Privacy Policy
Last updated: 25 October 2026 · version 2026-10-27b
This policy explains how Zaags, operated by RUDLU Unipessoal Lda (NIPC 516730304, 27A Rua da Bela Vista à Graça, 1170-058 Lisboa, Portugal, contact@zaags.app; operator of zaags.app, zaags.com and related websites), handles your personal data. We are the data controller for your Zaags account. Our guiding principle: Zaags should see as little of your information as possible.
1. What we collect
- Account data: when you sign in with Google we store your e-mail, name and profile picture and the date and version of the Terms you accepted. We do not receive your Google password. Website owners who sign in by e-mail link give us their e-mail only.
- Content you create: chats, notes, tasks, documents and your website content. You can keep chats, notes and tasks in your own Google Drive or your own Supabase database; when you choose that, we delete our copy and keep none. Otherwise a working copy is stored on our servers so the service can run, until you delete it. In Full Privacy mode, and when you pick a 🔒 EU-private model, AI chats are processed in the European Union by Mistral AI (France) under its data-processing terms, are not used to train AI models, and are not sent to our other AI providers; messages written in a private turn are never passed to an Open model later in the same conversation. When you ask the assistant about your own information (for example your calendar, mail, tasks or bookings), it reads only the items needed to answer that question: in Open mode that snippet is sent to the AI provider for the single reply and is not retained by the provider; in Full Privacy mode it is processed in the EU by Mistral AI and not used for training. You can switch each source off in Settings → Chat and see what the assistant looked at.
- Connected services: if you connect Google (Drive, Calendar, Contacts, Photos, Meet), a mailbox (IMAP/SMTP), WhatsApp, Telegram, a bank feed, Stripe, a WooCommerce store or a smart-home hub, we store the credentials needed, encrypted with a key kept outside the database, and access only what is needed for the feature you asked for. Contacts you sync are kept as a short-lived working copy (7 days) and rebuilt from Google when needed.
- Usage & billing: credit usage, subscriptions and payments (processed by Stripe — we never see full card numbers), invoices, and basic technical logs needed to run and secure the service (sign-ins with IP address and browser, security events).
- Your customers’ data (bookings, orders, enquiries, CRM records, employee attendance) when you use a business feature: see section 9 — you are the controller, we are your processor.
2. Why we use it (lawful bases)
To provide and secure the service and perform our contract with you (Art. 6(1)(b) GDPR); to process payments and keep accounting records (legal obligation, Art. 6(1)(c)); to protect the service against fraud and abuse and to send security notices (legitimate interest, Art. 6(1)(f)); and, with your consent where required, for optional features such as location or camera access. We do not sell your personal data and we do not use it for advertising.
3. Google user data
Zaags’s use of information received from Google APIs adheres to the Google API Services User Data Policy, including the Limited Use requirements. We request only the scopes a feature needs — Contacts (read, and write if you enable editing) to show and keep your address book in People, Drive to store your own files, Calendar for your events, Photos for the pictures you pick. We do not request Gmail access: mail works through your own mailbox (IMAP/SMTP). We use Google data only to provide the features you enable, never for advertising, never to train AI models, and never sell it. Humans at Zaags do not read it except with your explicit permission for support.
4. Who can see what inside Zaags
- Your chats, mailbox, files, contacts and notes are not visible to Zaags staff; there is no administrator screen that opens them.
- Your website’s customer data (bookings, orders, payments) is visible to you only; not to Zaags, and not to a designer after your site has been handed over. If you ask support for help, you can allow access for 7 days from your site’s Business details; it switches off by itself.
- Zaags staff see account metadata needed to run the service: your e-mail, plan, credit balance, counts of items, billing and security events.
Zaagster link
Zaagster (zaagster.com) is operated by the same company. If the same e-mail address has an account on both, the two apps are linked: Zaags Messenger can show and answer your Zaagster conversations, and Zaagster Messages can show and answer your Zaags conversations. Each side reads the other live, only when you open it, over an authenticated server-to-server connection; nothing is copied or kept on the other side except unread counters. A message you type in Zaags is stored where Zaags stores it (your own Drive/Supabase); a message you type “via Zaagster” is stored on zaagster.com like any Zaagster message. Both directions can be switched off in Messenger → 🔗 Zaagster. Contact syncing is only on your request: “Import my Zaagster friends” adds your accepted Zaagster friends to your Google Contacts (name, profile link, photo; e-mail only when they are also a Zaags user); “Find my contacts on Zaagster” sends only SHA-256 fingerprints of your contacts’ e-mail addresses, never names or addresses, and Zaagster stores nothing until you choose to send a friend request. The optional “keep in sync” boxes repeat these on a schedule and can be unticked at any time.
