Privacy Policy

Last updated: 24 September 2026

This Privacy Policy explains how [LEGAL ENTITY] ("Zebly", "we", "us") collects, uses, and discloses information in connection with zebly.com, the Zebly assistant, and related services, apps, and integrations (together, the "Services"). By using the Services, you acknowledge the practices described here.

Our commitment on AI training

During early access, we do not use any information we collect to train, fine-tune, or otherwise improve artificial intelligence or machine learning models, and we do not allow anyone else to.

This commitment covers everything:

• your content and messages
• data from your connected accounts
• information about the people you work with
• usage data
• de-identified or aggregated information

It covers our own models and third-party models alike. There is no opt-out to find and no setting to change, because there is nothing to opt out of.

After early access. We may revisit this commitment when early access ends. If we do:

• Notice first: we will tell you before any change takes effect and update this policy.
• Early-access data stays protected: information collected during early access will not be used for training without your separate consent.
• Google and Slack data are never used: data from Google Workspace and Slack will never be used to train AI models, as described below.

We select AI model providers and other service providers whose terms prohibit using our customers' data to train their models, and we configure our use of them accordingly.

How our AI providers handle your data

Zebly uses frontier AI models from third-party providers to understand requests and plan work. We configure them so that:

• No training: providers may not use your data to train or improve their models.
• No storage after processing: providers don't keep your data once a request is processed.
• One safety exception: like every frontier AI provider, our providers run automated safety systems. If those systems flag content for possible abuse or misuse, the provider may keep that content for a limited time under its own policy to investigate. It still may not be used for training.

Changes to this Privacy Policy

We may update this Privacy Policy from time to time. When we do, we will change the "Last updated" date above. If a change is material, we will make reasonable efforts to notify you, for example by email or through the Services. We will not apply a change to the AI training commitment to information we collected before the change without your consent.

Collection and use of information

We collect information to provide, operate, secure, and improve the Services. This includes:

• carrying out tasks you ask the assistant to perform
• communicating with you
• providing support
• preventing fraud and abuse
• complying with law

We do not sell your information, and we do not use it for advertising.

Information you provide to us

• Account and contact information, such as your name, email address, and company.
• Requests and instructions you give the assistant, including messages you send to Zebly in Slack or by email, and approvals, edits, and preferences you set.
• Communications with us, such as support requests, feedback, and early-access requests.

Information collected through your use of the Services

Zebly works on your behalf across the tools you connect. Depending on the permissions you grant, the assistant may access and process information from those tools as needed to carry out your requests and keep your work moving. Examples:

• calendars and availability
• email in your connected mailbox, such as Gmail, which Zebly reads to notice meeting requests and follow the replies
• email sent to or from Zebly's own assistant mailbox
• Slack messages in conversations Zebly is part of
• meeting notes and transcripts
• documents, pages, and tasks
• information about the people you ask it to work with

The assistant may also create information: drafts, proposals, summaries, status records, and a history of the actions it takes and the approvals you give.

You control what Zebly can access. For some sources, you can limit access to availability only (for example, busy times from a personal calendar without event details). You can disconnect a source at any time.

Information from Google Workspace

If you connect a Google account, Zebly may access data from Google services such as Google Calendar, Gmail, Google Drive, Docs, Sheets, and Tasks. Which services, and what access, depends on the permissions you grant.

• Purpose: we use Google user data only to provide and improve the user-facing features of the Services that you use.
• No AI training: we do not use information received from Google Workspace APIs to develop, improve, or train generalized AI or machine learning models, and we do not allow anyone else to.
• No transfers for other purposes: we do not transfer or sell Google user data for advertising or any other purpose unrelated to providing the Services.
• Human access: we do not allow humans to read your Google user data, unless you give us permission for a specific item, it is necessary for security, it is required by law, or the data has been aggregated and anonymized for internal operations.

Zebly's use of information received from Google APIs will adhere to Google API Services User Data Policy, including the Limited Use requirements.

You can revoke Zebly's access at any time from your Zebly settings or from your Google Account permissions page.

Information from Slack and other connected services

When you install Zebly in Slack or connect other services (for example Granola, Notion, or Linear), we receive information from those services as permitted by your authorization and by their terms. We handle Slack data under Slack's API terms: we use it only to provide the Services to you, keep it no longer than needed, and never use it to train models.

We are not responsible for the accuracy of information provided to us by third-party services.

Disconnecting stops new access. Disconnecting a service stops Zebly from accessing it going forward. Information already imported may remain until you delete it or it is deleted in the ordinary course. You can ask us to delete imported information at any time.

Information we collect automatically

When you use our website or the Services, we may automatically collect usage and technical information, such as:

• pages viewed and features used
• device and browser information
• IP address and approximate location derived from it
• log data

We use this information to operate, secure, and improve the Services, and to understand how they are used. We use privacy-friendly analytics and do not use advertising trackers.

De-identified and aggregated information

We may create de-identified or aggregated information from the information we collect. We use it to operate and measure the Services, for example to count usage or monitor reliability. We will not attempt to re-identify it, and, during early access, we will not use it or allow it to be used to train AI models.

Cookies

We use cookies and similar technologies that are necessary to sign you in, keep you signed in, and secure the Services. You can block cookies in your browser, but some features may not work correctly. Our website does not currently respond to "Do Not Track" signals.

How we disclose information

We may disclose information:

• To service providers that help us run the Services, such as hosting, databases, email delivery, security, and AI model providers. They may process information only on our instructions and are not permitted to use it to train models. AI model providers don't keep it after processing, except content their safety systems flag for review, as described above.
• To the people and services you direct us to. When the assistant acts for you, for example emailing a participant, messaging a colleague in Slack, or creating a calendar invitation, it shares the information needed for that task within the limits you approve.
• Within your workspace, as needed to coordinate with people you choose to work with through Zebly.
• In a business transfer, such as a merger, acquisition, financing, or sale of assets, subject to this Privacy Policy.
• To professional advisors, such as lawyers and accountants, under confidentiality obligations.
• For legal and safety reasons: to comply with law or legal process, to enforce our terms, or to protect the rights, safety, and security of Zebly, our users, or others.
• With your consent or at your direction.

Data retention

We keep information for as long as reasonably necessary for the purposes described in this Privacy Policy. That means:

• While your account is active and your tasks are in progress, we keep what we need to provide the Services.
• After that, we keep information only as needed to comply with legal obligations, resolve disputes, and enforce our agreements.

We aim to keep only the minimum content needed for active work, and we do not mirror your connected workspaces.

Your choices

• Disconnect any connected service at any time.
• Delete imported information from connected services.
• Delete your account. We will stop work on your behalf and delete your information, except where we are required to keep it. Meetings or messages already sent to others stay with them.
• Contact us to access or correct your information, or to exercise any other rights available to you under applicable law.

Third-party websites and services

The Services may link to or integrate with third-party websites and services that we do not control. Their own privacy policies govern their handling of your information.

Children

The Services are not directed to children, and we do not knowingly collect information from children. If we learn that we have, we will make commercially reasonable efforts to delete it.

Security

We use reasonable technical and organizational measures designed to protect information, including encryption of connection credentials. However, no method of transmission or storage is completely secure.

Risks of an assistant that acts for you:

• Unintended actions: it may take actions you did not intend, such as sending a message or creating an event.
• Misleading content: it may be influenced by misleading content in the messages, emails, or documents it reads.

Zebly is designed to act only within the limits you approve and to ask when it is unsure. Please review what you authorize.

How to contact us

Questions about this Privacy Policy or your information: privacy@zebly.com.

[LEGAL ENTITY], [ADDRESS].