Privacy Policy
Last updated: 2 November 2026
Zenntic is committed to protecting your privacy. This Privacy Policy explains how we collect, use, and protect information when you visit zenntic.com, use the free website check or our chat, use our services, and when you chat with the Zenntic Assistant on the website of a business that uses it. It also explains what we do with the details of businesses that we find through public sources, for LeadFinder and for our own sales.
1. Who We Are
Zenntic is V.O.F. Zenntic (a Dutch general partnership), registered with the Dutch Chamber of Commerce (KvK) under number 42182452, VAT number NL870077065B01, based in Groningen, the Netherlands. We offer three services:
- Email Sorter — connects to your Gmail or Outlook inbox to sort, categorise, and draft replies to your emails
- Assistant — a digital assistant a business places on its website and other channels, which answers visitors, takes messages, records sales enquiries, and can book appointments in the business's calendar
- LeadFinder — finds businesses that fit what you sell, using public business listings and websites
Zenntic is the controller for the processing described in this policy, except where we say that we process data on behalf of a business that uses our services (sections 3 and 4). In those cases that business is the controller and Zenntic is its processor, under our Data Processing Agreement.
For questions about this policy, contact us at [email protected].
2. At a Glance: What, Why, and for How Long
The table below lists every way we use personal data, the legal ground for it under the GDPR, and how long we keep it. The sections after it explain each in more detail.
| What we do | Legal ground (GDPR art. 6) | How long |
|---|---|---|
| Your account and the tools you use (section 5) | Contract | As long as your account exists. An account whose email address is not confirmed, and that bought nothing, is deleted after 30 days. |
| Confirming your email address and protecting sign-up against abuse | Contract; legitimate interest in preventing fake accounts | The confirmation link works for 7 days |
| Payments and bookkeeping | Contract; legal obligation | 7 years, as Dutch tax law requires (kept by Stripe and in our accounts) |
| Email Sorter and Assistant (sections 3 and 4) | Contract with the business; for the people in its mailbox or chat, we act as processor for that business | As set out in sections 3, 4, and 13 |
| The free website check (section 6) | Legitimate interest in offering the check; for a requested plan, your request | 12 months after the last activity |
| The chat on zenntic.com (section 7) | Legitimate interest in answering your questions; your request | 30 days |
| LeadFinder results (section 8) | Legitimate interest of our customers and us in finding business customers | 12 months |
| Our own sales emails to businesses (section 9) | Legitimate interest in offering our services to businesses | 12 months if we did not mail; 24 months after a mail; if you ask us not to mail you, we keep only what is needed to never mail you again |
| Security, abuse prevention, and fixing errors | Legitimate interest | IP addresses for rate limits are kept in memory only and forgotten within an hour; server logs are deleted after 30 days |
Where we rely on legitimate interest, we have weighed it against your interests, and you can object at any time (section 14). Giving us your data is not required by law. Without the data in section 5 we cannot create an account for you.
3. Email Sorter: Mailbox Access
The Email Sorter connects to one mailbox per account, either Gmail or Outlook. In both cases the connection is made through the provider's own sign-in screen, which shows you exactly what you are granting before you agree. Zenntic never asks for, receives, or stores your mailbox password.
Zenntic does not send email on your behalf, and it never deletes your messages. This is true for both providers. The permissions below would technically allow moving a message to the trash (Gmail) or deleting it (Outlook); Zenntic does not use them for that.
Gmail
Zenntic connects to your Gmail account using Google OAuth. We request one scope, and nothing beyond it:
| Scope | What it allows | What Zenntic does with it |
|---|---|---|
gmail.modify |
Read messages, change their labels, create labels and drafts, and send email. It does not allow permanently deleting messages. | Read an incoming message so it can be categorised, create the category labels and apply the one that records the outcome, and place a suggested reply in your drafts folder |
Google offers no narrower scope that allows both labelling and drafts, so this scope technically also allows sending email. Zenntic does not use it to send anything. We are telling you this because the Google consent screen describes the scope in broad terms, and you are entitled to know what the software actually does with it.
You can withdraw Zenntic's access at any time at myaccount.google.com/permissions.
