Privacy policy

This policy explains how ioZen collects, uses, shares and protects personal information when you visit iozen.ai, create an account, or use the ioZen app at app.iozen.ai (together, the "Service").

"We" and "us" mean RINCOT TECHNOLOGY LTD., the company that operates the ioZen brand (Business Number 796518827), at 22922 132 Ave, Maple Ridge, BC V4R 2R2, Canada. "You" means whoever is reading: a customer, a member of a customer's team, a visitor to our website, or a person who talks to an Intake Bot run by one of our customers.

1. Our two roles

We act in two different roles, and the rules differ for each.

We are the controller (the "responsable") for the personal information of our customers and their team members (account, workspace and billing data), of visitors to iozen.ai, and of anyone who writes to us. This policy covers that information in full.

We are a processor (the "encargado") when a customer uses ioZen to collect information from its own clients, through an Intake Bot, a FlowApp page, a WhatsApp number or the API. The customer decides what to collect and why, and we process that information on its behalf and on its instructions. Our data processing agreement governs that processing.

If you gave your information to a business that uses ioZen, that business's privacy notice applies, and it is the right place to send requests about your data. If you write to us instead, we'll pass your request to the business and help it respond.

2. Information we collect about customers and visitors

Account and workspace

When you sign up we collect your email address and password, or your Google account details if you sign in with Google. We also ask for your website or social profile (or a short description of your business) and what you want to solve. You can add your name, photo, language and time zone later. When you invite teammates, we store their email address and role.

Our sign-in provider stores your password as a hash. We never see it in plain text.

To set up your first FlowApp, we read the public pages of the website or social profile you give us and build a short business profile: industry, size, services, audience, location and languages. You can edit it at any time.

How you found us

When you sign up we record how you arrived: UTM parameters, ad click IDs (gclid, fbclid, msclkid), the referring page and the landing page.

Billing

If you buy a plan or credits, Stripe collects your card details. We receive your name, email, billing details, plan and payment history, never your full card number.

Communications

When you write to us or reply to our emails, we keep the conversation. Our email provider tells us whether an email was delivered and opened.

How you use the Service

Our systems record technical information such as IP address, browser, device, pages and features used, and errors. We use it to run, secure and fix the Service.

Website visitors

iozen.ai has no forms. We learn about visits through the analytics and advertising tags described in section 7.

3. How we use it, and on what legal basis

We use the information in section 2 for these purposes, each with its legal basis under laws such as the GDPR and Brazil's LGPD:

• Creating and running your account and workspace, and giving support: performance of our contract with you.
• Billing, invoices and tax records: performance of the contract, and legal obligation.
• Service emails, such as invitations, security alerts, billing notices and trial reminders: performance of the contract.
• Keeping the Service secure, preventing fraud and abuse, and fixing errors: our legitimate interest in a safe, working Service.
• Understanding how the product is used, to improve it: our legitimate interest in improving the Service.
• Product news and tips by email: our legitimate interest in telling customers about our own product, or your consent where the law requires it. Every one of these emails has an unsubscribe link, and you can turn them off in Settings.
• Analytics and advertising tags on iozen.ai and in the app: your consent where the law requires it, and otherwise our legitimate interest in measuring our own marketing.
• Complying with the law and answering lawful requests: legal obligation.

For the data we process for our customers (section 4), the customer chooses the legal basis, and we act on its instructions.

4. Data we process for our customers

When a customer's client (an "end user") answers an Intake Bot, writes to a customer's WhatsApp number, opens a FlowApp page or is added through the API, we process, on the customer's behalf:

• Answers and files: the answers to the questions the customer set up, uploaded files and documents, and the chat history.
• Contact details: name, email, phone, company, country, and any custom fields the customer defines.
• WhatsApp conversations: phone number, WhatsApp profile name, messages and media, opt-outs, and, for chats started from an ad, the ad's click ID and referral data.
• Technical and attribution data: browser and device, approximate location (country, region, city and time zone, derived from the IP address), a one-way hash of the IP address, the referring page and landing page, UTM parameters, ad click IDs (fbclid, gclid, gbraid, wbraid, msclkid, ttclid, li_fat_id, ctwa_clid), and the advertising cookies set by the customer's own pixels (_fbp, _fbc, _ttp, _ga).
• What the customer's team adds: notes, status, the person assigned, and AI summaries and scores.

