Privacy at Zeonext.

1. Scope and roles

This policy applies to information processed through the Zeonext website, contact and pilot forms, demo, and Account Profit Intelligence service. For website visitor and business-contact information, Zeo Platforms generally determines why and how the information is used. For business data submitted by a customer for analysis, Zeo Platforms generally processes that data on the customer's behalf and subject to the applicable commercial agreement. A data processing addendum may be made available where required.

2. Information we collect

We may collect: (a) business contact information such as name, work email, company, company size, systems used, interests, and messages; (b) customer-submitted business content such as contracts, invoices, service records, cost or margin information, service catalogs, and related account data; (c) recommendation and outcome information, such as whether a finding was accepted, rejected, or deferred and any realized-profit amount a user chooses to provide; and (d) limited technical information needed to operate and secure the service, such as request identifiers and IP address information used for rate limiting or security.

Zeonext is designed for business information. Do not submit Social Security numbers, government identification numbers, payment-card data, bank credentials, passwords, medical or biometric information, precise geolocation, or other highly sensitive or regulated personal information unless we have expressly agreed in writing that the service is configured to handle it.

3. Sources of information

We obtain information directly from website visitors and customer users, from files and exports customers choose to submit, and, when integrations are enabled, from systems a customer authorizes Zeonext to access. We may also receive business contact information from an authorized representative of your organization.

4. How we use information

We use information to provide and improve requested analysis; generate Recover, Protect, Expand, and Prioritize recommendations; operate pilots; respond to inquiries; secure and troubleshoot the service; prevent abuse; administer commercial relationships; measure recommendation outcomes; comply with law; and protect our rights and the rights of customers and others.

We do not use identifiable customer-submitted business content to train a general-purpose model for other customers unless the customer expressly agrees in writing. We may use aggregated or de-identified information that cannot reasonably identify a customer or individual to evaluate and improve product performance.

5. AI processing

When live AI analysis is enabled, the text submitted for analysis is transmitted to the configured AI service provider. When configured, the current pilot service uses the OpenAI API. We configure Responses API requests with storage disabled at the application-state layer (store: false). OpenAI states that API data is not used to train its models by default unless the API customer opts in. OpenAI also states that abuse-monitoring logs may retain customer content for up to 30 days by default unless approved data-retention controls such as Zero Data Retention or Modified Abuse Monitoring apply. Customers should submit only information necessary for the analysis.

6. Retention and durable product records

Raw analysis content: browser uploads may first be placed in short-lived, tokenized temporary storage encrypted at rest. When asynchronous analysis is queued, the job payload is also encrypted so processing can survive a restart or retry. Temporary source files and encrypted job payloads are cleared after successful processing or terminal failure/expiry under the configured retention controls. Durable Zeonext records may store derived results, findings, opportunity state, evidence excerpts and locators, workflow history, outcomes and audit records rather than the original uploaded document bodies. AI-provider processing and retention are governed separately as described above.

Website contact, pilot, and partner requests: retained for up to 24 months after the most recent interaction, unless a longer period is reasonably necessary for an active commercial relationship, legal obligation, dispute, or security purpose.

Analysis, opportunity, workflow, and outcome records: Zeonext intentionally persists analysis results, normalized findings, durable opportunity records, lifecycle events, account-level portfolio state, evidence excerpts and locators, outcome values, audit records, and related operational metadata so customers can re-open prior work, track actions across analyses, and measure realized value. These durable records remain tenant-scoped and may be retained for the active customer relationship and a reasonable period afterward, subject to the applicable agreement, legal requirements, security needs, and configured retention controls.

7. How we disclose information

We may disclose information to service providers that help us host, secure, operate, analyze, communicate about, or support the service; to a customer's authorized users or administrators; to professional advisers subject to appropriate confidentiality obligations; to authorities or other parties when reasonably necessary to comply with law or protect rights and safety; and in connection with a merger, financing, acquisition, reorganization, or sale of assets, subject to customary protections.

We do not sell personal information or share personal information for cross-context behavioral advertising as those terms are defined under the California Consumer Privacy Act. The current website does not use third-party advertising cookies or cross-site behavioral advertising trackers.

8. Security

We use administrative, technical, and organizational safeguards designed to protect information appropriate to the nature of the service, including transport security when deployed over HTTPS, restrictive browser security headers, tenant-scoped member/API authentication, encrypted temporary intake and queued-job payloads, rate limiting, durable audit events, governed action lifecycles, human approval before customer-facing or financial actions, and bounded retention practices. No security measure is perfect, and we cannot guarantee absolute security.

9. Your privacy choices and rights

Depending on where you live and whether the applicable privacy law applies to Zeo Platforms or Zeonext, you may have rights to request access to, correction of, or deletion of certain personal information; to receive information about our collection and disclosure practices; to opt out of certain sales, sharing, targeted advertising, or profiling; or to appeal a denied request. We will not discriminate against you for exercising a privacy right protected by law.

You may submit a privacy request through the Contact page. We may need to verify your identity or authority before completing a request. Authorized agents may submit requests where permitted by law, subject to appropriate verification.

10. California disclosures

California residents can review the categories of personal information, sources, purposes, disclosures, and retention practices described above. Zeo Platforms does not currently sell or share personal information for cross-context behavioral advertising. Because the current site does not engage in cross-site behavioral tracking, it does not take a different action in response to legacy browser "Do Not Track" signals. If our practices change in a way that makes a legally recognized opt-out preference signal such as Global Privacy Control applicable, we will honor it as required by law and update this policy.

11. Children

Zeonext is a business-to-business service and is not directed to children. We do not knowingly collect personal information from children under 13 through the service. Users must be at least 18 years old and authorized to act for the business they represent to enter into a paid service relationship.

12. U.S.-first service

The current service and pilot are designed for U.S. business use. If Zeonext later offers production services in additional jurisdictions, we may add jurisdiction-specific disclosures, contractual terms, transfer safeguards, or data-processing commitments before doing so.

13. Changes to this policy

We may update this policy to reflect changes in the service, vendors, or law. We will post the updated version with a new "Last updated" date and provide additional notice when required by law or when a change materially affects how previously collected personal information is used.

14. Contact

For privacy questions or requests, use the Contact page. Customers with a signed Order Form may also use the privacy or notice contact identified in their commercial agreement.