Privacy Policy

Last updated: November 9, 2026

Translations help explain this page and are generated automatically. They may contain errors. The English version controls where local law permits; your mandatory rights remain unchanged.

The essentials

This policy explains how ZINLEY, CORPORATION ("Zinley," "we," "us," or "our") handles personal data across our website, desktop and mobile apps, AI assistant features, and connected services. It also covers people who communicate with an assistant or whose information an account holder provides. Contact [email protected] for privacy requests or human support.

Zinley is a cloud service. Relevant conversations, files, connected-account information, and other context can be processed on our servers and by AI and service providers. Some features, such as supported live voice, connect directly from your device to a provider.
Some connections are read-only; the assistant as a whole is not. Apple Health, Health Connect, and our Plaid bank connection do not give Zinley permission to change those source records or move bank funds. Other tools can send messages, change calendars, edit files, and take actions with your authority.
Personalization uses saved context. Memory, People, News, Health, Proactive, and Look back can use information from more than the message you just sent. Their settings and connected sources determine what is available.
Our hosting, AI processing, logs, and backups are contractually US-only. Personal data processed for our service is hosted and processed in the United States. See Where data is processed for the boundary with external websites and recipients.
We do not sell your personal data. Health and connected Google data are not used for advertising or general-purpose AI model training. Website analytics and operational diagnostics are described below.
Stopping access and deleting history are different. Disconnecting a source, pausing a feature, signing out, or uninstalling the app does not automatically erase everything already stored.

The Health section explains consumer health data in detail. Our Terms of Service explain use of the product, billing, and responsibilities.

1. What we collect, and where it comes from

Account and billing information: name, email, sign-in identifiers, profile information, plan, payment status, invoices, usage and credit records, and any phone number you provide. Payment processors handle payment credentials; we receive identifiers and transaction information needed to manage billing.
What you send or create: messages, prompts, attachments, documents, images, audio, feedback, instructions, preferences, generated content, tool results, and task history. Voice features process audio and may produce transcripts and recordings.
Connected services: information retrieved through accounts you connect, such as email bodies and attachments, contacts, calendars, permitted cloud files, messages, and bank transactions. Access depends on the connection and permissions granted.
Devices and local tools: device identifiers, operating system, app version, capabilities, notification tokens, and information returned by tools you enable. Depending on the platform and task, this can include local file content, screenshots, browser content, clipboard content, contacts, calendars, reminders, photos, or location.
Health information: permitted phone Health data, information you enter, family profiles, health-related conversations, and generated insights. See the Health section.
Information about other people: names, contact details, relationships, messages, meeting details, and other information you provide or authorize us to read. People who email, message, call, or use your public contact page also supply information.
Inferences and personalization: interests, preferences, relationship context, recurring commitments, reader profiles, and summaries derived from available information. These can be incomplete or wrong; you can correct them using available controls or contact us.
Technical and usage information: IP address, browser and device information, identifiers, pages visited on our services, feature interactions, delivery status, performance measurements, and error reports. This is separate from browser content a tool accesses for a task.

We also receive public information from websites, publishers, search services, and other sources used to answer your requests. A feature may combine public information with your private context. Health, financial information, precise location, and private communications may be sensitive under applicable law.

2. What “read-only” means, and what can take action

Read-only means a particular integration does not write back to its source. It does not mean the information stays on your device, is never stored, or is never sent to an AI provider. Reading can produce a saved summary, memory, or recommendation in Zinley.

Access depends on the connection, granted permissions, and feature settings.
Connection or feature	What it can do
Apple Health / Health Connect	Read supported health categories you permit. Send selected data to Zinley and create Zinley records. Does not write back to Apple Health or Health Connect.
Bank accounts through Plaid	Read account, balance, and transaction information. Does not initiate transfers or change your bank account through this connection.
Gmail	Read and search permitted mail; send mail when sending permission and action authority are present. Other connection types or older grants can have different capabilities.
Google Calendar and Drive	Read calendars and manage events; read or change authorized Drive files. These are not generally read-only connections.
Phone calendars and device tools	Calendar information shared with cloud checks is read-only in that context. Separately enabled device tools can create or change events, reminders, files, or other supported device content.
Computer, browser, code, and connected-app tools	Can read and modify accessible content, run commands, submit forms, and communicate with external services, subject to available tools, account permissions, and action controls.