Private and encrypted fields

A customer can mark a question as private. Its answer is stored apart from the rest of the case, it stays out of AI features (section 5), and every time someone opens it, the access is logged. An encrypted field is also stored in an encrypted vault (Supabase Vault).

Attribution and conversions

Attribution capture is on by default and the customer can turn it off for each Intake Bot. Sending conversions to ad platforms is off until the customer connects an ad account and turns it on. When it's on, our servers send each event to the platforms the customer chose, on the customer's behalf:

• Meta (Conversions API): email, phone, first and last name, city, region, country, postal code and an external ID, each hashed with SHA-256 before it leaves our servers, plus the IP address, browser user agent, Meta click and browser IDs (fbc, fbp) and the event value, which are not hashed.
• TikTok (Events API): hashed email and phone, plus the IP address, browser user agent and TikTok click ID (ttclid).
• Google Analytics 4 (Measurement Protocol): a client ID and user ID with the event. No email or phone.
• Google Ads: hashed email and phone, the Google click ID (gclid) and the IP address.
• LinkedIn (Conversions API): hashed email and the event.

Hashing turns a value into a code the platform can match against its own users. It protects the value in transit; it is not anonymization. The customer decides whether to use these features and is responsible for having a legal basis and telling its end users.

If the customer adds its own Meta Pixel or TikTok Pixel to an Intake Bot, those pixels load on the Intake Bot page and set their own cookies (section 7).

Connected apps, webhooks and API

If a customer connects an app (for example HubSpot, Zoho CRM, GoHighLevel, Google Sheets or monday.com), we send the fields the customer maps to that app through Composio, our integration provider. Webhooks and the API send data to systems the customer controls. Each of those apps handles the data under its own terms.

Case distribution

If the customer turns on case distribution, we assign each new case to a member of the customer's team using rules the customer sets: country, channel, Intake Bot, board and AI score. Distribution decides who on the customer's team handles a case. It doesn't decide anything about the end user's rights.

5. How we use AI

ioZen uses AI to:

• Draft FlowApps and questions from a description or a website.
• Understand and check answers, and extract data from uploaded documents and images.
• Reply in conversations, using only the knowledge documents the customer published and connected to the Intake Bot.
• Turn voice input into text, when the customer turns voice input on.
• Summarize and score cases.

We send the model only what the task needs: the messages, answers, documents, voice transcripts, knowledge passages or website content involved. Draft knowledge documents are never sent. When a customer publishes one, it is sent to an embeddings model so the Intake Bot can search it.

Every AI request goes through Vercel AI Gateway to one of these providers: Google (Gemini), OpenAI, Anthropic, and Typesafe AI, which checks a reply against its sources before it's sent. If one provider fails, the request can go to another one on the list.

Private fields stay out of AI: their answers are replaced with "[private]" before any summary or score, and AI features are turned off for them.

We don't use customer content to train or fine-tune AI models. The providers process it only to answer the request, and their API terms don't allow them to train their models on it.

AI can be wrong. Customers should review what it produces before relying on it. AI scores help a customer's team decide what to look at first; we don't make decisions with legal or similarly significant effects on anyone based solely on automated processing.

6. Who we share it with

We don't sell personal information, and we don't rent it. We share it only in these cases:

• With our service providers (section 8), who process it for us under contract and only on our instructions.
• With the ad platforms, apps and systems a customer connects (section 4), on that customer's instructions.
• With Google and Meta, through the advertising tags on our website and on some app pages, to measure our own ads (section 7). Under some US state laws this can count as "sharing" for advertising. You can opt out as explained in section 7, or by writing to us.
• When the law requires it, for example a court order, or to protect the rights and safety of our users, the public or ioZen.
• In a merger, acquisition or sale of assets, with notice to you before your information falls under a different privacy policy.
• With your consent, for any other purpose.

7. Cookies and similar technologies

On iozen.ai

These tags load only on iozen.ai:

• Google Analytics 4 (cookies _ga and _ga_*): counts visits and clicks.
• Google Ads (_gcl_au): measures which ads bring sign-ups.
• Meta Pixel (_fbp, _fbc): measures page views and clicks on sign-up buttons for our Meta ads.

Where the law requires your consent (the European Union and the rest of the European Economic Area, the United Kingdom, Switzerland, Brazil, Colombia, Ecuador, Peru, Chile, Argentina and the province of Quebec), these tags load only after you accept them in our cookie banner. Elsewhere they load when you arrive, and you can turn them off. You can change your choice at any time from "Cookie settings" in the footer.

