> ## Documentation Index
> Fetch the complete documentation index at: https://reedai-07fa30f1.mintlify.site/llms.txt
> Use this file to discover all available pages before exploring further.

# Data Privacy and Compliance

> Understand how ZeroTwo handles your data, protects your privacy, and complies with regulations

ZeroTwo is committed to protecting your privacy and ensuring your data is handled securely and transparently. This guide explains how we collect, use, store, and protect your information.

## Data collection and use

### What data we collect

ZeroTwo collects only the data necessary to provide and improve our services:

<AccordionGroup>
  <Accordion title="Account information">
    **Collected during signup:**

    * Email address
    * Name (optional display name)
    * Password (encrypted, never stored in plain text)
    * Authentication tokens

    **Purpose**: Account creation, authentication, and communication

    **Retention**: Duration of account existence
  </Accordion>

  <Accordion title="Conversation data">
    **Includes:**

    * Your messages and prompts
    * AI model responses
    * Conversation metadata (timestamps, model used)
    * File attachments and uploads

    **Purpose**: Provide AI responses, maintain conversation context, enable features like conversation history

    **Retention**: Until you delete conversations or close your account
  </Accordion>

  <Accordion title="Memory data">
    **Includes:**

    * Extracted biographical information
    * Project contexts and preferences
    * Technical preferences and patterns
    * See [How Memory Works](/memory/how-memory-works)

    **Purpose**: Personalize AI responses across conversations

    **Retention**: Until you modify or delete, or close your account
  </Accordion>

  <Accordion title="Usage data">
    **Includes:**

    * Feature usage patterns
    * Performance metrics
    * Error logs and debugging information
    * API call frequencies

    **Purpose**: Improve service performance, identify issues, optimize features

    **Retention**: Aggregated anonymously after 90 days
  </Accordion>

  <Accordion title="Payment information">
    **Includes (if subscribed):**

    * Payment method details (securely stored by payment processor)
    * Billing address
    * Transaction history

    **Purpose**: Process payments and maintain subscription

    **Retention**: Required duration for financial record-keeping (typically 7 years)

    <Info>
      ZeroTwo uses Stripe for payment processing. Credit card details are never stored on ZeroTwo servers—they're handled entirely by Stripe's PCI-compliant infrastructure.
    </Info>
  </Accordion>
</AccordionGroup>

### What data we don't collect

<Check>
  **ZeroTwo does NOT collect:**

  * Passwords in plain text (all encrypted)
  * Payment card details (handled by Stripe)
  * Content of private or deleted conversations
  * Biometric information
  * Location data beyond general timezone
  * Browsing history outside ZeroTwo
  * Social media activity or personal communications
</Check>

## How your data is used

### Primary uses

<Tabs>
  <Tab title="Service delivery">
    **To provide ZeroTwo's core functionality:**

    * Process your prompts with AI models
    * Generate and display responses
    * Maintain conversation context and history
    * Provide Memory and personalization features
    * Enable file uploads and processing
    * Support collaboration in team workspaces
  </Tab>

  <Tab title="Personalization">
    **To improve your experience:**

    * Remember your preferences and settings
    * Maintain Memory for contextual awareness
    * Customize interface based on your usage
    * Provide relevant suggestions and assistance
  </Tab>

  <Tab title="Service improvement">
    **To enhance ZeroTwo:**

    * Analyze feature usage (aggregated, anonymized)
    * Identify and fix bugs
    * Optimize performance
    * Develop new features based on usage patterns
    * Improve AI response quality
  </Tab>

  <Tab title="Communication">
    **To keep you informed:**

    * Send important account notifications
    * Provide subscription and billing updates
    * Share product updates and new features
    * Respond to support requests

    You can opt out of non-essential communications in settings.
  </Tab>
</Tabs>

### What we don't do with your data

<Warning>
  **ZeroTwo will NEVER:**

  * ❌ Sell your personal data to third parties
  * ❌ Use your conversations to train AI models without explicit consent
  * ❌ Share your data with advertisers
  * ❌ Read your private conversations unless required for support (with your permission)
  * ❌ Use your data for purposes beyond providing our service
  * ❌ Share data with AI model providers beyond what's necessary for generating responses
</Warning>

## Data storage and security

### Storage infrastructure

<ResponseField name="Encryption" type="security">
  **At rest**: All data encrypted using AES-256 encryption
  **In transit**: All connections use TLS 1.3 encryption
  **Backups**: Encrypted backups stored in geographically distributed locations
</ResponseField>