Connection permissions limit technical access; your instructions define the work you authorize. Your account-wide decision settings include “Ask me first” and “Go ahead, then tell me.” The default, if you have not chosen, is Go ahead, then tell me. These settings guide when the assistant asks for a new decision; they do not require approval for every tool or action. Under either setting, routine work you have delegated, including scheduled work, can proceed without another confirmation. Ask me first instructs the assistant to ask and wait when an urgent situation requires a new decision. Go ahead, then tell me instructs it to complete authorized work and report back, asking about missing information or decisions outside your instructions. Specific instructions to ask before acting, or to prepare only a draft, still apply. Proactive, Health, individual tools, and other channels have separate controls. Review the settings for each feature you use.

Computer access can be broader than one chosen file. Desktop folder guardrails use configured exclusions; unlisted accessible folders may remain available. File contents, extracted text, screenshots, hashes, and embeddings may leave the device when a feature uses them. Cloud workspaces also store task files and can retain browser profiles or logins between sessions. Review device permissions, tool controls, and folder settings before enabling access.

3. Why we use data: assistance, memory, and background work

We use information to authenticate you, provide requested or enabled features, complete tasks, maintain continuity, synchronize devices, deliver communications, calculate charges, provide support, and protect the service. Relevant context may include earlier conversations and retrieved information, not just the latest prompt.

Memory and the Owner File store preferences, instructions, facts, and ongoing matters. People stores contact and relationship context. These records can be inferred from conversations, communications, and connected sources. Deleting a source message does not necessarily delete a separate summary or memory derived from it; use the relevant memory or People controls as well.

Proactive, scheduled tasks, News, Health, and Look back can run on our servers while the app is closed. Connecting Gmail can enable periodic mail and calendar checks when no earlier on, off, or pause choice exists, and supported mail/calendar connections can start People discovery. Check Proactive and source settings after connecting an account. Device-dependent work still needs the relevant device and permissions.

Turning off one feature does not turn off other features using the same source. For example, turning off News does not turn off Look back, and disabling a source for Proactive does not necessarily prevent you from using it in chat. Disconnect the account or revoke device permission to stop that connection's future access.

We use usage measurements and feedback to improve reliability, usability, and service behavior. Minimized operational signals can support evaluation and improvement of internal service systems. This is different from training a general-purpose AI model on your private content. The additional restrictions for Health and Google data apply to this work too.

4. News, Listen, and Look back

News combines public reporting with personal context to choose stories and explain why they may matter to you. It can use topics, language, city or approximate area, reading and listening activity, feedback, saved interests, relevant conversations, People and Owner File context, calendars, email signals, purchases, and permitted financial context. A reader profile can contain inferred interests and your corrections. News settings default to on; review them to choose whether and when editions are prepared.

Relevant private context is sent to the AI services that select and write your edition. Public search services receive search queries and requested URLs. News uses filters intended to keep names, private messages, and financial details out of public search queries, but this does not mean that the AI editor receives no personal data. Other general search or browsing tasks can include personal details you ask Zinley to research.

Listen sends the text needed for narration to a speech provider and stores generated audio for playback. Reading a publisher's page or playing embedded media, including YouTube or Vimeo, connects to that provider under its own privacy terms. News is AI-assisted: summaries, relevance judgments, translations, and audio may omit context or contain errors. Source links let you check the original.

Look back builds weekly, monthly, or yearly reflections from available conversations, completed work, Owner File changes, People interactions, calendar entries, calls, purchases, scheduled-task results, actions approved or completed through Zinley, News activity, and permitted Health or financial context. These are stored derived reports, not a complete record of your life. A calendar entry is not proof that you attended, and missing data is not proof that something did not happen. Weekly, monthly, and yearly Look back settings each default to on and are separate from News. Available information determines whether a report can be prepared. Turn off future reports in Look back settings; contact us to request deletion of stored reports if no deletion control is available.

News sharing creates a link to a snapshot. Depending on your selections, a share may include your name or personal parts of the edition. Anyone with the link may be able to view it. Review the preview before sharing and revoke the link when it is no longer needed. The News sharing feature does not publish Look back reports.

5. Health information: collection, use, sharing, and controls

This section covers consumer health data, including information that reveals or can be used to infer physical or mental health. It applies to Health features and health information you provide elsewhere in Zinley, including chats, files, or connected conversations.

Apple Health and Health Connect access is read-only. Health is a cloud feature. When you enable sharing, selected health information leaves your phone, is stored by Zinley, and is processed by the providers needed to produce your reads, answers, and audio. Read-only access means we do not change the records in Apple Health or Health Connect. Zinley can still create its own health records, summaries, goals, reminders, and authorized calendar actions.

Turning off phone sharing stops future sync from that phone and keeps its previous history. Pausing Health does not stop medication reminders or urgent alerts. The controls and deletion choices below explain these differences.

We do not sell consumer health data, use it for advertising or marketing, or authorize its use to train general-purpose AI models. Contact our privacy team at [email protected] for questions or requests, including requests about health information someone else has provided about you.