Outlook
Zenntic connects to your Outlook mailbox using Microsoft Graph. We request the following permissions, and nothing beyond them:
| Permission | What it allows | Why Zenntic needs it |
|---|---|---|
offline_access |
Keep the connection working without asking you to sign in again | So sorting continues on a schedule rather than only while you happen to be signed in |
User.Read |
Read your basic profile | To read back which mailbox address was connected, so it can be shown to you |
Mail.ReadWrite |
Read messages, change their categories, create folders, move messages between folders, and create drafts | To read an incoming message so it can be categorised, to create the folders Zenntic sorts your mail into and move the message to the right one, to apply the categories for urgent and processed mail, and to place a suggested reply in your drafts |
MailboxSettings.ReadWrite |
Read and change your mailbox settings | Outlook keeps the list of available categories in your mailbox settings, so this is the only permission that allows Zenntic to create the categories it sorts your mail into |
One point about the last permission deserves to be stated plainly rather than left in the small print. Microsoft does not offer a narrower permission for the category list, so granting it also technically covers other mailbox settings: your automatic replies, working hours, time zone, language, date and time format, archive folder, mailbox type, and how meeting messages are delivered to delegates.
Zenntic does not read or change any of those. The only thing it touches is the category list.
You can withdraw Zenntic's access at any time. For a personal Microsoft account this is at account.live.com/consent/Manage; for a work or school account it is in the My Apps portal at myapps.microsoft.com.
Withdrawing access, with either provider, stops all further processing immediately.
Using what your Assistant knows
If the same zenntic.com account also uses the Assistant, the Email Sorter asks the Assistant what it knows about your business before it drafts a reply: the details entered on the Assistant page, such as opening hours and prices, and the parts of the Assistant's information that best match the message. To find those parts, the subject and the first 2,000 characters of the message are sent to the Assistant, which uses the Google Gemini API to search the business's own information. The message text is used only for that search. The Assistant does not store it.
When the Assistant already answers the email of this mailbox itself, the Email Sorter places no suggested reply, so the sender does not get two answers. Messages from addresses that cannot receive a reply, such as no-reply addresses, get no suggested reply either.
The messages in a connected mailbox contain personal data of the people who write to the mailbox owner. For that data, the business that connected the mailbox is the controller and Zenntic is its processor, under the Data Processing Agreement.
4. Assistant
Who is responsible for what
A business that uses the Assistant decides to place it on its website or other channels, and decides what it is used for. For the conversations its visitors have with the Assistant, that business is the controller and Zenntic is its processor: we process that data on the business's behalf and on its instructions, under the Data Processing Agreement. For the business owner's own Zenntic account, settings, and calendar connection, Zenntic is the controller.
If you chatted with the Assistant on a business's website and have a question about your data, you can contact that business or us. We will make sure it is handled.
What data the Assistant processes
| Data | Why |
|---|---|
| Messages a visitor types in the chat or sends by email or WhatsApp, and the Assistant's replies | To answer the visitor and to let the business read the conversation back |
| Name, email address, and phone number, only if the visitor gives them. On WhatsApp, the visitor's phone number and WhatsApp profile name come with every message | So the business can contact the visitor or confirm an appointment |
| Messages for the business (for example a request to be called back) and sales enquiries, with what the visitor said they need | So the business can follow up; it sees these in its own dashboard and by email |
| Appointment details: date, time, and what it is about | To book the appointment the visitor asked for |
| Jobs under way, if the business uses Projects: the name or address of the job, the client it belongs to, a reference number, a status and background the business writes, and the messages about the job | So the business can keep track of work for its clients, and the Assistant can tell a client how their job is going |
| The business's own information: what it fills in on its Assistant page, opening hours, settings, and the pages of its website it chooses to have read | So the Assistant can answer questions about the business |
| Calendar data of the business owner, when connected (see below) | To offer free times and book appointments |
| Technical data: the time of a request, the website the chat runs on, the visitor's IP address for rate limiting, and error logs | Security, abuse prevention, and fixing problems |
We do not use this data for advertising, we do not sell it, and we do not build profiles of visitors.
Jobs under way
A business that uses Projects can record work it is doing for its clients, such as a renovation, with a short status. The Assistant tells that status to the client the job belongs to, recognised by the phone number or email address they get in touch with, or to anyone who gives the reference number the business gave its client. A reference number works like a parcel tracking code, so the business should treat it the same way. To stop guessing, the Assistant stops looking up references after a few wrong ones; we record when that happens and in which conversation, but not what was typed.
The business can also write background for the Assistant, such as what was agreed. The Assistant uses it to understand the client. It does not read it out and makes no promises based on it. Like the rest of a conversation, it is sent to the AI model that writes the Assistant's replies.
