1. What we collect

We collect information you provide directly to us, information we collect automatically when you use the Service, and information from third-party sources.

Account data — name, email address, company name, and password (stored as a salted hash).
Pipeline data — contacts, deals, notes, and activities you create within the Service.
Usage data — pages visited, features used, actions taken, timestamps, and referrer URLs.
Device data — browser type, operating system, IP address, and approximate geolocation.
Payment data — billing address and last four digits of card. Full card numbers are handled by Stripe and never stored on our servers.

2. How we use it

We use the information we collect to provide, maintain, and improve the Service, and to comply with legal obligations. Specifically:

To create and maintain your account and authenticate your sessions.
To operate pipeline features, automations, and AI-assisted scoring.
To send transactional emails (receipts, password resets, deal notifications).
To send product updates and announcements — you can opt out of these at any time.
To detect and prevent fraud, abuse, and security incidents.
To improve model performance and product quality using aggregated, anonymized data.

We do not use your personal data to train third-party AI models without your explicit opt-in consent.

3. Agents & your data

We never sell your data. Your pipeline data is yours — period. Agents act on your data only when you authorize them to do so, and all agent actions are logged and auditable in your account.

When you use agent features, your pipeline data (contacts, deals, notes, ICP profiles) is passed to AI models as context to generate responses and take actions. This context is processed under your instruction and is subject to the data handling terms of the underlying model provider (Anthropic / OpenAI / Google).

Agent inputs and outputs are stored in your account for auditing and reproducibility.
You can disable agents at any time from the Settings page without affecting your underlying pipeline data.
We do not share your pipeline data with other ZeroPipeline customers or any third party except as described in the Sharing section below.

4. Sharing

We do not sell, rent, or trade your personal information. We may share information in the following limited circumstances:

Service providers — We work with trusted third parties (Stripe for payments, Resend for email, Railway for hosting, Sentry for error monitoring) who process data on our behalf under strict data processing agreements.
AI model providers — Prompt context is sent to Anthropic and/or OpenAI for inference. These providers process data under their respective enterprise data processing agreements.
Legal requirements — We may disclose information if required by law, subpoena, or similar legal process.
Business transfers — In the event of a merger, acquisition, or sale, your data may be transferred as part of that transaction. We will notify you before your data becomes subject to a different privacy policy.

5. Your rights

Depending on your location, you may have the following rights regarding your personal data:

Access — Request a copy of the personal data we hold about you.
Correction — Request correction of inaccurate or incomplete data.
Deletion — Request deletion of your personal data. We will honor deletion requests within 30 days, subject to legal retention obligations.
Portability — Export your pipeline data in CSV or JSON format from the Settings page at any time.
Opt-out — Opt out of marketing communications via the unsubscribe link in any email or from your account settings.

If you are located in the European Economic Area or United Kingdom, you have additional rights under GDPR / UK GDPR including the right to lodge a complaint with your local supervisory authority.

6. Security

We take the security of your data seriously. Our security practices include:

All data in transit is encrypted using TLS 1.2 or higher.
All data at rest is encrypted using AES-256.
Passwords are hashed using bcrypt with a minimum cost factor of 12.
We undergo periodic third-party security reviews and are working toward SOC 2 Type II certification.
Access to production systems is restricted to authorized personnel and gated behind multi-factor authentication.

Despite our efforts, no method of electronic transmission or storage is 100% secure. If you discover a security vulnerability, please report it responsibly to security@ainative.studio.

7. Contact

If you have questions about this Privacy Policy or want to exercise your rights, please contact us:

Email: privacy@ainative.studio
Security disclosures: security@ainative.studio
AINative Studio, San Francisco, CA