In the app

• Necessary cookies: your sign-in session (sb-*, from Supabase) and a security cookie for ioZen staff sessions. The app can't work without them.
• Preferences: language (NEXT_LOCALE, 1 year), sidebar and layout (7 days), and the mobile notice (30 days).
• Google Ads, Google Analytics 4 and Meta Pixel, only on the sign-up, onboarding and billing pages, to measure our own ads.

On Intake Bot pages and the website widget

We don't place our own analytics or advertising tags on Intake Bot pages. When a customer embeds an Intake Bot on its own website, our widget sets a first-party cookie (iozen_session, 30 days) and keeps the first visit's campaign data in the browser's local storage, so the customer can see which campaign brought each case. Unfinished answers are saved in the browser for 24 hours so the person can pick up where they left off. If the customer added its own Meta or TikTok pixel, that pixel sets its own cookies (_fbp, _fbc, _ttp).

Your choices

You can block or delete cookies in your browser settings. Our website and app don't respond to the browser "Do Not Track" signal; use the cookie settings instead. Blocking necessary cookies will sign you out of the app. Google offers an opt-out for Google Analytics at tools.google.com/dlpage/gaoptout, and you can manage Meta ads in your Meta account settings.

8. Service providers (subprocessors)

• Supabase: database, sign-in, file storage and encrypted vault. All account and customer data.
• Vercel: hosts the app, runs background jobs, stores data exports, routes AI requests (AI Gateway) and gives approximate location from the IP address. Request data, IP addresses, exports and AI requests.
• Cloudflare: hosts and protects iozen.ai. Visitor IP addresses and request logs.
• Upstash: rate limiting, cache and job queues. IP addresses and short-lived job data.
• Postmark: sends our emails. Email addresses, names, email content and delivery events.
• Stripe: payments and billing. Billing details.
• Sentry: error monitoring. Error reports with browser and request details, configured not to collect names or email addresses.
• Google (Gemini), OpenAI, Anthropic and Typesafe AI, through Vercel AI Gateway: AI features (section 5). The content each request needs.
• Kapso and Meta (WhatsApp Business Platform): connect customers' WhatsApp numbers and deliver their messages. Phone numbers, messages and media.
• Composio: connects the apps a customer chooses (section 4). The fields the customer maps.
• Jina AI: reads public web pages a customer gives us during setup. Public business content.
• Google (Analytics and Ads) and Meta (Pixel): analytics and ad measurement for our own website and app (section 7).
• Sanity: manages the content of iozen.ai. Our team's editor accounts; your browser loads site images from its network.
• Discord: internal alerts to our team about errors and sign-ups. Workspace names, error details and a shortened code derived from the email address.

When a person uses some features, their browser also contacts these services directly: OpenStreetMap (map tiles for location questions, which receive the IP address and the approximate area shown), the browser maker's speech service (Google in Chrome, Apple in Safari) for voice input, and a QR code service that receives only the Intake Bot's public link.

We update this list at least 30 days before a new provider starts processing customer data, except in an emergency. Customers who want to be told can write to hello@iozen.ai.

9. International transfers

We store data in the United States: our database, app servers and queues run in the US East region (Northern Virginia). Some providers in section 8 process data in other countries.

When we transfer personal information out of the European Economic Area, the United Kingdom or Switzerland, we rely on the European Commission's Standard Contractual Clauses (with the UK addendum), or on the EU-US Data Privacy Framework where the provider is certified. Where another law requires a specific mechanism, such as standard contractual clauses under Brazil's LGPD, we use it, or we rely on the transfer being necessary to provide the Service you asked for. By the nature of the Service, end users' data travels to the United States; customers should say so in their own privacy notices.

10. How long we keep data

• Account and workspace data: while your account is active.
• A deleted workspace: when an owner deletes a workspace, it can be restored for 30 days. After that we permanently delete it, with its cases, contacts, conversations and files.
• Your user account: write to hello@iozen.ai and we'll delete it within 30 days of confirming the request. If you're the only owner of a workspace, we'll ask you to transfer or delete that workspace first.
• Customer data: until the customer deletes it (customers can delete contacts, records and Intake Bots in the app) or deletes the workspace. If a plan ends or is downgraded, we pause what's over the new plan's limits; we don't delete it.
• Data exports: 7 days.
• Activity logs: 90 days by default. On some plans the customer can set between 30 and 365 days.
• Webhook delivery logs: 30 days. Conversion delivery records and read notifications: 90 days.
• Billing records: as long as tax and accounting laws require.
• Backups: our database provider keeps rolling backups. Deleted data drops out of them as they rotate, and we never restore it to the live Service.
• Analytics on our website: Google and Meta keep it under each tool's retention settings.

