Privacy Policy

1. Introduction

This Privacy Policy explains how Zect AI, Inc. ("Zect," "we," "us," or "our") collects, uses, discloses, and safeguards information in connection with our website at xect.ai (the "Site"), the Xect AI orchestration and automation platform ("Xect" or the "Platform"), and related services, whether delivered as a hosted SaaS offering or deployed into a customer's own cloud environment ("Private Cloud") (collectively, the "Services"). Xect AI is a product of Zect AI, Inc.; there is no separate "Xect AI" corporate entity.

2. Who This Policy Covers

This Policy applies to three categories of individuals, described separately because Zect's role differs for each:

• Website visitors and prospects. Individuals who visit the Site, request a demo, subscribe to communications, or otherwise interact with us before becoming a customer. For this group, Zect acts as a data controller.
• Authorized Users. Individuals designated by a customer to access and use the Platform on the customer's behalf. For this group, Zect acts as a data controller for account administration and authentication data, and as a data processor for any personal data such users submit or generate while using the Platform.
• Data subjects referenced in Customer Data. Individuals whose information appears within the operational data a customer connects to, or processes through, the Platform ("Customer Data"), for example records from a customer's CRM, ticketing, OSS/BSS, or billing systems. For this category, Zect acts solely as a data processor (or "service provider" under applicable US state law) acting on the customer's documented instructions, as set out in the applicable Agreement.

If you are a data subject referenced in Customer Data and have a question about how your information is used, we encourage you to contact the Zect customer whose Services generated that data; that organization controls the data and is best positioned to respond. Zect will support that organization in responding to your request as required by law and the applicable Agreement.

3. Information We Collect

• Contact and account information you provide directly, such as name, work email, company, phone number, and job title, when you request a demo, contact us, or register for the Platform.
• Usage and technical data, such as IP address, browser type, device identifiers, pages visited, and interaction events, collected automatically through the Site and the Platform.
• Customer Data, meaning the operational data a customer or its Authorized Users submit to, connect through, or generate within the Platform in the course of using the Services. Zect processes Customer Data solely as a processor, under the customer's instructions and the applicable Agreement.
• Communications, including messages sent through the Site's contact and demo-request forms, and any correspondence that follows.

4. How We Use Information

We use the information described above — spanning website/account information and, where the Platform is in use, Customer Data — for the following purposes:

• operate, maintain, and improve the Site and the Platform;
• respond to inquiries, schedule demonstrations, and provide customer support;
• provision, configure, and support the Services under an active Agreement;
• send product updates, security notices, and, with consent where required, marketing communications;
• monitor for, investigate, and prevent fraud, abuse, and security incidents; and
• comply with legal obligations and enforce our agreements.

Customer Data specifically: We do not use Customer Data to train models on behalf of any customer other than the customer that submitted it, and we do not sell Customer Data.

5. Cookies and Tracking Technologies

The Site uses cookies and similar technologies to operate core functionality, remember preferences, and understand aggregate usage. Details on the categories of cookies we use, their purposes, and how to manage them are set out in our Cookie Policy.

6. How We Share Information

We share information only in the following circumstances:

• with sub-processors and service providers who process data on our behalf to deliver the Services (for example, cloud hosting, email delivery, and analytics providers), under contracts that require them to protect the information consistent with this Policy;
• in connection with a corporate transaction, such as a merger, acquisition, financing, or sale of assets, subject to standard confidentiality protections;
• where required to comply with a valid legal request, protect our rights, or protect the safety of any person; and
• at your direction, where you have asked us to share information with a named third party.

We do not sell personal information, and we do not share Customer Data with third parties except as necessary to provide the Services or as instructed by the applicable customer.

7. SaaS and Private Cloud Deployments

Zect offers the Platform in two deployment models, and where your data is processed depends on which model your organization uses:

• SaaS Platform. Customer Data is processed on cloud infrastructure operated and managed by Zect or its hosting sub-processors, under the security and access controls described in our security documentation.
• Private Cloud. Customer Data is processed within the customer's own cloud account or environment. Zect's access to Customer Data in a Private Cloud deployment is limited to what is reasonably necessary to provide support, troubleshooting, and platform updates, as authorized by the customer and set out in the applicable Agreement.

In both models, Zect processes Customer Data solely to provide the Services and does not use it for any other purpose without the customer's consent. For retention periods and cross-border transfer safeguards that apply to Customer Data, see Data Retention and International Data Transfers below.

8. International Data Transfers

Zect may process information in countries other than the country where you reside. Where required, we rely on recognized transfer mechanisms, such as the European Commission's Standard Contractual Clauses, to safeguard personal data transferred internationally.

9. Data Retention

We retain website visitor and account information for as long as reasonably necessary to fulfill the purposes described in this Policy, and Customer Data for the duration set out in the applicable Agreement, after which it is deleted or returned in accordance with that Agreement and applicable law.

10. Data Security

We maintain administrative, technical, and organizational safeguards designed to protect information against unauthorized access, disclosure, alteration, and destruction. Details on how the Platform is tested against, and hardened for, adversarial and AI-specific threats are published on our Security page. No method of transmission or storage is completely secure, and we cannot guarantee absolute security.

11. Your Privacy Rights

Depending on where you live, you may have rights to access, correct, delete, or export your personal information, to restrict or object to certain processing, or to withdraw consent. California residents have rights under the California Consumer Privacy Act, and residents of the European Economic Area, the United Kingdom, and Switzerland have rights under the General Data Protection Regulation. To exercise a right described in this section, contact us using the details in Section 14. If your information appears in Customer Data, see Section 2 above.

12. Children's Privacy

The Services are intended for business use and are not directed to individuals under the age of 16. We do not knowingly collect personal information from children.

13. Changes to This Policy

We may update this Policy from time to time. We will post the revised Policy on this page with an updated "Last updated" date, and, where changes are material, provide additional notice as appropriate.

14. Contact Us

Questions about this Policy can be sent to [email protected], or through our contact form.