Health information we collect

The information available to us depends on your devices, permissions, entries, connected services, and the features you use.

Activity, fitness, and environment: steps, distance, energy use, exercise, standing, stairs, time outdoors, workouts and their timing, fitness estimates, walking speed and steadiness, mobility measurements, falls, environmental and headphone sound exposure, and supported low-fitness or walking-steadiness notifications.
Sleep and body measurements: sleep duration and stages, bedtime and waking times, breathing, blood oxygen, heart rate and variability, heart-related notifications, blood pressure, glucose, temperature, weight, body fat, inhaler-use counts, and supported sleep-apnea notifications.
Nutrition, daily habits, and wellbeing: food or meal entries, calories, protein, water, caffeine, alcohol, mindful activity, mood, energy, symptoms, and notes.
Cycle and other sensitive information: menstrual flow when you separately enable cycle tracking, supported mood information when permitted, and reproductive, mental, or other sensitive health information you choose to write, upload, or discuss.
Health cards and care details: birth year, sex, height, blood type, allergies, conditions, injuries or limitations, diet, medications, doses and schedules you enter, medication-taking logs, health concerns, and doctor or emergency-contact details.
Family health profiles: a person's name and relationship to the account holder, the data shared from their phone, and health cards, logs, goals, and notes entered about them.
Derived information: trends, baselines, comparisons, wellness estimates, inferred patterns or concerns, goals, experiments, recommendations, alerts, personalized reads and reviews, and summaries included in Look back. These are estimates and interpretations, not verified medical records.
Related account and usage information: account and device identifiers, permission and sync status, time zone, language, approximate area used for local context, settings, reads you open or listen to, reactions, reminder responses, and records needed to operate, secure, and support the feature.

Shared phone data is not limited to daily totals. It can include selected sleep-stage segments and timestamps, workout summaries, hourly activity or heart-rate summaries, high or low readings, source metadata, and historical monthly summaries. The supported data varies between iPhone and Android and by operating-system version.

Where this information comes from

You: Health setup, forms and logs, questions and replies, feedback, uploaded files, and instructions you give your assistant.
Health platforms you authorize: Apple Health or Health Connect, including information those platforms receive from your watch, other devices, and health apps. We request supported read permissions; you can choose which categories to allow in the platform's controls.
An account holder sharing a family profile: another person may provide information about you or connect a phone to a profile within their account. Those profiles are visible to that account holder.
Connected services and conversations: health-related information can appear in messages, calendar events, documents, or other material you make available to Zinley. Turning off the Health connection does not remove information you separately provide through those sources.
Your use of Zinley: interactions with Health, delivery and action results, and technical logs. We also generate summaries and inferences from information available to the feature.
Public information services: health research, news, local conditions, and nearby places, which we may combine with your context when the relevant settings are enabled.

Only provide another person's health information when you have their permission or other lawful authority. An adult account holder's family profile is not a separate private account for that family member. The account holder can view and manage that profile. The phone-sharing feature restricts menstrual-flow and mood-valence fields in family views, but this does not hide information that someone separately writes into a card, log, chat, or file.

Why we use health information

Show your health records, charts, patterns, trends, and changes over time; keep information available across your signed-in devices.
Generate personalized Health reads, reviews, audio, and answers, using relevant measurements, entries, preferences, and context.
Help track goals, habits, experiments, and medication schedules you provide; create or adjust reminders and calendar blocks when authorized.
Produce care notices and urgent alerts, and make calls or contact an emergency contact under the settings described below.
Use Health in Proactive check-ins when allowed, and include available Health insights in Look back. Health-related information you discuss in chat can also inform your assistant's continuing context.
Find relevant general research and local information when enabled, and prepare selected content you choose to share.
Process corrections, exports and deletion requests; maintain consent and deletion records; investigate support issues and protect the service from misuse or security threats.

We collect and use consumer health data with the consent required by applicable law or as necessary to provide a service you request. This notice explains the processing; reading it is not a substitute for consent where consent is required. Separate permission may be needed for sharing beyond what is necessary for your requested service.

Who receives health information, and what they receive

The Health information described above may be processed by the services below to the extent needed for their role. A provider that stores a report does not necessarily receive every underlying record, and a delivery provider does not need the full health profile. The provider used for an AI request can change with the feature and model routing.

