Privacy Policy

1. Who we are

Zoex is an AI employee for direct-to-consumer brands, offered at zoex.ai, at app.zoex.ai, in Slack and by email (the Service). It is provided by Byteex Ltd, Gladstonos 16, 8046 Paphos, Cyprus (“we”, “us”). For any question about this policy or your information, write to [privacy email]. Words with capitals mean what our Terms of Service say they mean.

2. Our two roles

Account data. For information about you as a user of Zoex (your account, your company’s billing, how you use the Service, and this website), we decide why and how it is processed: we are its controller.

Customer Data. When a company connects its store, ad accounts, analytics, Slack and other apps, Zoex processes what it finds there only to do the work that company asks for. For that data the company is the controller and we are its processor, acting on its instructions under our Terms and a data processing agreement, which we sign on request. If you are a shopper at a brand that uses Zoex, or a person in one of its tools, please contact that brand about your information; we help it answer your request.

3. What we collect

Information you give us

• Your name, email address and password when you sign up. The password is held, hashed, by our sign-in provider; we never see it. When you accept our Terms and this policy, we record when.
• Your company’s name, your role, the people you invite, and the access you give them.
• What you write to Zoex, files you attach, recordings you make to teach it, and the notes, rules, skills and pages it keeps for your company.
• Billing details, handled by Stripe, which holds your card details; we never see or store a card number. We keep your plan, credits and invoices.
• What you tell us when you contact us.

Information from the services you connect

• Shopify: products, collections, inventory, orders, discounts, pages and themes. We don’t copy your customers’ personal details into Zoex: where an automation needs a customer’s contact to send something, it reads it live at that moment and keeps it masked in its records.
• Google Ads: accounts, campaigns, search terms, assets, results and settings.
• Google Analytics: reports read live when you ask, and a daily summary of totals.
• Slack: the messages and files in conversations with Zoex and the threads it is asked in; for teammates your company adds, their Slack name, photo and ID; and, for channels your company chose to let Zoex learn from, the notes it takes (not the messages).
• Email: emails sent to the addresses your automations listen on, and replies to emails Zoex sent for you.
• Other apps you connect: what a task needs to read or change there.

Information collected automatically

• A record of the work Zoex does (the steps of each task), so you and we can see what happened and fix mistakes.
• Operational logs with IDs, counts and timings only; never the content of messages, answers or your data.
• IP address, browser and device information for security, including the bot check on sign-in forms.
• Cookies: see section 9.

Public information Zoex reads when asked

When your team asks Zoex to research the market, it reads public sources such as ad libraries, TikTok Shop listings, Reddit threads and public web pages. It looks for brands, products and topics, not for people, and it doesn’t keep the names of the people who wrote them.

4. How we use it

• To provide the Service: answer your questions, do the tasks you ask for and the routines and automations you turn on, and show you what changed.
• To keep it safe: confirm sign-ups, stop abuse and bots, enforce approvals and access rules, and investigate problems.
• To bill you and keep the records the law requires.
• To talk with you: the emails the Service needs (confirmations, invitations, alerts you set up) and answers to your questions. If we ever send news or offers, you can opt out at any time.
• To improve Zoex: we review the steps of tasks to fix mistakes and measure quality, under strict access (for data from Google, only as section 7 allows), and we look at usage figures that don’t identify anyone.

We don’t sell personal information, we don’t use it for advertising, and we don’t use your data to train AI models, ours or anyone else’s. Zoex doesn’t make decisions about people that have legal or similarly significant effects on them.

5. Legal bases (EEA, UK and Switzerland)

• Contract: to provide the Service you signed up for.
• Legitimate interests: to keep the Service secure, prevent abuse, support you and improve the Service, in ways you would expect.
• Legal obligation: tax, accounting and lawful requests.
• Consent: where we ask for it; you can withdraw it at any time.

6. AI providers

Zoex is powered by Anthropic’s Claude models through Anthropic’s commercial API, which does not use your content to train its models. For a few side tasks, Zoex uses other models (from OpenAI, Google or Moonshot AI) through Vercel’s AI Gateway with zero data retention. AI providers receive only what a task needs, while Zoex works on it, and may keep it briefly for security and abuse monitoring under their API terms.

