Privacy policy
In short
We collect only what we need to reply to you and to run the demos. Demo chats are logged anonymised, uploaded demo documents are deleted after 1 hour, and we never use your data to train AI models.
Last updated: 2026-10-02
Who we are
ziai ("we") is the controller of personal data collected on ziai.online. Contact: the email address in the site footer.
What we collect
- Contact and quote forms: name, business, phone/WhatsApp, email, country, industry, your message, the page you came from. Used to reply to you and prepare a quote (legal basis: pre-contractual steps / legitimate interest).
- Live demos (website chat): the messages you type and the AI's replies. Before storing, we remove email addresses and phone numbers from the text. We store a salted hash of your IP address (not the IP itself) to enforce rate limits. Logs are kept for up to 12 months to improve the demos and may be used, anonymised, as marketing examples.
- Document demo: files you upload are processed to answer your questions and are automatically deleted, together with their search index, 1 hour after upload. Please don't upload confidential documents to a public demo.
- WhatsApp demo: your messages to our demo number are processed by Meta (WhatsApp) and by us. We store a salted hash of your number, not the number itself, unless you ask us to contact you.
- Analytics: only if you accept, privacy-friendly analytics without cookies for advertising or cross-site tracking.
AI providers
Demo messages may be processed by AI providers (Anthropic, OpenAI) under terms that do not allow them to train on the data, or by our self-hosted private model in the EU. The demo shows which one answered. We do not train AI models on your data.
Sharing
We use processors for hosting (EU), email delivery, Cloudflare (security/CDN), our CRM, and the AI providers above. We don't sell personal data.
Your rights
You can ask for access, correction, deletion, restriction, portability, or object to processing by emailing us. You can complain to the Cyprus Commissioner for Personal Data Protection.
Security
Secrets are encrypted at rest, admin access requires two-factor authentication, and all traffic uses HTTPS.