Hosting, storage, and account services: Google Cloud and Firebase store health records, profiles, reports, settings, and generated audio and help authenticate access. Our hosting, AI processing, logs, and backups, including contracted provider processing for those services, are contractually restricted to the United States. People or independent services you choose to share information with may store it elsewhere.
AI routing and model providers: Portkey and the model or inference providers selected for the feature receive relevant health context, instructions, and conversation content to analyze information and generate a response. These may include Microsoft Azure/OpenAI, Google, and Fireworks AI. The relevant content can include measurements, conditions, medications you entered, symptoms, concerns, and derived summaries. See Service providers and AI processing for the broader explanation.
Speech services: Google Gemini speech services receive text prepared for Health audio and supported spoken interactions. Generated audio can contain personal health information and is stored for playback. An AI voice is not a human clinician.
Search and local-information services: configured search providers receive general research queries; these may reveal the health topic being researched. Filters are designed to exclude personal names, contact details, medication names, individual readings, and private text. Open-Meteo receives a city name or the center of an approximate area for local conditions. These searches do not require a complete health profile, and filters cannot be treated as a guarantee that every inference is impossible.
Notification and communication services: device push services and, when selected, Twilio, SendGrid, and connected messaging services handle destination identifiers and delivered content. Routine Health messages outside the app are filtered to limit personal health details; they may be generic notices or short personalized prompts. Those filters do not guarantee that no sensitive information can be inferred. A requested or consented Health call can communicate the alert itself. A message you ask Zinley to send, or an answer you request on another channel, may contain the health information needed for that interaction.
Authorized recipients: an account holder can see family profiles within their account; a configured emergency contact may receive the limited message described below; anyone with a public Health link can see the selected shared card. Connected calendar or reminder services receive the details needed for actions you authorize.
Diagnostics: Sentry receives error and crash information. The mobile app can attach a screenshot and interface details, including content visible on a Health screen, along with account identifiers, email, name, and device information. Restricted AI operational logs can also include health-related requests and responses.
Support, security, and professional advisers: authorized personnel and providers helping us resolve a support issue, maintain reliability, protect the service, or meet legal obligations may receive relevant information, subject to applicable consent and legal restrictions. Health processing is not a guarantee of zero logging or zero human access.
Legally required recipients and business successors: we may disclose information when legally required or otherwise permitted by applicable law, including a lawful transfer in a merger or acquisition. Applicable health-data restrictions still govern that disclosure.

We do not sell health data or disclose it for another company's advertising or marketing. Personalization of your own Health experience is separate from training a general-purpose model. Provider retention, safety review, and processing terms vary; using AI processing does not imply that providers retain nothing. Ask us for information about the providers relevant to your request.

Notifications, calls, contacts, and public sharing

Health can send in-app notices and device notifications. Depending on your notification settings, brief notices can also reach you by SMS, iMessage, email, or Telegram. These can be generic or personalized and are filtered to limit health details. Those channels and lock screens may be visible to other people. Even a brief notice can reveal that you use a health feature or suggest a health concern.

Urgent calls to you require the account's urgent-call consent, the Health urgent-call setting, and the necessary phone configuration. Health's call setting is on by default, but it does not replace the account-level consent. If you separately enable contacting an emergency contact when you cannot be reached, Zinley may send that contact a limited message asking them to check on you or the family member concerned. This contact setting is off by default. Add only someone who has agreed to be contacted.

These features depend on available data, device sync, connectivity, and service availability. A phone may not sync while locked, offline, or restricted by its operating system. Health is not continuous clinical monitoring or a guaranteed emergency-response service. Do not assume that silence means someone is well or that a contact has been reached.

When you choose to share a Health card, we create a public link containing the selected statistics, chart, caption, or general fact. Anyone who receives the link can view and forward it. The public Health-share feature supports the account holder's own eligible cards, not family profiles. You can revoke a link, but revocation cannot recover screenshots, downloads, or copies already held by others.

Your permissions and controls

You can use Zinley without connecting Apple Health or Health Connect. Health information you type, upload, or discuss is still processed to provide the feature you use. Regular reads, Health use in check-ins, Care Watch, local context, health research, and bedtime reminders are on by default. You can change these settings separately. Entering a health card or manual log can trigger or resume supported reads, care checks, urgent-alert processing, and plan activity without connecting a phone. Turning off phone sharing alone does not stop processing of information you enter yourself.

