use restrictions must be confirmed for the production configuration. This notice does not represent that every possible provider or configuration prohibits all model training. Google user data remains subject to the specific restrictions below.

Google user data

When you connect Gmail or Google Workspace, the requested permissions support sending, reply and bounce synchronization, and supported message-management features. Access is limited to the service features you authorize.

Use and transfer of information received from Google APIs must comply with the Google API Services User Data Policy, including Limited Use requirements. Google user data is not used for advertising, sold, or used to train generalized AI models. Human access is restricted to permitted circumstances such as your affirmative support authorization, security investigations, or legal requirements.

You can revoke access in your Google Account and disconnect the mailbox in Email Accounts. Revoking access stops future authorized access; it does not automatically erase previously stored messages, attachments, backups, or records subject to retention. Contact us about deletion.

Google API Services User Data Policy

Recipients and international processing

Information may be processed by infrastructure, storage, email, AI, and billing providers needed for enabled features, by authorized workspace users, and by service personnel with a business need. We may disclose information when legally required, to address fraud or security issues, or in connection with a lawful business transfer with appropriate protections.

The Subprocessors page describes the production inventory that must be confirmed. Where cross-border transfers require safeguards, the responsible parties must put in place an applicable mechanism, such as an adequacy decision or appropriate contractual safeguards. This draft does not claim that a particular transfer mechanism has already been executed.

Retention and deletion

Retention depends on the purpose, account relationship, customer instructions, legal recordkeeping duties, security needs, disputes, and technical backup cycles. Active workspace content is maintained to provide requested functionality until removed under applicable settings or instructions. Limited billing, security, and suppression records may need to remain after an account or message is deleted.

Workspace deletion is destructive and is subject to account permissions and subscription conditions. It is not a promise of immediate erasure from every backup or external provider. Production retention periods and backup-expiry schedules must be confirmed before this notice is finalized.

Privacy rights and requests

Depending on applicable law, you may request access, correction, deletion, restriction, portability, or objection to processing, and withdraw consent where processing relies on it. Rights can be subject to legal conditions and exceptions. You may complain to the relevant data protection authority.

Submit requests through Contact. We may need proportionate identity verification. For information uploaded by another business, direct your request to that business; we assist it as required by our agreement and applicable law. Request export assistance where a self-service export is unavailable. We do not promise a complete workspace export from Settings.

Cookies, tracking, and security

The Cookie Policy describes authentication cookies, browser storage, and campaign tracking. Customers must provide any notices and obtain any permissions required for tracking recipients.

We use access controls and security measures appropriate to service operations. No service can guarantee absolute security. Report suspected unauthorized access through Contact without sharing credentials. The service is intended for business users, not children.

Outreach and suppression

Customers must follow applicable anti-spam rules and honor recipient objections. The Acceptable Use Policy explains sender identification, opt-outs, and our right to restrict or terminate accounts for spam or abuse.

Changes to this notice

Material changes will be reflected in the notice and communicated when required. This review version is not a certification of compliance or a substitute for the required operator and deployment details.