Google and Microsoft calendar access
When a business owner connects a calendar, the connection is made through Google's or Microsoft's own sign-in screen. The Assistant asks for the narrowest access that does the job:
| Provider | Scope or permission | What Zenntic does with it |
|---|---|---|
calendar.freebusy |
See which times are busy, to offer only times that are free. This shows whether a time is taken, not what an appointment is about. | |
calendar.events |
Put an appointment a visitor booked into the calendar, move that same appointment when the visitor asks, and check that an appointment the Assistant made still exists | |
openid, email |
Read which Google account was connected, so it can be shown to the business owner | |
| Microsoft | Calendars.ReadWrite (or Calendars.Read when booking is not allowed) |
The same as the two Google scopes above: free and busy times, and the appointments the Assistant books |
| Microsoft | offline_access, openid, email |
Keep the connection working without signing in again, and read which account was connected |
Calendar data is used only to provide these features to the business that connected the calendar. People at Zenntic do not read calendar data, unless the business owner asks us to help, it is needed for security, or the law requires it.
The business owner can disconnect at any time at myaccount.google.com/permissions (Google) or myapps.microsoft.com (Microsoft), or by asking us.
Google and Microsoft mailbox access for sending
A business owner can also connect their own Gmail or Outlook mailbox, so the Assistant sends its email replies and appointment emails from the business's own address instead of from Zenntic's. This is a separate connection from the calendar, and it only allows sending:
| Provider | Scope or permission | What Zenntic does with it |
|---|---|---|
gmail.send |
Send the Assistant's reply to a visitor who emailed the business, and the confirmation, change, cancellation and reminder emails for appointments a visitor booked. Nothing else is sent. This permission does not allow reading, searching or deleting any email. | |
openid, email |
Read which address was connected, so the emails can be sent from it and it can be shown to the business owner | |
| Microsoft | Mail.Send |
The same as gmail.send above |
| Microsoft | offline_access, openid, email |
Keep the connection working without signing in again, and read which address was connected |
The emails the Assistant sends this way appear in the Sent folder of the business owner's mailbox. If the connection stops working, the Assistant sends from Zenntic's address until the business owner connects again. The business owner can disconnect on the Assistant page, or at the addresses above.
A business can let the Assistant answer messages to its WhatsApp number. The business connects its own WhatsApp Business account in a sign-in window of Meta on its Assistant page, or Zenntic connects a number with the business. Either way the messages go through Meta's WhatsApp Business Platform: Meta delivers each message to Zenntic, and the Assistant's reply goes back through Meta. Meta processes these messages under its own WhatsApp Business terms.
When the business connects its own account, Meta gives Zenntic an access token for that account. We store it encrypted and use it only to send the Assistant's replies, to mark messages as read, and to register the number and the connection with our app. We use it for nothing else. The business can disconnect on its Assistant page, which also removes our app from its WhatsApp account, or in its Meta Business settings.
How long the Assistant keeps data
Each business chooses on its Assistant page how long conversations are kept, between 30 days and 10 years. Conversations, messages, and contact details older than that are deleted automatically. Jobs under way are the business's own records and are not deleted with that period; a contact stays as long as a job belongs to them. If a business has not chosen a period, data stays until the business deletes it or ends the service. We delete a person's data on request (see section 14).
5. What Data We Collect About Account Holders
Account data
When you create an account on zenntic.com, we store your name, email address, a hash of your password, and which tools you use. When you connect a mailbox for the Email Sorter, we also store the mailbox address, which provider it belongs to, and an OAuth refresh token that allows us to access that mailbox on your behalf.
When you sign up, we send a link to confirm your email address, and we record when you agreed to our Terms and which version. You can download a copy of your account data, and delete your account, yourself under Account & data in your dashboard.
Email data (Email Sorter)
For each message the Email Sorter processes, we store:
- the message and thread identifier assigned by your mail provider
- the sender address and the subject
- the time the message was received
- the labels or categories that were applied
- the output of our processing: category, urgency, a short summary, the reasoning behind the categorisation, and a suggested reply
We do not store the body text of your messages in our database: it is read to categorise the message and draft a reply, and then discarded. We also do not store your mailbox password or your attachments. When a processing run fails, our workflow service keeps a record of that run, which can include the message, for a limited time so the error can be fixed.
Payment data
Payment is processed by Stripe. We do not store your card details. We receive confirmation of payment and your subscription status from Stripe.
6. The Free Website Check
When you check a website with our free website check, we store the address you entered and the results, so you can read them and so we can see how the check is used. We do not store your IP address; it is used only in memory to limit how often one connection can run the check.
If you ask us for a plan, we also store your name (if you give it) and email address, and use them only to send you that plan and follow up on it. We delete checks and contact requests 12 months after the last activity.