Phone permissions: choose or revoke individual read permissions in Apple Health or Health Connect. Revoking access prevents new reads of those categories; it does not erase data already synced to Zinley.
Stop sharing from a phone: stops future uploads from that phone. Signing out also stops that phone's sharing. Previously shared history remains until it expires or you delete it.
Check-ins, regular reads, and Care Watch: these settings control different uses. Turning off check-ins stops Proactive use of Health; it does not delete records or turn off all Health features. Turning off Care Watch does not stop urgent-alert processing.
Pause Health: pauses regular reads, routine nudges, and plan activity for the selected period. Medication reminders and urgent alerts continue. Pause does not delete data or revoke the phone's Health permissions.
Cycle tracking: off by default. Turning it off stops new cycle reads and uploads from that phone. The app separately offers "Keep" or "Delete" for information already shared. That deletion clears stored menstrual-flow fields and cycle-related profile notes; previously written reads, chats, or reports may need separate deletion.
Local context and research: turn these off in Health settings to stop those optional research and local-information features.
Actions: the first eligible timed reminder in each newly prepared plan, and enabled bedtime reminders, can be created automatically. Other plan reminders and calendar blocks need your confirmation unless the Health "Just do it" setting is on. That setting is off by default. Medication reminders follow the schedule you provide.
Calls and contacts: turn off urgent calls in account notification settings or Health settings, and turn off emergency-contact messages separately. Changing a setting cannot undo a call or message already sent.
Other uses and copies: Look back has its own settings. Information already included in a chat, report, or other feature is not removed merely by switching off a Health routine.

To withdraw consent for collection or sharing that is not covered by a product control, email [email protected] and describe the use you want stopped. Withdrawal applies going forward and may make the related feature unavailable. You can also request deletion of information already collected.

Retention and deletion

Different records have different lifetimes. Phone-shared daily records are generally kept on a rolling 90-day basis. More detailed hourly summaries have shorter windows. Manual health logs have a two-year retention window. When sharing begins, supported historical monthly summaries can cover up to the previous 24 months. Monthly summaries, health cards, inferred profiles, and other derived records can remain after the underlying daily records expire. Look backs and conversations have their own retention rules.

Daily reads have a 30-day retention window and weekly reviews 26 weeks. Expiry of a read does not itself delete every generated audio file. Generated Health audio is included in "Delete everything in Health."

Expiry cleanup runs as part of service processing and may take time; a retention window is not a guarantee that every copy disappears at an exact instant. Account deletion and a verified health-data deletion request are broader than stopping a sync or routine.

Removing phone data: deleting one phone's data removes its stored phone and daily records. If it was that person's last connected phone, certain computed profile data, monthly summaries, and alert evidence are also cleared. Written reads, alert text, notes, cards, and manual logs can remain.
Delete everything in Health: the dedicated Health deletion control removes the Health records it covers, including phone data, cards, logs, reads, reviews, goals, profiles, generated Health audio, and hosted Health shares, and cancels associated supported Health jobs. Limited revocation records remain to prevent an old sync from restoring deleted data.
Family profiles: removing a family profile removes its phone records, cards, logs, profile, goals, monthly summaries, individual reads, and supported associated jobs. Existing weekly reviews, owner-level reports, chats, and files may still mention that person. Ask us for a broader deletion when needed.
Copies outside Health: deleting dedicated Health records does not automatically remove all health-related chat messages, uploaded files, previously generated Look backs, connected-service records, or copies another person received. Delete those separately where controls exist, or ask us for a broader health-data deletion.
Privacy requests: where applicable law requires deletion, we apply the request across the covered records and notify relevant processors or recipients as required. Backup, legal, security, and deletion-record handling depends on the applicable legal requirements; we do not promise immediate erasure of every copy.

Deleting data from Zinley does not delete the original information in Apple Health, Health Connect, or another source service. If you reconnect or provide the same information again, it may be collected again for the feature you request.

The Health export control provides a JSON file of supported records. It excludes generated audio files and certain family cycle and mood fields or entries. Each group of records is limited to 5,000 entries; the export identifies any groups that were cut short. Contact our privacy team to request access to information not included.

Your health privacy rights and how to request them

Depending on your location and the law that applies, you may ask us to confirm whether we collect, use, or share your consumer health data; access that data; obtain information about recipients, including a list and contact information where required; correct information; withdraw consent; or delete the data. You may also have rights to portability and to appeal a decision. We will not unlawfully discriminate against you for exercising a privacy right.

Email [email protected] with the subject "Health privacy request." State what you are requesting and provide enough information to locate the relevant account or family profile. Do not send medical records or identity documents in the first message. We may ask for information reasonably needed to verify your identity and authority, and provide a suitable way to send it. You do not need to create a new account to make a request.

We will respond within the period required by applicable law, explain any permitted extension, and explain a refusal or limitation. If we decline your request, you can appeal by replying to our decision or emailing the same address with the subject "Health privacy appeal." Include the original request and the reason you want the decision reviewed. We will explain the outcome and the applicable complaint options.

Washington consumers whose data is covered by the My Health My Data Act can exercise its access, withdrawal, and deletion rights through this process. If an appeal is denied, you can submit a complaint to the Washington State Attorney General. Other consumers can contact the privacy regulator or authority responsible for their jurisdiction. These rights do not depend on accepting a new use of your health information.