<ResponseField name="Database security" type="infrastructure">
  **Provider**: Supabase (PostgreSQL) with enterprise security
  **Access**: Role-based access control, minimal privilege principle
  **Monitoring**: 24/7 security monitoring and intrusion detection
  **Compliance**: SOC 2 Type II certified infrastructure
</ResponseField>

<ResponseField name="File storage" type="infrastructure">
  **Provider**: Secure cloud storage with encryption
  **Access control**: Per-user access controls, signed URLs for temporary access
  **Scanning**: Automated malware and virus scanning on uploads
  **Retention**: Files retained according to your conversation retention settings
</ResponseField>

### Data isolation

<Info>
  **User data isolation:**

  * Your conversations are isolated to your account
  * Team data is isolated to your team workspace
  * No cross-user data access or sharing
  * Strict database-level access controls
  * Regular security audits
</Info>

### Security measures

<Steps>
  <Step title="Authentication">
    * Secure password hashing (bcrypt with high cost factor)
    * Optional two-factor authentication (2FA)
    * Session management with secure tokens
    * Automatic session expiration
  </Step>

  <Step title="Authorization">
    * Role-based access control (RBAC)
    * Granular permissions for team features
    * Principle of least privilege
    * Regular permission audits
  </Step>

  <Step title="Infrastructure">
    * DDoS protection
    * Web application firewall (WAF)
    * Regular security patching
    * Penetration testing
    * Incident response procedures
  </Step>

  <Step title="Monitoring">
    * 24/7 security monitoring
    * Automated threat detection
    * Audit logging of all access
    * Real-time alerts for suspicious activity
  </Step>
</Steps>

## Compliance and regulations

### GDPR (General Data Protection Regulation)

ZeroTwo is GDPR-compliant for users in the European Union:

<AccordionGroup>
  <Accordion title="Your GDPR rights">
    **Right to access**: Request a copy of all your personal data

    **Right to rectification**: Correct inaccurate or incomplete data

    **Right to erasure**: Request deletion of your personal data ("right to be forgotten")

    **Right to data portability**: Export your data in machine-readable format

    **Right to object**: Object to certain types of data processing

    **Right to restriction**: Limit how we process your data
  </Accordion>

  <Accordion title="Exercising GDPR rights">
    To exercise any GDPR rights:

    1. Email: [reed@zerotwo.ai](mailto:reed@zerotwo.ai)
    2. Specify which right(s) you're exercising
    3. We'll respond within 30 days
    4. Identity verification may be required

    Or use in-app tools:

    * Export data: Settings → Data Export
    * Delete data: Settings → Delete Account
    * Modify data: Settings → Memory Management
  </Accordion>

  <Accordion title="Legal basis for processing">
    We process your data based on:

    * **Contract performance**: Necessary to provide ZeroTwo services
    * **Legitimate interest**: Service improvement and security
    * **Consent**: Optional features (you can withdraw anytime)
    * **Legal obligation**: Compliance with laws and regulations
  </Accordion>
</AccordionGroup>

### CCPA (California Consumer Privacy Act)

For California residents:

<ResponseField name="Right to know" type="right">
  You have the right to know what personal information we collect, use, and share.
</ResponseField>

<ResponseField name="Right to delete" type="right">
  You can request deletion of your personal information.
</ResponseField>

<ResponseField name="Right to opt-out" type="right">
  Opt out of the sale of personal information (note: we don't sell personal information).
</ResponseField>

<ResponseField name="Right to non-discrimination" type="right">
  We won't discriminate against you for exercising your privacy rights.
</ResponseField>

### Other compliance frameworks

<CardGroup cols={2}>
  <Card title="SOC 2 Type II" icon="shield-check">
    Our infrastructure providers are SOC 2 Type II certified, ensuring security, availability, and confidentiality.
  </Card>

  <Card title="HIPAA considerations" icon="hospital">
    ZeroTwo is not HIPAA-compliant. Do not enter protected health information (PHI) in conversations.
  </Card>

  <Card title="PCI DSS" icon="credit-card">
    Payment processing compliant through Stripe's PCI DSS Level 1 certification.
  </Card>

  <Card title="ISO 27001" icon="certificate">
    Our infrastructure follows ISO 27001 information security standards.
  </Card>
</CardGroup>

## Data sharing and third parties

### Service providers

We share minimal data with trusted service providers:

<Tabs>
  <Tab title="AI model providers">
    **Who**: OpenAI, Anthropic, Google, etc.