11. How we protect it

• Every connection uses HTTPS, and browsers are told to always use it (HSTS).
• Our providers encrypt stored data at rest.
• Every query is limited to its workspace, and the database denies direct access by default (row-level security).
• Private fields are stored apart from the rest of the case, encrypted fields live in Supabase Vault, and every read of either is logged.
• Ad platform credentials are encrypted (AES-256-GCM) and API keys are stored only as hashes.
• Roles (owner, admin, member) control what each person sees, and a workspace can limit members to the cases assigned to them.
• We limit request rates and verify the signature of incoming webhooks.

No system is perfectly secure. If a breach affects personal information, we'll tell the affected customers without undue delay, and we'll notify authorities and affected people as the law requires (within 72 hours under the GDPR).

12. Your rights

What you can ask for

Wherever you are, you can ask us to:

• Tell you what personal information we have about you, and give you a copy.
• Correct it if it's wrong or incomplete.
• Delete it.
• Send it to you, or to another company, in a common machine-readable format.
• Stop using it for a purpose you object to, including direct marketing.
• Withdraw your consent, where we rely on it. This doesn't affect what we did before.

We won't treat you differently for using these rights.

How to ask

Write to hello@iozen.ai from the email address on your account, or tell us how to confirm who you are. Someone you authorize can ask for you. We reply within 10 business days, and if we need more time, we'll tell you why within the limits your law allows. It's free. If we decline a request, we'll explain why and how to challenge the decision, including with the authority below.

If your data reached us through a business that uses ioZen, that business decides on your request. We'll pass it on and help it answer.

By country

• European Economic Area, United Kingdom and Switzerland (GDPR): you can also ask us to restrict processing, and object to processing based on legitimate interests. You can complain to your data protection authority.
• California (CCPA and CPRA): you can know, delete and correct, and opt out of the sale or sharing of personal information. We don't sell it; to opt out of the advertising "sharing" in section 6, use Cookie settings or write to us.
• Canada (PIPEDA and British Columbia's PIPA): you can access and correct your information and withdraw consent, and complain to the Office of the Privacy Commissioner of Canada or British Columbia's Information and Privacy Commissioner.
• Mexico (LFPDPPP): you have the ARCO rights (access, rectification, cancellation and opposition) and can revoke your consent. You can complain to the federal data protection authority.
• Colombia (Law 1581 of 2012): you can know, update and correct your data, ask for proof of your authorization, be told how your data is used, revoke the authorization or ask for deletion, and complain to the Superintendence of Industry and Commerce (SIC).
• Ecuador (LOPDP): you have the rights of access, rectification, deletion, opposition, portability and suspension, and not to be subject to decisions based solely on automated processing. You can complain to the Superintendence for Personal Data Protection.
• Brazil (LGPD): you can confirm that we process your data, access, correct, anonymize, block or delete it, port it, learn who we share it with, and revoke consent. You can complain to the ANPD.
• Peru (Law 29733): you have the rights of access, rectification, cancellation and opposition, and can revoke your consent. You can complain to the National Authority for Personal Data Protection.
• Chile (Law 19.628, and Law 21.719 once in force): you have the rights of access, rectification, deletion, opposition, portability and blocking, and can complain to the competent authority.

13. Children

You must be 18 or older to create an ioZen account. We don't knowingly collect personal information from children. Customers who collect information about minors through ioZen are responsible for getting the consent their law requires. If we learn that we hold a child's information without that consent, we'll delete it.

14. Changes to this policy

We update the date at the top every time we change this policy. For material changes, we email account owners at least 30 days before the change takes effect and show a notice in the app.

15. Contact

• Privacy questions and requests: hello@iozen.ai
• Person responsible for privacy: Jacobo Moreno, CEO, at hello@iozen.ai
• Legal entity and address: RINCOT TECHNOLOGY LTD. (Business Number 796518827), 22922 132 Ave, Maple Ridge, BC V4R 2R2, Canada