Privacy Policy

The categories below depend on how you use the product. Anonymous visitors generate less data than authenticated users with an active account.

• Account and identity: name, email, profile image, user identifiers, and session metadata processed by authentication and identity providers.
• Workspace content: documents, notes, visual boards, tasks, comments, and other information you create or upload, plus preferences, folders, calendar data, chat history when enabled, and editor settings.
• Subscription and billing: email, customer identifiers, subscription, checkout, and billing data processed by payment providers. We do not store full card numbers.
• AI and media processing: prompts, document or note excerpts, preferences, audio/video/image/PDF files, and extracted text when you use chat, rewrite, translation, SEO, summary, OCR, transcription, or converters.
• Telemetry and diagnostics: IP address, browser, device, visited page, product events, logs, errors, and traces. Session replay is disabled in the current configuration.
• Email and support: recipient, sender, shared content, generated attachments, optional technical screenshots, user agent, page path, affected area, minimal technical context, and free-text fields sent through support or bug reports.

We process each category for defined purposes and under the legal basis applicable to the specific activity. Depending on the case, this may include performing a contract or pre-contractual steps, complying with legal obligations, exercising legal rights, legitimate interests assessed under applicable law, or consent where required. You may ask which basis applies to your request through the channel in this policy.

• Operate login, sessions, synchronization, editing, storage, and retrieval of documents.
• Process payments, subscriptions, quotas, plan limits, and billing webhooks.
• Run requested AI, OCR, transcription, conversion, export, and email sharing features.
• Detect failures, prevent abuse, apply rate limits, investigate incidents, and support users.
• Measure usage, diagnose performance, and improve the product under telemetry governance; any promotional communications, if sent, follow applicable choices and rules.

Zerus uses cookies and local storage needed for sessions and product operation. Analytics and observability tools may collect technical identifiers and events depending on session state and telemetry settings. Accepting the Terms during sign-up is not unlimited authorization for advertising or marketing.

• Web analytics: visit metrics and navigation events when allowed.
• Product analytics: authenticated events and activation metrics when allowed.
• Observability and diagnostics: errors, traces, structured logs, and operational metadata for diagnostics and security; session replay is currently disabled.

We do not sell personal data. We share only what is necessary with providers supporting authentication, payments, hosting, email, analytics, security, and features you request. Depending on the provider and flow, data may be processed outside Brazil. International transfers must follow the safeguards and mechanisms required by applicable law; location and retention may vary by provider.

Data needed to operate the account and workspace is processed in Zerus infrastructure. Some features send data directly to providers specializing in AI, media, OCR, email, or payments when you use them; those providers may have their own policies and retention periods.

• Authentication and identity providers: login, sessions, and basic account data.
• Payment providers: checkout, portals, subscriptions, payments, and communications needed to operate payments.
• AI providers and selected models: processing prompts and context needed for AI features you activate. The provider or model may vary with service configuration; the model provider's policies also apply. Zerus does not control providers' retention periods or data-use practices, and does not promise that submitted data will not be stored or used for training.
• Hosting and infrastructure providers: operation of the application and internal services.
• Visit and performance measurement providers: web analytics and performance metrics when enabled on the site.
• Caching and operational control providers: sessions, quotas, caching, and rate limits.
• Media and file providers: uploads, temporary storage, and media processing.
• OCR and conversion providers: text recognition in images and document processing when you use those features.
• Internal document services: document and PDF processing in Zerus infrastructure, depending on the feature.
• Email providers: transactional emails or sharing flows you request, including weekly agenda sharing.
• Analytics and observability providers: usage metrics, logs, errors, and diagnostics according to telemetry settings.

We keep core account, subscription, and workspace data while your account exists and while needed to operate the service, comply with legal obligations, resolve disputes, prevent abuse, or preserve security evidence. Bug reports are kept for up to 365 days after creation for triage and technical investigation, then automatically purged.

Some periods are already objective in the product: an active editor session for up to 7 days; private dashboard, calendar, document, folder, note, and kanban caches for seconds or a few minutes; daily and monthly quotas until period rollover; aggregated AI usage records for 3 months before automatic cleanup.

Deleting an item in the interface does not necessarily remove backups, logs, records needed for security, or data kept by providers under their own cycles. Supported document and note content is encrypted by the application before database persistence; this is not end-to-end encryption and does not prevent processing when you use features that need to read the content.

Account settings let you export data and register an account deletion request. Submitting a request records it for operational handling; it does not mean immediate erasure. Completion may require verification and steps across Zerus systems and providers. Certain records may be retained where there is a legal basis or documented need.

Under applicable law, you may request confirmation and access, correction, anonymization, blocking or deletion where applicable, information about sharing, portability subject to regulation, review of automated decisions, and withdrawal of consent when consent is the basis. Requests may require identity verification and may be subject to legal retention or limitation rules.

Use account settings to export data or register a deletion request. For other requests, questions, or complaints, email [email protected]. Include the account email and describe your request; do not send passwords or excessive personal data. Zerus may ask for additional information to verify your identity.

If you believe your request was not handled appropriately, you may request a review through the same channel and, where applicable, petition the Brazilian National Data Protection Authority (ANPD) or use available legal remedies.

We apply technical and organizational controls designed to protect data, including authentication, access controls, user-level segregation, input validation, and monitoring. No measure guarantees absolute security. If an incident creates relevant risk or harm, we will make notifications required by applicable law.

The service is operated by an individual. For privacy matters or to request information about the data controller, contact [email protected].

This policy may be updated when the product, providers, or practices change. Significant changes will be communicated through available service channels, and the revision date will be updated below.