7. The Chat on zenntic.com
The chat on zenntic.com is our own Assistant, and on our website Zenntic is its controller. It is an AI assistant, and it says so. What you type, and any contact details you give, are processed as described in section 4 and kept for 30 days. The chat places no cookies; it keeps the current conversation in your browser tab until you close it.
8. LeadFinder: Businesses in Our Results
LeadFinder helps our customers find businesses that could use what they sell. When a customer searches, we look up businesses in Google Places and read the public website of each business. A result contains the business name, address, phone number, website, rating and number of reviews, and, when the website shows one, a business email address. For a sole trader or partnership, some of this can be personal data.
We compile these results, so we are the controller for them, on the ground of the legitimate interest of our customers and us in finding business customers. The customer who searched decides whether and how to contact a business, and is the controller for that. Our Terms require customers to follow the law when they do, including the Dutch rules on unsolicited email. We keep results for 12 months.
Are you listed in our results and do you not want to be? Email [email protected]. We delete the results that mention you.
9. Our Own Sales Emails
Zenntic looks for businesses that could use the Email Sorter, in the same public sources: Google Places and the business's own website. We check whether the business's email runs on Gmail or Outlook (from public DNS records), whether its website shows a shared inbox such as info@, and how busy it seems from its public Google reviews. An AI model drafts a first email, which one of the founders reads, edits, and sends personally. Nothing is sent automatically.
We only send such an unsolicited email to companies (such as a BV or NV), not to sole traders or partnerships unless they asked for it. Every email says where we found the business and offers an easy way to stop. If you ask us not to email you, we never do again. To make sure of that, we keep only your business name, website, and email address on a do-not-mail list. Otherwise we keep this data for 12 months if we did not email you, and for 24 months after we did. This processing is based on our legitimate interest in offering our services to businesses; you can object at any time.
10. How We Use Your Data
We use the data of account holders exclusively to:
- provide the tools you use: sorting your email, running your Assistant, and finding leads
- generate draft replies and Assistant answers using AI
- show you what happened, such as processing results, conversations, messages, and leads
- handle payments and support
- email you about your account and our service, such as confirming your address or changes to these terms
We do not send account holders newsletters or marketing email. The data of businesses we find through public sources is used only as described in sections 8 and 9.
We do not sell your data, we do not use it for advertising, and we do not share it with third parties beyond what is described in this policy.
11. Limited Use
Zenntic's use and transfer of information received from Google APIs to any other app will adhere to the Google API Services User Data Policy, including the Limited Use requirements. This applies to Gmail data for the Email Sorter, and to calendar data and the sending of email for the Assistant.
Specifically:
- We do not use your Google user data for advertising, and we do not build advertising profiles from it.
- We do not use your Google user data to train generalised artificial intelligence or machine learning models.
- No Zenntic personnel reads your messages or calendar, except where you have given explicit consent, where it is necessary for security purposes such as investigating abuse, or where we are required to do so by law.
12. Third Parties We Work With
| Service | Purpose | Used for | Privacy Policy |
|---|---|---|---|
| Google / Gmail API | Mailbox access via OAuth, for Gmail customers | Email Sorter | google.com/privacy |
| Microsoft Graph | Mailbox access via OAuth, for Outlook customers | Email Sorter | privacy.microsoft.com |
| Google Calendar, Microsoft 365 | The business owner's calendar, when connected | Assistant | As above |
| Gmail API, Microsoft Graph | Sending email from the business owner's own mailbox, when connected | Assistant | As above |
| Google Gemini API | AI categorisation and reply drafting; searching a business's own information | Email Sorter, Assistant | google.com/privacy |
| Anthropic | The AI model that writes the Assistant's replies, and LeadFinder's descriptions | Assistant, LeadFinder | anthropic.com/legal/privacy |
| Meta (WhatsApp Business Platform) | Delivering WhatsApp messages to and from the Assistant, for businesses that connect WhatsApp | Assistant | whatsapp.com/legal |
| Resend | Sending and receiving email for the Assistant, such as messages to the business | Assistant | resend.com/legal/privacy-policy |
| Google Places | Public business listings | LeadFinder | google.com/privacy |
| Supabase | Database for tokens, processing records, and Assistant data (Ireland) | Email Sorter, Assistant | supabase.com/privacy |
| Render | Backend hosting | Email Sorter, Assistant | render.com/privacy |
| n8n | Workflow automation that moves messages between the services above | Email Sorter | n8n.io/legal/privacy |
| Stripe | Payment processing | All tools | stripe.com/privacy |
Phone is not yet switched on for any business. When it is, Vapi will process those calls as well. We will add it to this list before that happens.
