Loading page content…
Privacy Policy
Last updated: March 3, 2026
1. Google User Data
zigzag integrates with Google services to enhance your experience. This section specifically describes how we handle data obtained through Google APIs in compliance with the Google API Services User Data Policy.
1.1 Google Data We Access
When you connect your Google account to zigzag, we may access the following data:
- Basic Profile Information: Your name, email address, and profile picture from your Google account for authentication and account creation
- Google Slides: Read and write access to create and edit pitch deck presentations on your behalf
- Google Docs: Read and write access to create and edit business documents on your behalf
- Google Sheets: Read and write access to create and edit spreadsheets for financial models and data analysis
- Google Drive: Limited access to store and organize files created through our platform
1.2 How We Use Google User Data
We use Google user data solely to provide our core services:
- Authentication: To securely sign you into zigzag using Google Sign-In
- Pitch Deck Creation: To generate and export professional pitch decks directly to your Google Slides
- Document Generation: To create business plans, executive summaries, and other documents in Google Docs
- Financial Modeling: To export financial projections and data to Google Sheets
- File Organization: To save and organize your created content in Google Drive
Important: We do not use Google user data for advertising purposes, and we do not use Google user data to train AI/ML models unless you explicitly opt in.
1.3 Google Data Sharing
We do not share, sell, rent, or trade Google user data with third parties except in the following limited circumstances:
- With Your Consent: When you explicitly authorize sharing (e.g., collaborating with team members)
- Service Providers: With trusted service providers who help operate our platform (e.g., cloud hosting), bound by strict confidentiality agreements and prohibited from using data for any other purpose
- Legal Requirements: When required by law, subpoena, or court order
- Safety: To protect the rights, safety, or property of zigzag, our users, or the public
We never sell Google user data. We never share Google user data with third parties for their marketing purposes.
1.4 Google Data Storage & Security
We protect your Google user data with robust security measures:
- Encryption: All Google user data is encrypted in transit (TLS 1.2+) and at rest (AES-256)
- Access Controls: Strict role-based access controls limit who can access user data
- Secure Infrastructure: Data is stored on secure cloud infrastructure with SOC 2 compliance
- Token Security: OAuth tokens are stored securely and refreshed automatically; we never store your Google password
- Regular Audits: We conduct regular security assessments and vulnerability testing
1.5 Google Data Retention & Deletion
Retention Period: We retain Google user data only as long as necessary to provide our services. OAuth access tokens are retained while your account is active. Basic profile information is retained for the duration of your account.
Data Deletion: You can request deletion of your Google user data at any time by:
- Revoking access in your Google Account settings
- Deleting your zigzag account through your account settings
- Emailing us at hello@gozigzag.com with a deletion request
Upon receiving a deletion request, we will delete your Google user data within 30 days, except where retention is required by law. We will also revoke our access to your Google account.
2. Information We Collect
In addition to Google user data described above, we collect information you provide directly to us, such as:
- Account information (name, email, password)
- Business ideas and startup information you input
- Payment information for subscriptions
- Communications with our support team
- Usage data and analytics
3. How We Use Your Information
We use your information to:
- Provide and improve our AI-powered services
- Generate personalized business recommendations
- Process payments and manage subscriptions
- Send service updates and support communications
- Train and improve our AI models (using anonymized data)
- Comply with legal obligations
4. AI and Machine Learning
Our platform uses large language models from OpenAI to provide AI-powered features including lean canvas generation, Brand and Outreach creation, validation frameworks, and MVP requirements. When you use any of these features, the business inputs you enter (your startup idea, business description, and related content) are sent to OpenAI's API for processing.
We do not send your name, email address, or other personally identifiable information to OpenAI. OpenAI processes API inputs under a Data Processing Agreement and does not use API data to train its models. Inputs are retained by OpenAI for up to 30 days for abuse monitoring purposes only, then deleted. For full details, see OpenAI's Enterprise Privacy page.
The lawful basis for this processing is contract performance (Article 6(1)(b) UK/EU GDPR) — AI generation is the core purpose of the service you have signed up for. We do not use your business data to train our own AI models.
5. Data Sharing and Disclosure
We may share your information in the following circumstances:
- With your explicit consent
- To comply with legal requirements or court orders
- To protect our rights, property, or safety
- In connection with a business transaction (merger, acquisition)
- With service providers who assist in our operations (under strict confidentiality)
We never sell your personal information to third parties.
6. Data Security
We implement industry-standard security measures including:
- Encryption of data in transit (TLS 1.2+) and at rest (AES-256)
- Regular security audits and penetration testing
- Access controls and authentication systems
- Secure data centers with SOC 2 compliance and 24/7 monitoring
- Employee training on data protection practices
7. Data Retention
We retain your account data for as long as your account is active. Internal analytics events, error logs, API metrics, and LLM metrics are automatically deleted after 90 daysby a daily automated retention job. Payment records are retained for 7 yearsas required by HMRC regulations.
Self-service deletion: You can permanently delete your account and all associated personal data instantly from your profile settings (Data & Privacy → Delete My Account). Monitoring records containing your email are anonymised rather than deleted to preserve aggregate service statistics.
Deletion via email: You may also request deletion by emailing hello@gozigzag.com. We will delete your personal data within 30 days, except where retention is required by law.
8. Your Rights and Choices
You have the right to:
- Access and review your personal information
- Correct inaccurate or incomplete data
- Delete your account and associated data
- Export your data in a portable format
- Opt out of marketing communications
- Restrict certain data processing activities
- Revoke third-party application access (including Google)
Most rights can be exercised instantly from your profile settings (Data & Privacy section) — including data export, account deletion, and marketing consent. For anything else, contact us at hello@gozigzag.com. We will respond within 30 days as required by Article 12(3) UK/EU GDPR.
9. Cookies and Tracking
We use strictly necessary cookies (session authentication via an httpOnly cookie) that do not require consent. We also offer optional first-party analytics — these only run if you click "Accept all" in the cookie banner. We do not use Google Analytics, Facebook Pixel, or any other third-party advertising or tracking cookies.
Declining optional cookies disables all non-essential tracking immediately. Your consent choice is stored in your browser's localStorage. You can change your cookie preference at any time from your Profile → Data & Privacy settings. For full details see our Trust Centre — Cookies & Analytics.
10. International Data Transfers
Your information may be processed and stored in countries other than your own. We ensure adequate protection through appropriate safeguards and compliance with applicable data protection laws.
11. Children's Privacy
Our service is not intended for children under 13. We do not knowingly collect personal information from children under 13. If we become aware of such data collection, we will delete it immediately.
12. Changes to This Policy
We may update this privacy policy periodically. Significant changes will be communicated via email or platform notifications. Continued use of our service after changes constitutes acceptance.
13. Contact Us
For privacy-related questions or to exercise your rights, contact us at:
- Email: hello@gozigzag.com
- Self-service: Profile → Data & Privacy
- Trust Centre: gozigzag.com/trust