Privacy Policy
1. Introduction
ZeroLeaks is the name of the service. It is not a registered company. This Privacy Policy explains how we collect, use, disclose, and safeguard your information when you access the website, applications, and services (collectively, the "Services").
This Privacy Policy applies to all users of our Services, including visitors to our website and subscribers to our security assessment services. Please read this policy carefully. By accessing or using our Services, you acknowledge that you have read, understood, and agree to be bound by this Privacy Policy.
2. Information We Collect
2.1 Personal Information
We may collect the following categories of personal information:
- Identity Data: Full name, job title, company name, and professional credentials.
- Contact Data: Email address, telephone number, and business address.
- Account Data: Username, password, account preferences, and authentication information.
- Financial Data: Payment card details, billing address, and transaction history (processed securely through our payment processors).
- Communications Data: Correspondence with our support team and service-related communications.
2.2 Technical Data
When you access our Services, we automatically collect certain technical information:
- IP address and geographic location
- Browser type, version, and settings
- Operating system and device information
- Referring website or source
- Pages visited and navigation patterns
- Date, time, and duration of visits
- Error logs and performance data
2.3 Security Assessment Data
An endpoint scan receives the endpoint URL, request shape, tool definitions, an optional description, and optional encrypted credentials. The agent's own instructions stay on the agent. A runtime scan receives the instructions, tools, and metadata you submit so the scan can replay them. A skill scan receives the skill source or an uploaded archive.
What we keep afterward:
- Scores, findings, recommendations, and remediation. Findings and transcripts can include what the agent said, including a leaked instruction. Credential-shaped values and a planted canary are removed. Current scans do not redact a pasted system prompt out of the report. Older hosted prompt scans, which we no longer accept, replaced exact copies and long overlapping stretches of the pasted prompt with a redaction marker. Full hardened prompts are not stored.
- Conversation transcripts and tool logs, until the retention window in Section 8.
- Runtime-scan instructions, with credential-shaped values removed when the scan finishes, until that same window. The messages and responses on the scan's event log are cleared when the scan finishes.
- Saved endpoint configurations, including the URL, tool definitions, and encrypted credentials, until you remove the agent.
- Uploaded skill archives, until the retention window.
We do not use your AI System Data to train foundation models. Attack prompts written by our engine, and a summary of the defenses we observed, are stored for your account or workspace so later scans of the same target can reuse them. Those records are not a copy of your system prompt.
2.4 Shield API Data
When you send text to the Shield API, we classify it in memory and return the result. The request log does not contain that text. It records the date, the time the request finished, and the classification score.
- Free Shield model on a free plan: If Shield (the free model) flags a request, and you agreed when you created the key, we may store a redacted excerpt of the flagged text, a hash of that excerpt, the score, the model, and the account and key it came from, for security research. Redaction of personal data and credentials is best effort. Unflagged requests are not stored as excerpts.
- Every other case: Text submitted on a paid plan is not stored. That includes a paid account calling the free model, and every call to Shield Base, Shield Large, or Shield Tiered. We do not train models on Shield submissions.
Please avoid submitting personal data or confidential information to the free Shield model.
3. How We Collect Information
We collect information through the following methods:
- Direct Provision: When you register for an account, subscribe to our services, complete forms, or communicate with us.
- Automated Collection: Through cookies, web beacons, and similar tracking technologies when you interact with our Services.
- Service Usage: When you submit AI systems for security assessment or use our platform features.
- Third-Party Sources: From analytics providers, payment processors, and business partners who provide services on our behalf.
4. Legal Basis for Processing (GDPR)
For users in the European Economic Area (EEA), we process your personal data based on the following legal grounds:
- Contract Performance: Processing necessary to fulfill our contractual obligations to you.
- Legitimate Interests: Processing necessary for our legitimate business interests, such as improving our Services and preventing fraud.
- Legal Compliance: Processing necessary to comply with applicable laws and regulations.
- Consent: Where you have provided explicit consent for specific processing activities.
- Free Shield model: Storing a flagged excerpt (Section 2.4) is based on the consent you give when you create a free API key. Revoking that key, or emailing us, stops future storage. It does not undo excerpts already stored.
5. How We Use Your Information
We use the information we collect for the following purposes:
- To provide, maintain, and improve our Services and security assessments.
- To process subscriptions, payments, and related transactions.
- To communicate with you regarding your account, services, and support requests.
- To send important notices, including security alerts and policy updates.
- To analyze usage patterns and optimize user experience.
- To detect, prevent, and address technical issues, fraud, and security threats.
- To comply with legal obligations and enforce our terms.
- To develop new products, services, and features based on aggregated, anonymized insights.
We do not sell your personal information or AI System Data to third parties for marketing, advertising, or any other purposes.
6. Disclosure of Information
We may share your information only in the following limited circumstances:
- Service Providers: With the providers listed on our trust page, limited to what each one needs to perform its function.
