ZADOK ("we," "us") is an AI chief-of-staff service for solo founders, operated as a sole proprietorship in the United States. This policy explains what we collect, why, and the control you keep.
Account data: your email address, name, and timezone. Business data you provide: cash, burn, tasks, and conversation transcripts, used only to power your briefings and metrics. Connected services (all optional, per-service opt-in): your calendar's events, read from the private calendar link you paste in (Google, Outlook or Apple; stored encrypted); Google Drive files limited to the ones ZADOK creates for you or that you choose with Google's file picker (your finance spreadsheet, and the documents and spreadsheets you ask for); Stripe and RevenueCat business metrics (read-only); and X and Buffer posting. ZADOK does not connect to your email account or edit your calendar: approved email drafts and calendar events open in your own email or calendar app, and you send or save them yourself. Access tokens, keys and your calendar link are encrypted at rest with AES-256-GCM. Billing: payments are processed by Stripe; we never see or store your card number.
Your data is used to run your ZADOK: briefings, metrics, and the actions you approve. We do not sell your data, ever. We do not use your data for advertising.
We share data only with the service providers that run ZADOK, only as needed for the feature you're using, and never with anyone else except where the law requires it:
AI model providers, Anthropic and OpenAI: to write your briefings and replies and draft the actions you approve, we send them your conversation with ZADOK together with the relevant context. That can include data obtained from Google: your Google Drive finance figures and the content of documents and spreadsheets you ask ZADOK to create. It also includes your calendar events, read from your calendar link. They process it under their API terms, which do not allow training their models on it. Voice provider, ElevenLabs: receives the text of replies ZADOK reads aloud, which can include the same information. Supabase (database) and Vercel (hosting): store and serve your data and run the app. Stripe: processes payments; it receives no Google data.
ZADOK's use of information received from Google APIs adheres to the Google API Services User Data Policy, including the Limited Use requirements. Google Drive data is used only to keep your finance figures current, inform your briefings and replies, and create the documents and spreadsheets you approve. It is shared only with the providers named under "Who we share data with," only to provide those features. It is never sold, never used for advertising, never used to develop, improve, or train generalized AI or machine learning models, and never transferred to anyone else except where the law requires it.
Every connector can be disconnected at any time from the Connectors card, which revokes and deletes its tokens and links. Every action ZADOK takes requires your approval (or your explicitly enabled autopilot with veto window) and is recorded in your actions log. You can request deletion of your account and all associated data by emailing us.
Data lives in Supabase (Postgres, row-level security so only you can access your rows) hosted in the United States. We retain it while your account is active and delete it on request. Transport is TLS; secrets are encrypted at rest.
We'll post any material changes here and update the date above. Continued use after changes means acceptance.