6. Connected banks and financial context

If you connect a bank through Plaid, Zinley receives account names and types, masked account numbers, balances, and transactions, including dates, amounts, merchants, and categories. We store a protected connection token so synchronization can continue. This connection is read-only: it does not let Zinley transfer money or change your bank account.

Financial data can support summaries, chat, enabled check-ins, and relevant personalized features. Financial check-ins can be enabled by default after connection. You can turn off those check-ins or disconnect the bank. Disconnecting removes locally stored connection and transaction data and requests revocation at Plaid; it does not erase bank records or financial information already included in separate saved content. Your bank and Plaid also process information under their own terms.

This read-only limit applies to the Plaid connection. Other authorized tools, such as a browser, may still perform purchases or other actions. Zinley does not provide professional financial advice.

7. Google accounts and Limited Use

Connecting Google services authorizes access to the services and scopes shown on the consent screen. Permissions depend on the connection route and can differ for older grants or integrations managed through Composio. Google sign-in alone is not a grant to read all of your Google content.

Gmail: the direct connection requests gmail.readonly and gmail.send, allowing message search/read and sending on your behalf. A connection without sending authority cannot send through that permission.
Calendar and Meet: calendar.events, calendar.calendarlist.readonly, and calendar.freebusy support reading calendar lists and availability and creating, changing, or deleting events. Meet links can be attached to events.
Drive: the direct per-file connection uses drive.file for files you select or the app creates. This can include reading and editing supported documents, spreadsheets, and presentations. Older or other connection grants may differ; review your provider's actual permission list.

Authorized Google content can support your requests and visible enabled features, including summaries, replies, scheduling, People, memory, Proactive, News, and Look back. Background checks do not require you to ask again for each read. Relevant content can be included in AI requests and saved conversations or derived records.

Zinley's use and transfer of information received from Google APIs adheres to the Google API Services User Data Policy, including its Limited Use requirements. We do not sell Google user data, use it for advertising or creditworthiness decisions, or use or transfer it to train, fine-tune, or improve generalized AI or machine-learning models. These restrictions also apply to aggregated, anonymized, and derived Google data.

Transfers of Google data are limited to providing or improving permitted, prominent user-facing features with consent, security purposes, legal requirements, or an eligible business transfer with the consent Google requires. Human access is limited to your affirmative agreement to review specific data, necessary security or legal purposes, or permitted aggregated internal operations. Broader support and operations descriptions elsewhere in this policy do not override these restrictions.

We store access and refresh tokens to keep connections working. Disconnect in Settings to disable the connection and remove its usable stored credentials. Also remove Zinley from your Google Account connections to revoke the provider grant. Disconnection does not recall messages already sent, cancel completed actions, or erase saved conversations, summaries, or memories. Delete those separately or request assistance.

8. Service providers and AI processing

We use external providers to operate Zinley. The providers and data involved depend on the feature, model, connection, and routing available at the time. A fallback can use a different provider. This list does not mean every provider receives every user's data.

Hosting, authentication, and storage: Google Cloud and Firebase process account data, conversations, stored content, and files. Vercel serves the website. Cloudflare supports network protection, delivery, and supported hosted sites.
AI routing and models: Portkey routes many requests. Depending on the feature or model, processors can include OpenAI, Microsoft Azure, Anthropic, Google Gemini or Vertex AI, Fireworks AI, OpenRouter and its selected inference provider, xAI, Meta, Sakana AI, and Perplexity. Requests can include prompts, relevant history, files, images, health or financial context, tool results, and outputs. An open-weight model's original developer is not necessarily the company receiving the request; for example, a model can run on Fireworks infrastructure.
Speech: Google and other selected speech endpoints process text or audio needed for transcription, voice conversations, calls, or Listen. Generated recordings can be stored in Firebase Storage.
Search and web retrieval: Exa, Parallel Web Systems, Perplexity, Firecrawl, and xAI receive queries, URLs, or content needed for supported research and browsing features. Websites visited by a task receive normal requests and any information the task submits.
Memory and search indexes: when enabled, Mem0 processes memory content and context; Algolia indexes supported conversation content and identifiers; Turbopuffer stores indexed text and file, device, or source metadata used for retrieval. Embedding providers process text to create searchable numerical representations.
Computer and browser work: Daytona provides cloud workspaces that can process files, code, browser sessions, credentials supplied to the task, and generated artifacts.
Connected applications: Composio manages supported connections and requests; the connected application receives requests and content needed for the action.
Communications: Twilio handles phone numbers, call audio, routing, and supported messaging or verification. SendGrid handles email content and delivery. Linq and connected messaging platforms handle supported message content and delivery data. OneSignal, Apple, and Google notification services receive identifiers, delivery information, and notification payloads.
Payments and banks: Stripe processes billing and payment information. Payment disputes can involve evidence about your account, purchase, or use of the service. Plaid processes linked-bank information when you use that feature.
Support and internal operations: Discord and, when configured, Slack receive support reports and operational alerts. Depending on the report, this can include account identifiers, billing events, report text, technical context, and attachments or screenshots. This is separate from messaging accounts you connect.
Diagnostics and analytics: Sentry receives crash, error, and diagnostic information. Google Analytics processes website usage information. See Cookies and diagnostics.
Other optional tools: SerpAPI receives supported flight or hotel search queries. SunoAPI receives prompts or lyrics for supported music generation. Optional TypeSafe/System One decision services can receive task state when that route is enabled. These configured integrations do not all receive data on every account or request.
Approximate location: ipapi.co and ipwho.is can receive an IP address to estimate a city or region for supported context features. This is distinct from device location permission.
Local context and external media: Open-Meteo receives city or coarse-area requests for environmental context. Publishers, YouTube, Vimeo, and other destinations process visits or media playback under their own policies.