    **What we share**: Your prompts and conversation context

    **Purpose**: Generate AI responses

    **Protection**:

    * No data used for model training (per agreements)
    * Encrypted transmission
    * Minimal data retention by providers
    * No personally identifiable information unless you include it

    <Warning>
      Be cautious about including sensitive information in prompts, as it's sent to AI model providers to generate responses.
    </Warning>
  </Tab>

  <Tab title="Infrastructure providers">
    **Who**: Supabase, Vercel, AWS

    **What we share**: Necessary data for service operation

    **Purpose**: Host and deliver ZeroTwo services

    **Protection**:

    * All providers are enterprise-grade with strong security
    * Data processing agreements (DPAs) in place
    * GDPR and SOC 2 compliant
    * Encrypted storage and transmission
  </Tab>

  <Tab title="Payment processor">
    **Who**: Stripe

    **What we share**: Billing information, transaction details

    **Purpose**: Process payments and manage subscriptions

    **Protection**:

    * PCI DSS Level 1 compliant
    * No card details stored on ZeroTwo servers
    * Stripe's comprehensive security measures
  </Tab>

  <Tab title="Analytics (optional)">
    **Who**: Analytics service providers

    **What we share**: Anonymized usage data only

    **Purpose**: Understand feature usage and improve UX

    **Protection**:

    * No personally identifiable information
    * Aggregated and anonymized
    * Can be opted out in settings
  </Tab>
</Tabs>

### We don't share with

<Check>
  **Zero sharing with:**

  * Advertisers or marketing companies
  * Data brokers
  * Social media platforms
  * Third-party AI model training (without consent)
  * Any party for purposes beyond service delivery
</Check>

## Your privacy controls

### In-app privacy settings

<Steps>
  <Step title="Access privacy settings">
    Navigate to Settings → Privacy & Data in ZeroTwo.
  </Step>

  <Step title="Control data collection">
    **Options:**

    * Enable/disable Memory
    * Control conversation history retention
    * Manage file upload privacy
    * Set data sharing preferences
    * Configure analytics opt-in/out
  </Step>

  <Step title="Review permissions">
    **Team settings:**

    * Control what team members can see
    * Manage shared conversation visibility
    * Set team Memory permissions
  </Step>

  <Step title="Configure communications">
    **Email preferences:**

    * Essential notifications (required)
    * Product updates (optional)
    * Marketing communications (optional)
    * Security alerts (recommended)
  </Step>
</Steps>

### Data retention controls

<Tabs>
  <Tab title="Conversations">
    **Options:**

    * Keep indefinitely (default)
    * Auto-delete after 30/60/90 days
    * Manual deletion anytime
    * Bulk deletion by date range

    Set in: Settings → Data Retention → Conversations
  </Tab>

  <Tab title="Memory">
    **Options:**

    * Keep and update automatically (default)
    * Disable Memory entirely
    * Manual management of memories
    * Category-specific retention

    Set in: Settings → Memory
  </Tab>

  <Tab title="Files">
    **Options:**

    * Retain with conversation (default)
    * Auto-delete after conversation deletion
    * Immediate deletion after processing
    * Manual file management

    Set in: Settings → File Storage
  </Tab>

  <Tab title="Account">
    **Options:**

    * Keep account active
    * Deactivate temporarily (data preserved)
    * Delete account permanently (all data removed)

    Set in: Settings → Account → Account Status
  </Tab>
</Tabs>

## Data export and deletion

### Exporting your data

<Steps>
  <Step title="Access data export">
    Settings → Data Export or Settings → Privacy
  </Step>

  <Step title="Select data categories">
    Choose what to export:

    * Conversations (all or by date range)
    * Memory data
    * Account information
    * File attachments
    * Usage data
  </Step>

  <Step title="Choose format">
    * JSON (machine-readable)
    * Markdown (human-readable)
    * CSV (spreadsheet-compatible)
  </Step>

  <Step title="Generate and download">
    <Check>
      Export is generated and ready for download. Large exports may be emailed as a secure link.
    </Check>
  </Step>
</Steps>

### Deleting your data

<AccordionGroup>
  <Accordion title="Delete specific conversations">
    1. Select conversations to delete
    2. Click Delete
    3. Confirm permanent deletion
    4. Data removed immediately from active database
    5. Purged from backups within 30 days
  </Accordion>