- Legal Requirements: When required by law, subpoena, court order, or other legal process, or when we believe disclosure is necessary to protect our rights, your safety, or the safety of others.
- Business Transfers: In connection with a merger, acquisition, reorganization, or sale of assets, where your information may be transferred as a business asset.
- With Your Consent: When you have explicitly authorized us to share information with specific third parties.
7. Data Security
We implement industry-standard technical and organizational security measures to protect your personal data and AI System Data, including:
- TLS for data in transit
- AES-256-GCM encryption, before storage, for integration secrets, planted canaries, and customer API keys you give us
- Passkeys, two-factor authentication, and per-device sessions you can revoke
- Isolated sandbox containers for behavioral tool tests, destroyed after each scan batch
While we strive to protect your information using commercially reasonable safeguards, no method of transmission or storage is completely secure. We cannot guarantee absolute security of your data.
8. Data Retention
We retain your personal data only for as long as necessary to fulfill the purposes for which it was collected, including:
- Account Data: Kept until you ask us to delete the account. Email support@zeroleaks.ai.
- Scan transcripts and uploads: Conversation logs, tool logs, campaign checkpoints, skill archives, and runtime-scan instructions are deleted after 365 days, or after the shorter window chosen on a Business or Enterprise plan. Scores, findings, and remediation stay.
- Payment details: Card numbers are handled by Stripe. We store subscription status and billing identifiers with the account.
- Product analytics: Sent to PostHog only after you consent. We do not keep a separate copy of those events in our database.
- Shield text: Not stored, except a redacted excerpt from a flagged request to the free Shield model on a free plan, as described in Section 2.4. Those excerpts are deleted about twelve (12) months after collection, on the next hourly cleanup.
- Shield request logs: The date, finish time, and classification score are deleted after thirty (30) days. They do not contain the text you sent.
9. Your Rights and Choices
Depending on your jurisdiction, you may have the following rights regarding your personal data:
- Right to Access: Request a copy of the personal data we hold about you.
- Right to Rectification: Request correction of inaccurate or incomplete personal data.
- Right to Erasure: Request deletion of your personal data, subject to legal retention requirements.
- Right to Restrict Processing: Request limitation of how we process your personal data.
- Right to Data Portability: Request transfer of your personal data in a structured, machine-readable format.
- Right to Object: Object to processing based on legitimate interests or direct marketing.
- Right to Withdraw Consent: Withdraw consent at any time where processing is based on consent.
To exercise any of these rights, please contact us at support@zeroleaks.ai. We will respond to your request within thirty (30) days.
10. Cookies and Tracking Technologies
We use cookies and similar tracking technologies to collect information about your browsing activities and to personalize your experience. Types of cookies we use include:
- Essential Cookies: Required for the operation and security of our website, including account sessions, authentication, billing flows, interface preferences, and your saved consent choice. These cannot be disabled through our consent controls.
- Analytics and Performance: With your consent, PostHog measures product usage, such as completed scans and report views. It uses an internal account ID for signed-in activity. We do not send scan contents, prompts, credentials, names, email addresses, or wallet addresses to PostHog, and session recording is disabled. Your account analytics choice also controls eligible background events. Changing your choice stops future collection; it cannot recall requests already sent.
- Error Diagnostics: When enabled, Sentry and Cloudflare Workers Logs help diagnose service errors. These operational diagnostics are separate from optional product analytics. Diagnostic fields are restricted to technical information and internal identifiers; session recording and automatic prompt collection are disabled.
- Support Messenger: Intercom powers support chat for authenticated users. The messenger loads only after you consent to support cookies.
You can accept, reject, or customize optional services in our cookie banner and revisit your choices through the Cookie settings link in the website footer. You can also manage cookies through your browser settings.
11. International Data Transfers
The providers listed on our trust page process data in the United States. We have not executed Standard Contractual Clauses with each of them. Where a transfer of personal data from the EEA, the UK, or Switzerland needs a transfer tool, ask us at support@zeroleaks.ai and we will tell you the current position for that provider.
12. Children's Privacy
Our Services are not intended for individuals under the age of eighteen (18). We do not knowingly collect personal information from children. If you are a parent or guardian and believe your child has provided us with personal information, please contact us immediately, and we will take steps to delete such information.
13. Changes to This Privacy Policy
We may update this Privacy Policy from time to time to reflect changes in our practices or for legal, operational, or regulatory reasons. We will notify you of material changes by posting the updated policy on our website and updating the "Last updated" date. For significant changes, we may provide additional notice via email.
We encourage you to review this Privacy Policy periodically. Your continued use of our Services after any changes constitutes your acceptance of the updated policy.
14. Contact Us
If you have questions, concerns, or requests regarding this Privacy Policy or our data practices, please contact us at support@zeroleaks.ai or visit https://zeroleaks.ai.
For users in the European Union, you have the right to lodge a complaint with your local data protection authority if you believe we have not complied with applicable data protection laws.