Private by default, explained plainly.

Who controls your data

Nova Nuggets L.L.C, headquartered in Dubai, UAE, operates ZAKI. For access, correction, export, deletion, privacy, or DPA requests, contact support@chatzaki.com.

Information we process

We process account and authentication data, consent records, subscription and billing status, prompts, conversations, files, Agent run events, tool results, usage and diagnostic events, support messages, and the settings or connected-account scopes you choose. Stripe handles payment-card details; ZAKI does not store full card numbers.

How ZAKI uses information

The ZAKI hub controls identity, billing, settings, consent, and metering. It routes requested work to ZAKI Agent and Brain or ZAKI Chat and then to the subprocessors required for that request. Agent is the only writer of the personal Brain. Spaces uses a separate workspace store. We process data to deliver features, operate memory and personalization, secure the service, prevent abuse, meter usage, and support users.

Memory and automated profiling

Agent can extract durable memories from interactions and store memory records and vector embeddings in a PostgreSQL and pgvector Brain. ZAKI can also maintain a TELOS profile of goals, preferences, and values and derive behavior patterns that affect later context, suggestions, and response style. These processes are automated profiling. You can request access, correction, export, or deletion through support.

Connected accounts and channels

When enabled, Composio can authorize Gmail, Google Drive, and Google Calendar within scopes you approve and only when the product invokes those tools. Telegram is the currently available external messaging channel. Email, Discord, Slack, and WhatsApp remain limited or planned until their user controls are activated. Connected accounts can be revoked.

Legal bases and your rights

Where GDPR applies, our legal bases may include contract performance, legitimate interests in operating and securing the service, legal obligations, and consent where required. Depending on applicable law, you may request access, correction, deletion, restriction, portability, or objection and may withdraw consent where consent is the basis. You may also complain to the relevant supervisory authority.

International transfers

Core hosting is in the European Union. Subprocessors and their support or inference systems may process data internationally, including in the United States and other countries. Where required, we rely on appropriate contractual or lawful transfer safeguards. Model requests may be routed internationally to Moonshot AI or Together AI.

Material subprocessors

• Stripe — payments, subscriptions, invoices, and billing events.
• Cloudflare — DNS, edge routing, content delivery, traffic protection, and security signals.
• DigitalOcean, EU region — Kubernetes, storage, networking, managed PostgreSQL, conversations, and Brain data.
• Moonshot AI and Together AI — model inference using the prompt, required conversation or memory context, tool context, and files.
• Resend — transactional email such as verification, password reset, billing, and service messages.
• Composio — connected-account authorization and requested Gmail, Drive, or Calendar tool execution.

Cookies and local storage

Essential cookies support authentication and service operation. Analytics are off by default and require explicit consent. V5 also stores local display, guide, sound, cookie-note, and game preferences in your browser. You can clear these choices through browser storage controls.

Retention, deletion, and account closure

Conversation transcripts and associated Agent or Chat history are retained until you delete the account or they are removed under a documented operating policy. Long-term Brain memories remain until deleted, corrected, superseded, or removed with the account. Limited billing, security, fraud-prevention, consent, and audit records may be retained where law or security requires and are isolated from ordinary product use.

Children and minimum age

ZAKI is not directed to children. You must be at least 16 to create an account. If local law requires a higher age or parental authorization, that rule applies.

Security

Controls include encryption in transit, access controls, monitoring, and role-based internal access. No online service can guarantee absolute security.

Data Processing Agreement

Business customers may request a DPA by emailing support@chatzaki.com with the subject “DPA Request.” Availability and terms are confirmed during review.