Privacy Policy

Zenji is the organisation responsible for personal information processed to operate the public website, Accounts, Company Profiles, billing and support. Privacy requests: privacy@zenji.app. Policy version 2026.1 (aligned with internal policy identifier 2026.1-QC-LAW25).

This Policy applies to personal information relating to identifiable individuals — including Account holders, claimants, Agent chat participants, and visitors. Information about legal entities that does not identify a natural person is business data, not personal information, although officers’ names and work emails are personal information and are treated as such.

• Account data: work email, display name, authentication events, language and theme preferences.
• Company and claim data: legal name, identifiers, domain, address, officers you submit, supporting documents for HITL review.
• Usage data: search queries, pages viewed, map interactions, feature flags, approximate location derived from IP, device and log metadata.
• Communications: Agent messages, support tickets, intro or mission requests.
• Billing data: plan, subscription status, tax region, truncated payment references via Stripe (we do not store full card numbers).
• Consent records: Law 25 consent logs for AI interaction, profiling and commercial inquiry, with timestamp and policy version.

We process personal information to: create and secure Accounts; provide search, graph, Agents and billing; verify claims; prevent abuse; comply with law; and, with required consent, improve models and send product communications.

• Contract: performing the Terms of Use and, where paid, the Terms of Sale.
• Consent: Law 25 opt-in for automated profiling and certain AI interactions, and for optional marketing.
• Legitimate interests / PIPEDA appropriate purposes: security, fraud prevention, aggregated product analytics.
• Legal obligation: tax invoicing, responding to lawful requests, retention of certain billing records.

Agents retrieve Company Profile context and send prompts to language-model providers to generate replies. This may constitute automated processing and, in Quebec, profiling requiring transparency and, where Law 25 so requires, express consent. HITL remains mandatory for outreach, financial and contractual actions: those are not executed solely by automated means.

You may refuse non-essential profiling and still use core Account features, subject to degraded Agent quality. Do not submit information that you are not entitled to process. We do not use Agent chats to train public foundation models under our control; subprocessors’ own training policies are described in their notices.

We share personal information only with: (i) infrastructure and subprocessors that host or process data on our instructions (including database, email, payments and model-routing providers such as Stripe, Resend and OpenRouter); (ii) the company whose Agent you contact, to the extent your message is delivered to that workspace; (iii) professional advisers under confidentiality; (iv) authorities when legally required. We do not sell personal information.

Zenji targets a Canada-centred operational posture (including Montreal / Canada residency objectives for primary stores). Language-model inference and certain observability or payment providers may process data in other countries, including the United States and the European Union. Where required, we use contractual clauses and vendor assessments. Enterprise customers may contract specific residency in a signed order form.

Account and profile data are kept for the life of the Account and a reasonable period thereafter for security, dispute and legal-hold purposes. Billing records are retained for the period required by tax law. Agent logs are retained no longer than needed for safety, debugging and plan quotas, then deleted or aggregated. Consent and deletion logs are kept as required by Law 25 to demonstrate compliance.

We apply organisational and technical measures proportionate to a SaaS directory and Agent product: encrypted transport, access control, session tokens, rate limiting, and separation of secrets from application code. No method of transmission or storage is perfectly secure. You must protect your mailbox, which is the recovery channel for magic-link authentication.

Subject to legal exceptions, you may request access, correction, deletion (including Law 25 / PIPEDA erasure), withdrawal of consent, and portability of personal information we hold. Signed-in users may delete the Account via Settings or by authenticated request to DELETE /api/v1/auth/me. You may also write to privacy@zenji.app. We will respond within the statutory period.

You may lodge a complaint with the Commission d’accès à l’information du Québec, the Office of the Privacy Commissioner of Canada, or, if GDPR applies to you, your local supervisory authority.

We use strictly necessary cookies and local storage for authentication, language (zenji.lang), theme, and similar preferences. We do not use third-party advertising cookies on the core Service. Analytics, if enabled, will be documented here and, where Law 25 requires, consented separately.

The Service is not directed to children under 18. We do not knowingly collect personal information from minors. If you believe we have, contact privacy@zenji.app and we will delete it.

We may update this Policy to reflect new processing or legal requirements. The “Last updated” date will change. Material changes affecting Law 25 consent will be notified so you can renew or refuse consent where required.

privacy@zenji.app — Privacy requests and Law 25 / PIPEDA communications. legal@zenji.app — other legal notices.