Skip to content
Zo. Open in WhatsApp

Privacy Policy

Zo, also known as Ask Zo, ("we", "us", "our") is a personal assistant built by Z8Z Labs. This policy explains what data we collect, how we use it, and your rights under the Digital Personal Data Protection Act, 2023 (DPDPA) and applicable Indian law.

1. Who This Applies To

This policy applies to all users of Zo, accessible via WhatsApp and the Zo iOS and Android apps.

2. Data We Collect

Your privacy is fundamental to how Zo is built. No human at Z8Z Labs accesses or reads your conversations or Google account data in the normal course of operating Zo. The only exceptions are where access is strictly necessary to protect the security of the Service, to comply with a legal obligation, or where you have given us your explicit consent. All data is encrypted in transit and at rest, and is used solely to make Zo work for you.

  • Account identity — your email address, used to identify your account securely.
  • Conversation history — your messages and Zo's responses, stored encrypted so Zo remembers context across sessions. No one at Z8Z Labs reads these.
  • Google account data — if you choose to connect your Google account, Zo can access your Calendar strictly to carry out actions you request (e.g. "what's on my calendar today?" or "schedule lunch with John on Friday"). Your calendar data is never stored on our servers beyond what is needed to respond to your immediate request, and is not read by any human except in the limited circumstances described above.
  • WhatsApp messages — messages sent to Zo via WhatsApp are processed to generate a response and then stored encrypted as part of your conversation history. No human reads your messages.
  • Things you ask Zo to remember — facts you explicitly tell Zo to store (e.g. a contact's number, a preference, a location), kept so Zo can act on them in your future requests.
  • Technical logs — anonymised operational data such as timestamps and error codes, reviewed only to keep the Service reliable. These logs never contain the contents of your messages or your Google account data. We do not collect device identifiers or use any data for advertising.
  • Browser Use records (only if you use Browser Use):
    • Signed-in sessions: the cookies and site data websites give Zo's browser when you sign in through it, kept in a browser profile used only for you. We do not keep your password: you type it on Zo's secure page and it is passed to the website once.
    • Task recordings: a recording of what Zo's browser did and saw during a task, including the pages it opened, which may include pages from accounts you are signed in to. We use these only to fix problems and improve Browser Use, and delete them after 7 days.
    • Saved details: details you ask Zo to remember for websites, such as a delivery address. You can see, change and delete them in My Zo.
    • Watched pages: the address and latest status of pages you ask Zo to keep checking.

3. How We Use Your Data

  • To operate Zo and respond to your requests.
  • To maintain conversation context so you don't have to repeat yourself.
  • To access Google Calendar on your behalf when you ask Zo to do so.
  • To keep the Service reliable and fix errors, using only technical logs — never the contents of your Google Calendar, Gmail, or other Google account data.

We do not use your data for advertising, and we do not sell your data to third parties. We use data obtained from Google APIs only to provide the features you ask Zo to perform, and for no other purpose.

4. AI Processing

Zo uses third-party, enterprise-grade AI services to understand your requests and generate responses. Your messages, and where a request requires it, data from your connected Google account, are transmitted to large language models operated by these providers, solely to generate responses to you. These are commercial API services: under their terms, data sent through their APIs is not used to train or improve their models. We do not run our own AI models, and we do not use any AI provider that reserves the right to train on submitted data.

Limited Use of Google user data. Zo's use and transfer of information received from Google APIs to any other app adheres to the Google API Services User Data Policy, including the Limited Use requirements. Data obtained through Google APIs is used solely to provide and improve the user-facing features you ask Zo to perform. It is not used for any other purpose — including advertising, marketing, analytics, research, profiling, or training generalized artificial intelligence or machine learning models (whether ours or any third party's) — is never sold or transferred except as needed to deliver those features to you, and is not read by any human except where strictly necessary for security, to comply with the law, or with your explicit consent.

5. Third-Party Services

Zo is built on enterprise-grade infrastructure. All third-party services we use are bound by their own privacy policies and data processing agreements, and are held to the same standard of data protection we hold ourselves to. No third party is permitted to use your data for their own purposes, including advertising or model training.

6. Data Retention

We retain your conversation history and stored facts for as long as your account is active. Any references to your Google Calendar or Gmail that appear in your conversation history are kept only as part of that conversation, solely to maintain context for you, and for no other purpose. If you disconnect your Google account, we delete the stored OAuth tokens immediately. You may request deletion of all your data at any time (see Section 8).

  • Browser profiles (signed-in sessions): deleted when you sign out in My Zo, when your account is deleted, or after 90 days without a Browser Use task.
  • Task recordings: deleted after 7 days.
  • Saved details and watched pages: kept until you delete them or your account is deleted.

7. Data Security

All data in transit is encrypted with TLS. Data at rest is stored in an encrypted Postgres database. OAuth tokens are stored encrypted and refreshed automatically; we never store your Google account password.

Card details entered on Zo's secure page are passed to the website for that task and are not shown to Zo's AI, but they do pass through Zo's servers on the way.

8. Your Rights

Under the DPDPA and applicable law, you have the right to:

  • Access — request a copy of the personal data we hold about you.
  • Correction — ask us to correct inaccurate data.
  • Erasure — ask us to delete your account and all associated data.
  • Withdraw consent — disconnect your Google account at any time via the Zo profile panel; this immediately revokes our access.
  • Grievance redressal — raise a complaint with our Data Protection Officer (see below).

To exercise any of these rights, email us at support@z8z.ai. We will respond within 30 days.

9. Children's Privacy

Zo is not directed at children under 18. We do not knowingly collect data from minors.

10. Changes to This Policy

We may update this policy from time to time. When we do, we will update the "Last updated" date at the top. Continued use of Zo after changes constitutes acceptance of the revised policy.

Contact / Data Protection Officer

Z8Z Labs
India
support@z8z.ai

Last updated: October 25, 2026