7. Google, Slack and Shopify data

Zoex’s use and transfer of information received from Google APIs adheres to the Google API Services User Data Policy , including its Limited Use requirements. We use Google Ads and Google Analytics data only to provide the features you use in Zoex. We don’t use it for advertising, we don’t sell it, and people at Zoex read it only with your permission, for security, to comply with the law, or, for our own operations, once it is aggregated and anonymised.

We access Slack, Shopify and Google data only after you grant permission, and you can revoke it at any time in those services. Data from Slack, Shopify and Google APIs is never used to develop, improve or train generalised AI or machine-learning models. We honour the customer data and deletion requests Shopify sends us for a store.

8. Who we share it with

We share information only with companies that help us run Zoex, under contracts that limit them to that work and require them to protect it, and with the services you connect, as you direct. The kinds of companies we use:

Kind	What for	What they handle
Hosting and storage	Running the app and keeping its data	Account data, Customer Data
AI model providers	The models Zoex thinks and writes with	What a task needs, while Zoex works on it
Search and memory	Finding the right notes and pages for a task	Text of notes and pages
Integration and computing services	Connecting your other apps; isolated computers for code	What a task reads or changes
Web research services	Reading public pages, ad libraries and forums when you ask	Search words, web addresses
Email delivery	Account emails and emails you ask Zoex to send	Email addresses and content
Payments	Subscriptions, invoices and tax	Billing details
Security, logs and quality	Bot checks, operational logs, quality review	Technical data; task steps for companies that agree

Each one is named on our Subprocessors page. We may also disclose information if the law requires it, to protect people’s safety or our rights, or as part of a merger, financing or sale of our business, in which case this policy keeps applying.

9. Cookies

This website, zoex.ai, sets no cookies and uses no advertising or analytics trackers. The app sets only cookies it needs to work: keeping you signed in, protecting sign-in forms from bots, and remembering simple choices such as a closed sidebar. They don’t need consent, and we don’t use them to track you elsewhere.

10. Where your data is kept

Zoex’s database and app run in the European Union (Frankfurt, Germany). Some of the companies we use, including the AI model providers, process data in the United States or elsewhere. Where the law requires, we rely on safeguards such as the European Commission’s Standard Contractual Clauses and, where available, the EU–U.S. Data Privacy Framework.

11. How long we keep it

• Account data and Customer Data: while your company uses Zoex. When you delete your account (Settings → Profile), we delete it, together with a company you own alone, and release the connected services.
• Records of Zoex’s work: 90 days. Records of automation runs: 7 to 30 days, depending on the kind.
• Sign-ups that are never confirmed: removed after 7 days.
• Billing records: as long as tax law requires.
• Backups: overwritten on a rolling schedule after deletion.

12. How we protect it

Data is encrypted in transit, and the keys to your connected services are encrypted at rest. Access inside your company follows the roles and access you set, down to a single ad account. Zoex changes nothing in your store or ad accounts without the approvals your company chose, keeps the values from before so changes can be undone, and treats anything it reads from outside (emails, web pages, reviews) as information, never as instructions. If a security incident affects your personal information, we tell you and, where required, the authorities, without undue delay. More on our Security page.

13. Your rights

Depending on where you live, you may ask to access, correct, delete or receive a copy of your personal information, to object to or restrict how we use it, and to withdraw consent. Write to [privacy email]; we answer within 30 days, and may need to confirm it is you. You can also delete your account yourself in Settings → Profile. An authorised agent may ask for you, with your written permission. If you are in the EEA, the UK or Switzerland, you may complain to your data protection authority. Ours is the Commissioner for Personal Data Protection in Cyprus (dataprotection.gov.cy).

U.S. state privacy laws: we don’t sell or share personal information for cross-context behavioural advertising, we don’t use sensitive personal information to infer characteristics about you, and we won’t treat you differently for using your rights.

14. Children

Zoex is a service for businesses and isn’t meant for anyone under 18.

15. Changes

If we change this policy in a way that matters, we tell account owners by email or in the app before the change takes effect. The date at the top shows when it last changed.

16. Contact

Byteex Ltd, Gladstonos 16, 8046 Paphos, Cyprus. Email [privacy email].