Model training is different from processing or retention

We do not use your private content to train a Zinley general-purpose generative AI model. We use API services and data controls intended to prevent provider training on customer content. Health and Google data have the additional restrictions stated above. This is not a zero-retention promise: providers can process and retain information for service delivery, security, abuse prevention, or legal requirements under the terms and controls applicable to the endpoint.

Our operational AI logs can contain request and response content. Authorized personnel may access data when needed for support, reliability, safety, security, abuse prevention, or legal obligations, subject to stricter rules for Google data and other protected information. Encryption does not make the service end-to-end encrypted or prevent the processors needed for a feature from accessing its content.

10. Retention, disconnection, and deletion

Retention depends on the record and purpose. The following describes current application retention settings; expiry and cleanup jobs can run after the stated period. These are not guaranteed deadlines for erasing all copies at every provider or in backups.

Account and saved content: account records remain while needed to operate the account. Conversations generally remain until deleted; Trash allows restoration for up to 30 days unless permanently deleted sooner. Memory, People, and derived reports have separate stores and controls.
AI operational logs: configured to expire after seven days. This does not apply to saved chats, call recordings, or all provider logs.
Product analytics: raw internal events normally expire after 90 days and session rollups after 180 days. Aggregate statistics may remain. These periods do not set Google Analytics or Sentry retention.
Phone and email history: plan-based history windows limit what you see; they do not themselves delete older messages, call records, or recordings.
Health: daily phone rows are generally retained for 90 days; short hourly series have shorter windows. Daily reads have a 30-day window, weekly reviews 26 weeks, and stored monthly summaries can remain until deleted. The 24-month historical import window is not a deletion deadline. Manual logs have a two-year retention policy; cards, goals, profiles, and other saved records have their own controls. See the Health section.
News and Look back: unsaved News stories become eligible for pruning 30 days after closing. Saved stories and Look back reports remain subject to their separate controls or a deletion request; not every report has a self-service delete button. Turning off future editions does not delete existing ones.
Bank transactions: synchronization prunes stored transactions beyond 400 days. Disconnecting removes local connection and transaction records; separate summaries can remain.
Billing, security, support, and legal records: retained as needed for accounting, disputes, fraud prevention, security investigations, request handling, and legal obligations. Backup and provider copies follow their applicable retention and deletion processes.

Deleting your account

A self-service deletion request starts a three-day grace period, during which you can cancel it. After that, sign-in is disabled and the deletion workflow removes supported agent data, including conversations, People, memory, Health, finance, saved skills and guardrails, background-work state, and per-user telemetry. Cleanup is a process, not an instant erasure of every copy. Some account and authentication records, deletion markers, billing, fraud-prevention, security, aggregate, backup, or legally required records may remain. The current self-service workflow does not automatically erase every connected-account credential or cloud workspace. Disconnect accounts and review workspace deletion separately, or ask us to include them in your deletion request.

Manage subscriptions and phone lines separately. Do not assume an account-deletion request, sign-out, or app uninstall cancels every subscription, releases a phone line, or reverses a charge. Review billing before deleting, and contact support if you cannot access it.

Disconnecting stops future use of that connection but does not recall completed actions or erase previously imported content. Deleting Health, a bank connection, or a conversation also does not necessarily erase related text in another saved report, export, memory, or a recipient's records. Use the relevant controls or ask us for a category-specific deletion review. Legal deletion rights may require additional steps beyond the self-service controls.

