Privacy Policy
Last updated: 27 September 2026
The short version
Zedata stores the contacts and deals you put into it. The browser extension reads profile pages you deliberately open, and nothing else. Zedata does not message anyone, does not browse on your behalf, and does not sell data to anyone.
What we collect
- Your account: name, email address, whether that address has been confirmed, and when you last signed in. Email is how you sign in, so we cannot operate without it.
- Your CRM data: contacts, companies, deals, pipelines, notes and tasks that you create or capture.
- Captured profile data: when you click “Add to Zedata” on a profile page, the name, headline, job title, employer, location, profile photo URL and profile URL shown on that page.
- Connection state: which social account your extension is signed in as, and when it last checked in.
What we never do
- We never see or store your social network passwords. The extension uses the session already in your browser.
- We never send messages, connection requests, follows or comments.
- We never crawl, scrape in bulk, or read profiles you did not open yourself.
- We never sell personal data, and we do not use your CRM data to train AI models.
The browser extension
The extension runs only on the social networks it supports. It reads a page only when you click “Add to Zedata”, and it sends that profile data to your own Zedata workspace over an encrypted connection, authenticated with a key scoped to that workspace. You can revoke that key at any time under Settings → API keys, which immediately stops the extension working.
On LinkedIn the extension also reads one cookie, JSESSIONID, because LinkedIn's own interface requires that value echoed back as a header before it will answer a request from your signed-in session. It is used to build that header and is never stored, logged, or sent to us or anyone else.
AI processing
If your workspace has AI extraction enabled, the visible text of a profile page you capture is sent to OpenAI to pull out the name, job title and employer. It is capped at roughly 6,000 characters, is not used to train their models under their API terms, and is not retained by Zedata beyond the fields you save. If AI extraction is not configured, this never happens.
Third parties who process data for us
- Google (Firebase): hosting, authentication, database and email delivery for sign-in messages such as address confirmation and password resets. Data is stored in Google Cloud.
- OpenAI: only if AI extraction is enabled, and only for the page text described above.
We do not use advertising networks, session recording, or third-party analytics that identify you.
Where the data lives and how long we keep it
Your data is kept as long as your account is open. Delete a workspace and its contacts, companies and deals are permanently removed. Delete your agency and everything goes with it. Neither is recoverable, so export first if you may want it back.
Your rights
You can export everything Zedata holds for your agency as a JSON file at any time from Settings → Data & privacy, and you can delete your agency permanently from the same place. If you are in the UK, EU or California you also have rights to access, correct, restrict and object to processing — the export and delete controls cover most of these directly, and you can contact us for anything they do not.
People whose profiles you capture
When you capture someone into your CRM, you become the data controller for that record and Zedata processes it on your behalf. You are responsible for having a lawful basis to hold it, and for responding if that person asks to see or delete their data. Zedata gives you the tools to find and delete any contact.
This matters more than it sounds: the people in your CRM did not sign up for Zedata and have not agreed to anything. Capture people you have a genuine business reason to contact, and delete a record when someone asks you to.
Contact
Questions about this policy, or a request about your data: privacy@zedata.app.