5. Sharing and sub-processors
We share data only with service providers that help us run Zaags, under contract, and where required by law. Content you publish on a website is, by its nature, public. In Open AI mode your prompts and the content you attach are processed by outside AI providers; in Full Privacy mode they are not. The same applies to the snippets of your own app data (calendar events, mail headers, tasks, bookings) that the assistant reads on your request. Our current sub-processors:
| Provider | Location | Purpose |
|---|---|---|
| Google LLC (Google Cloud, Google APIs, Google Maps/Places) | USA (EU SCCs) | sign-in; Drive, Calendar, Contacts and Photos features you connect; business data for the website maker |
| Stripe Payments Europe Ltd | Ireland / USA | card payments, subscriptions, invoices |
| PlanetHoster (N0C) | Canada / France | hosting of zaags.app (servers, backups) |
| Hetzner Online GmbH | Germany | AI gateway (routes AI requests) |
| Mistral AI SAS | France (EU) | AI chat in Full Privacy mode and with the 🔒 EU-private models; not used for training |
| OpenAI, OpenRouter (and the model providers it routes to), Replicate, Black Forest Labs | USA | AI text, image, logo and video generation in Open mode; audio transcription and voices |
| remove.bg (Kaleido AI GmbH) | Austria | logo background removal |
| Brave Software, DuckDuckGo, Steel.dev, Scrapling sidecar (own server) | USA / Germany | web search and page reading when you use search or import features |
| Meta Platforms Ireland (WhatsApp Business), Kapso | Ireland / USA | WhatsApp inbox and messages when you connect a number |
| Telegram FZ-LLC | UAE | alerts you choose to receive on Telegram |
| GoCardless Ltd | UK | open-banking bank feed when you connect an account |
| Firma.dev | EU | electronic signature requests |
| Supabase Inc | USA / EU region of your choice | your own data store when you connect one (you hold the keys) |
| Pexels, Openverse, Gravatar (Automattic) | USA | stock photos and profile-picture lookups |
| Revolut, Moloni, WooCommerce stores you connect | EU / your choice | payment links, invoicing and back-office orders for your own business, under your own accounts |
We update this table when a provider changes; business customers under the DPA are notified of additions in advance.
6. International transfers
Some providers above are established outside the European Economic Area (notably in the United States). Transfers rely on the European Commission’s Standard Contractual Clauses, on the EU–US Data Privacy Framework where the provider is certified, and on additional safeguards (encryption in transit and at rest). Full Privacy mode keeps AI processing in the EU.
7. Retention
- Account, settings and content: for as long as your account exists, or until you delete the item.
- Sign-in sessions and security events: sessions end after inactivity or sign-out; security events are kept 12 months.
- Billing and invoices: 10 years (Portuguese accounting law), without the rest of your profile once the account is deleted.
- Cookie-consent proofs on your websites: 12 months, with the IP address truncated.
- Employee attendance (Presence): location pings 90 days; check-in photos 30 days unless the employer sets another window; attendance records as long as the employer keeps them.
- Scheduled e-mails that failed to send: 7 days. Synced contacts working copy: 7 days. History of changes to your contact cards (shown by People → 🕑 Updates): 12 months, visible only to you.
8. Your rights, export and deletion
Under the GDPR you can access, correct, delete, restrict or port your personal data, and object to certain processing. In My account you can download everything we hold about you as one file and delete your account yourself (7-day grace period, then permanent erasure of all data, tokens and files; billing records excepted). For anything else write to contact@zaags.app. You may also complain to the Portuguese supervisory authority, the CNPD.
9. Businesses using Zaags with their own customers and staff
When you use a website built with Zaags, book a table, place an order, send an enquiry, check in at work or appear in a business’s CRM, that business is the controller of your personal data and Zaags processes it on the business’s behalf under our Data Processing Agreement. Each site carries its own privacy notice; contact the business to exercise your rights, and us if you cannot reach them.
10. Cookies
On zaags.app we use only the cookies needed to run the site and keep you signed in; there is no advertising or tracking cookie. You can decline optional cookies in the banner; declining changes nothing you can do in the app. Websites built with Zaags show their own banner with equal Accept and Decline choices.
11. Automated decisions
We use automated checks for content safety, fraud and payment risk, and the attendance tool can flag anomalies to an employer. You can ask for a human review of any decision that significantly affects you (see the Terms, section 17).
12. Security
Connections are encrypted (TLS); credentials of connected accounts are encrypted at rest with a key stored outside the database; sessions are protected by HttpOnly cookies and an idle time-out; two-step verification is available and sensitive changes require a fresh code; outbound fetches are restricted to public hosts; every security-relevant change on your account is e-mailed to you.
13. Changes & contact
We may update this policy; material changes are notified and the version number changes. Questions? contact@zaags.app — RUDLU Unipessoal Lda, 27A Rua da Bela Vista à Graça, 1170-058 Lisboa, Portugal. Contact form →