11. Cookies, analytics, and diagnostics

We use cookies, browser storage, and device identifiers for sign-in, security, preferences, synchronization, and measurement. The website loads Google Analytics, which can receive page visits, browser and device information, identifiers, and interactions. Our own product measurement also uses browser/session identifiers and can associate earlier signed-out activity with your account after sign-in.

Sentry helps diagnose errors and crashes. Reports can contain account ID, email, name, plan, device details, stack traces, and event context. The mobile app can attach a screenshot and a description of the screen's interface to an error report, which may include content visible at the time. Disabling automatic personal-information collection in a diagnostic SDK does not remove information the app explicitly supplies.

Browser controls can block or clear cookies and local storage, and third-party tools may offer their own controls. These controls can affect sign-in or features and do not stop all server-side operational logging. There is currently no single in-app control that turns off all analytics and diagnostics. Contact us about applicable consent, objection, or opt-out rights.

Health and Google content are not advertising inputs. We use technical controls to reduce unnecessary sensitive data in diagnostics, but do not describe all logs as anonymous or content-free.

12. Where data is processed and how we protect it

Zinley's hosting, AI processing, operational logs, and backups are contractually restricted to the United States. This includes the contracted providers that process customer data for those services. If you use Zinley outside the US, your personal data is transferred to the US to provide the service.

This residency commitment covers our contracted service processing. It does not control where an independent website you visit, an application you connect, or a person you choose to contact stores information. Sending or publishing information to those destinations can disclose it outside the US. Where international-transfer rules apply, the transfer needs the safeguards or legal mechanism required by that law. Contact us for information about arrangements applicable to your data. US hosting alone is not an adequacy decision, a security certification, or proof of compliance with every local privacy law.

We use transport encryption, cloud storage protections, access controls, secret management, and operational monitoring. Some device data remains local; other data is synchronized or sent for processing. Not every local cache is encrypted by Zinley, and no security measure eliminates risk. See Security. We will provide legally required notices of security incidents, including applicable health-data breach notices.

13. Your choices and privacy rights

You can review connected accounts, revoke provider grants, change device permissions, adjust News and Health settings, control Proactive and scheduled work, correct available memory or profile records, revoke supported public links, delete supported content, and request account deletion. Feature exports are available where the product provides them; there is not a promise that every data category has a one-click export.

Depending on the law that applies, you may have rights to know or access your information, receive a portable copy, correct it, delete it, restrict or object to processing, withdraw consent, limit certain sensitive-data uses, opt out of certain sharing or profiling, and appeal a denied request. These rights can have exceptions. Withdrawing consent does not invalidate earlier lawful processing, and some features will stop working without the data they need.

Email [email protected] with your request, relevant account or contact details, and the data or feature concerned. Do not send passwords, full payment-card numbers, or unnecessary medical details. We may need proportionate identity or authority verification. You can use an authorized agent where the law allows it. We respond within applicable legal deadlines; if we deny a request, you can reply asking for an appeal and the reason for the decision. You can also complain to the relevant privacy regulator or attorney general. We do not penalize you for exercising applicable privacy rights.

EEA, UK, and other regions

Where EU or UK data protection law applies, ordinary account, billing, and requested service processing generally supports performance of our contract; necessary security, fraud prevention, support, and limited service improvement can rely on legitimate interests; required recordkeeping relies on legal obligations; and optional processing relies on consent where required. Sensitive Health processing requires an applicable additional legal condition, such as explicit consent. Merely accepting our Terms or this policy does not replace a separate consent required by law.

Personalization makes automated inferences about interests and needs. It is not intended to decide eligibility for employment, credit, insurance, medical care, or other legally significant matters. If an automated account restriction or decision affects you, ask support for a human review. Rights and remedies under California and other US state laws, Brazil's LGPD, Canadian privacy laws, Korea's PIPA, and other local laws depend on their applicability. Mandatory local rights remain available regardless of this policy's language.

14. Children and information about other people

Zinley accounts are intended for adults aged 18 or older, or the higher age required by local law. We do not invite children to create accounts. Adults may provide information about other people through family features, contacts, or communications; this can include a dependent's information. Provide it only with lawful authority and any required consent. An adult's account setting is not a substitute for a child's legal protections.

If you believe a child has created an account or information has been collected without required authorization, contact us so we can investigate and take appropriate deletion or access-restriction steps.

15. Changes and contact

We update this policy when our practices or legal requirements change. We change the date above and provide material-change notices through email, the product, or another appropriate channel when required. We obtain new consent where the law or a provider's rules require it; publishing a policy update alone does not supply that consent.

Responsible operator: ZINLEY, CORPORATION.

Privacy requests and human support: [email protected].

Website: zinley.com.