ZADOK ("we," "us") is an AI chief-of-staff service for solo founders, operated as a sole proprietorship in the United States. This policy explains what we collect, why, and the control you keep.
Account data: your email address, name, and timezone. Business data you provide: cash, burn, tasks, and conversation transcripts, used only to power your briefings and metrics. Connected services (all optional, per-service opt-in): Google Calendar events (read-only or read/write, your choice), Gmail draft creation (drafts-only by default; sending requires a separate explicit mode you enable), Stripe business metrics (read-only), and X posting. OAuth tokens are encrypted at rest with AES-256-GCM. Billing: payments are processed by Stripe; we never see or store your card number.
Your data is used to run your ZADOK: briefings, metrics, and the actions you approve. Conversation content is sent to our AI model providers (Anthropic, OpenAI) and voice provider (ElevenLabs) to generate responses under their API terms, which do not permit training on your data. We do not sell your data, ever. We do not use your data for advertising.
ZADOK's use of information received from Google APIs adheres to the Google API Services User Data Policy, including the Limited Use requirements. Calendar and Gmail data are used only to show your day, inform your briefing, and create the drafts and events you approve. They are never used for advertising, and never transferred except as necessary to provide these features.
Every connector can be disconnected at any time from the Connectors card, which revokes and deletes its tokens. Every action ZADOK takes requires your approval (or your explicitly enabled autopilot with veto window) and is recorded in your actions log. You can request deletion of your account and all associated data by emailing us.
Data lives in Supabase (Postgres, row-level security so only you can access your rows) hosted in the United States. We retain it while your account is active and delete it on request. Transport is TLS; secrets are encrypted at rest.
We'll post any material changes here and update the date above. Continued use after changes means acceptance.