The subject and body of emails processed by the Email Sorter are sent to the Google Gemini API for the single purpose of categorising the message and drafting a suggested reply, and, when the account also uses the Assistant, to search that business's own information for the reply (section 3). Google does not use data submitted to the paid Gemini API to train its models.
zenntic.com itself runs on our own server in the Netherlands. In addition:
- Cloudflare carries all traffic to zenntic.com and protects it against attacks. It sees your IP address and the pages you request, and does not use them for its own purposes (cloudflare.com/privacypolicy).
- Google Workspace handles our own email, including the email that confirms your address and our replies to you (policies.google.com/privacy).
- Anthropic and Google Places are also used for our own sales emails (section 9): to look up businesses and draft the first email.
Several of these providers are based in the United States. Where data goes outside the European Economic Area, we rely on an adequacy decision of the European Commission, in particular the EU–US Data Privacy Framework for providers certified under it, and otherwise on the EU Standard Contractual Clauses.
13. Data Retention
- OAuth tokens — stored for as long as the connection is active. Deleted when you disconnect your mailbox, calendar or WhatsApp, and, for the Email Sorter, within a day after the period you paid for has ended once you cancel.
- Processed email records — 90 days after the message was processed. Deleted sooner: within a day after you disconnect your mailbox or after the paid period of a cancelled Email Sorter subscription has ended, on request, and when you ask us to delete your account.
- Assistant conversations, messages, and contact details — for the period the business chose, as described in section 4.
- Jobs under way (Projects) — until the business ends the service, or until the person they are about asks us to delete their data. Deleting a person's data also deletes the jobs that belong to them.
- Account data — for as long as your account exists. An account whose email address is never confirmed, and that bought nothing, is deleted after 30 days. When you delete your account, it is removed from zenntic.com at once, and from the Email Sorter and the Assistant within 30 days.
- Website checks and contact requests — 12 months after the last activity.
- LeadFinder searches and results — 12 months.
- Businesses in our own sales — 12 months if we did not email them, 24 months after we did; a do-not-mail entry for as long as needed to respect it.
- Payment records — retained as required by Dutch tax law (7 years).
14. Your Rights (GDPR)
As a person in the EU, you have the right to:
- Access — request a copy of the data we hold about you
- Deletion — request deletion of your account or your data
- Correction — request correction of inaccurate data
- Portability — receive your data in a portable format
- Restriction — ask us to stop using your data for a while, for example while we check a correction
- Objection — object to processing based on legitimate interest. You can always object to our sales emails; we then stop at once, without needing a reason.
- Withdraw consent — disconnect your mailbox or calendar at any time
This also applies if you chatted with the Assistant on a business's website. Account holders can download their data and delete their account themselves under Account & data. For anything else, contact us at [email protected]. We will respond within one month. We do not take decisions about you based solely on automated processing that have legal or similarly significant effects; the scores in LeadFinder and in our own sales only help a person decide whom to contact. You can also complain to the Dutch Data Protection Authority (Autoriteit Persoonsgegevens).
15. Security
We protect your data using:
- AES-256-GCM encryption of mailbox and calendar refresh tokens before they are written to our database, cryptographically bound to the account they belong to so that a stored token cannot be reused against another account
- HTTPS for all data in transit
- Row-level security on our databases, so that only our backend can reach your data
- A separate key between zenntic.com and the Assistant's backend, which never reaches the browser; each business only sees its own Assistant's data
- Limits per visitor and per business on the Assistant, against abuse
- No storage of mailbox passwords — only OAuth tokens, which you can revoke at any time
16. Cookies and Storage
Zenntic.com uses only essential cookies: one to keep you logged in and one to remember your language. Our network provider Cloudflare may place a strictly necessary security cookie to tell people from bots. We do not use analytics, tracking, or advertising cookies, and we load no fonts or scripts from Google. Because these cookies are strictly necessary, we do not ask for consent.
The Assistant's chat on a business's website places no cookies. It keeps the current conversation in the browser tab (session storage), so it survives moving to another page of that website; it is gone when the tab closes.
17. Changes to This Policy
We may update this policy from time to time. We will notify account holders of significant changes by email. The date at the top shows when this policy last changed.
18. Contact
For privacy-related questions or requests:
Email: [email protected]
Zenntic, Groningen, the Netherlands
Website: zenntic.com