  <Accordion title="Delete Memory data">
    1. Settings → Memory
    2. Select memories to delete or reset categories
    3. Confirm deletion
    4. See [Managing Memory](/memory/manage-reset-export)
  </Accordion>

  <Accordion title="Delete your account">
    **What happens:**

    * All conversations permanently deleted
    * All Memory data removed
    * All files deleted
    * Account closed (cannot be recovered)
    * Subscriptions canceled
    * Username released for reuse after 90 days

    **How to delete:**

    1. Settings → Account → Delete Account
    2. Review implications
    3. Enter confirmation phrase
    4. Confirm with password
    5. Account deleted within 48 hours

    <Warning>
      **Account deletion is permanent and cannot be undone.** Export your data first if you might want it later.
    </Warning>
  </Accordion>
</AccordionGroup>

## Breach notification

In the unlikely event of a data breach:

<Steps>
  <Step title="Detection and containment">
    We detect and contain the breach immediately using automated systems and security protocols.
  </Step>

  <Step title="Assessment">
    Determine scope, affected users, and type of data involved.
  </Step>

  <Step title="Notification">
    * Affected users notified within 72 hours
    * Regulators notified as required by law
    * Public disclosure if legally required
  </Step>

  <Step title="Remediation">
    * Implement fixes to prevent recurrence
    * Offer affected users assistance (e.g., credit monitoring if financial data involved)
    * Transparent communication about steps taken
  </Step>
</Steps>

## Children's privacy

<Warning>
  ZeroTwo is not intended for users under 13 years of age (or under 16 in the EU). We do not knowingly collect information from children. If you believe a child has provided us with personal information, contact [reed@zerotwo.ai](mailto:reed@zerotwo.ai) immediately.
</Warning>

## International data transfers

<Info>
  **Data location:**

  * Primary data centers: United States (for US users) and EU (for EU users)
  * Backup locations: Geographically distributed, encrypted
  * AI model processing: May occur in provider data centers globally

  **Protection for international transfers:**

  * Standard Contractual Clauses (SCCs) for EU data
  * Privacy Shield successor frameworks where applicable
  * Encryption for all data in transit
  * Contractual protections with all service providers
</Info>

## Updates to privacy practices

We may update our privacy practices occasionally:

<Steps>
  <Step title="Notification">
    You'll be notified of significant changes via email and in-app notification.
  </Step>

  <Step title="Review period">
    30-day review period before changes take effect for existing users.
  </Step>

  <Step title="Consent">
    Continued use constitutes acceptance. You can delete your account if you disagree with changes.
  </Step>

  <Step title="Transparency">
    All privacy policy versions archived and accessible.
  </Step>
</Steps>

## Contact and questions

### Data protection officer

For privacy questions or concerns:

**Email**: [reed@zerotwo.ai](mailto:reed@zerotwo.ai)\
**Subject line**: "Privacy Inquiry" or "Data Protection Request"

**Response time**: Within 5 business days for acknowledgment, 30 days for complete response

### Support channels

<CardGroup cols={2}>
  <Card title="Email support" icon="envelope">
    [reed@zerotwo.ai](mailto:reed@zerotwo.ai)\
    For privacy, security, and data questions
  </Card>

  <Card title="In-app support" icon="circle-question">
    Help → Contact Support\
    For technical and account issues
  </Card>

  <Card title="Documentation" icon="book">
    docs.zerotwo.ai\
    Comprehensive guides and FAQs
  </Card>

  <Card title="Status page" icon="signal">
    status.zerotwo.ai\
    Service status and incidents
  </Card>
</CardGroup>

## Additional resources

<CardGroup cols={2}>
  <Card title="Terms of Service" icon="file-contract" href="/terms">
    Legal terms and conditions
  </Card>

  <Card title="Cookie Policy" icon="cookie" href="/cookies">
    How we use cookies and tracking
  </Card>

  <Card title="Security practices" icon="lock" href="/security">
    Detailed security information
  </Card>

  <Card title="Transparency report" icon="chart-line" href="/transparency">
    Data requests and compliance reports
  </Card>
</CardGroup>

<Tip>
  For the most up-to-date privacy policy and detailed legal information, visit [zerotwo.ai/privacy](https://zerotwo.ai/privacy).
</Tip>