Loading page content…
Privacy Policy
Last updated: July 24, 2026
1. Google User Data
zigzag integrates with Google services to enhance your experience. This section specifically describes how we handle data obtained through Google APIs in compliance with the Google API Services User Data Policy.
1.1 Google Data We Access
When you connect your Google account to zigzag, we may access the following data:
- Basic Profile Information: Your name, email address, and profile picture from your Google account for authentication and account creation
- Google Slides: Read and write access to create and edit pitch deck presentations on your behalf
- Google Docs: Read and write access to create and edit business documents on your behalf
- Google Sheets: Read and write access to create and edit spreadsheets for financial models and data analysis
- Google Drive: Limited access to store and organize files created through our platform
1.2 How We Use Google User Data
We use Google user data solely to provide our core services:
- Authentication: To securely sign you into zigzag using Google Sign-In
- Pitch Deck Creation: To generate and export professional pitch decks directly to your Google Slides
- Document Generation: To create business plans, executive summaries, and other documents in Google Docs
- Financial Modeling: To export financial projections and data to Google Sheets
- File Organization: To save and organize your created content in Google Drive
Important: We do not use Google user data for advertising purposes, and we do not use Google user data to train AI/ML models unless you explicitly opt in.
1.3 Google Data Sharing
We do not share, sell, rent, or trade Google user data with third parties except in the following limited circumstances:
- With Your Consent: When you explicitly authorize sharing (e.g., collaborating with team members)
- Service Providers: With trusted service providers who help operate our platform (e.g., cloud hosting), bound by strict confidentiality agreements and prohibited from using data for any other purpose
- Legal Requirements: When required by law, subpoena, or court order
- Safety: To protect the rights, safety, or property of zigzag, our users, or the public
We never sell Google user data. We never share Google user data with third parties for their marketing purposes.
1.4 Google Data Storage & Security
We protect your Google user data with robust security measures:
- Encryption: All Google user data is encrypted in transit (TLS 1.2+) and at rest (AES-256)
- Access Controls: Strict role-based access controls limit who can access user data
- Secure Infrastructure: Data is stored on secure cloud infrastructure with SOC 2 compliance
- Token Security: OAuth tokens are stored securely and refreshed automatically; we never store your Google password
- Regular Audits: We conduct regular security assessments and vulnerability testing
1.5 Google Data Retention & Deletion
Retention Period: We retain Google user data only as long as necessary to provide our services. OAuth access tokens are retained while your account is active. Basic profile information is retained for the duration of your account.
Data Deletion: You can request deletion of your Google user data at any time by:
- Revoking access in your Google Account settings
- Deleting your zigzag account through your account settings
- Emailing us at hello@gozigzag.com with a deletion request
Upon receiving a deletion request, we will delete your Google user data within 30 days, except where retention is required by law. We will also revoke our access to your Google account.
2. Information We Collect
In addition to Google user data described above, we collect information you provide directly to us, such as:
- Account information (name, email, password)
- Business ideas and startup information you input
- Payment information for subscriptions
- Communications with our support team
- Usage data and analytics
3. How We Use Your Information
We use your information to:
- Provide and improve our AI-powered services
- Generate personalized business recommendations
- Process payments and manage subscriptions
- Send service updates and support communications
- Comply with legal obligations
4. AI and Machine Learning
Our platform uses large language models provided through Microsoft Azure OpenAI Service to deliver AI-powered features, including lean canvas generation, brand identity and outreach creation, validation frameworks, MVP requirements, and other services. When you use these features, the business inputs you provide — such as your startup idea, business description, and related content — are sent to our Microsoft Azure resource located in West Europe. Model inference uses an EU Data Zone deployment, which processes prompts and generated responses within the European Union data zone.
Microsoft Azure is our AI infrastructure subprocessor. OpenAI is not a zigzag subprocessor and does not receive or have access to data submitted through our Azure deployment. Microsoft does not use our prompts, generated responses, embeddings, or uploaded data to train Microsoft, OpenAI, or other third-party foundation models without our permission or instruction, and zigzag does not grant that permission or instruction.
We do not intentionally include your account name, email address, or other account identifiers in AI generation requests. Content you choose to enter may itself contain personal data, so you should avoid including sensitive personal information unless it is necessary for the feature you are using. Microsoft may process prompts and responses for content filtering and abuse monitoring as part of providing Azure OpenAI Service; that processing is not model training.
Certain research features use Microsoft's web-grounding service. Search queries sent to that service may be processed outside the Azure OpenAI EU Data Zone. We limit those queries to the business context needed to perform the requested research and do not intentionally include account identifiers.
The lawful basis for this processing is contract performance (Article 6(1)(b) UK/EU GDPR) — AI generation is the core purpose of the service you have signed up for. We do not use your business data to train our own AI models.
5. Data Sharing and Disclosure
We may share your information in the following circumstances:
- With your explicit consent
- To comply with legal requirements or court orders
- To protect our rights, property, or safety
- In connection with a business transaction (merger, acquisition)
- With service providers who assist in our operations (under strict confidentiality)
We never sell your personal information to third parties.
For AI-powered generation, we disclose the business inputs required for the requested feature to Microsoft Azure, acting as our subprocessor. OpenAI is not our subprocessor for these requests.
6. Data Security
We implement industry-standard security measures including:
- Encryption of data in transit (TLS 1.2+) and at rest (AES-256)
- Regular security audits and penetration testing
- Access controls and authentication systems
- Secure data centers with SOC 2 compliance and 24/7 monitoring
- Employee training on data protection practices
7. Data Retention
We retain your account data for as long as your account is active. Internal analytics events, error logs, API metrics, and LLM metrics are automatically deleted after 90 daysby a daily automated retention job. Payment records are retained for 7 yearsas required by HMRC regulations.
Self-service deletion: You can permanently delete your account and all associated personal data instantly from your profile settings (Data & Privacy → Delete My Account). Monitoring records containing your email are anonymised rather than deleted to preserve aggregate service statistics.
Deletion via email: You may also request deletion by emailing hello@gozigzag.com. We will delete your personal data within 30 days, except where retention is required by law.
8. Your Rights and Choices
You have the right to:
- Access and review your personal information
- Correct inaccurate or incomplete data
- Delete your account and associated data
- Export your data in a portable format
- Opt out of marketing communications
- Restrict certain data processing activities
- Revoke third-party application access (including Google)
Most rights can be exercised instantly from your profile settings (Data & Privacy section) — including data export, account deletion, and marketing consent. For anything else, contact us at hello@gozigzag.com. We will respond within 30 days as required by Article 12(3) UK/EU GDPR.
9. Cookies and Tracking
We use strictly necessary cookies (session authentication via an httpOnly cookie) that do not require consent. We also offer optional first-party analytics — these only run if you click "Accept all" in the cookie banner. We do not use Google Analytics, Facebook Pixel, or any other third-party advertising or tracking cookies.
Declining optional cookies disables all non-essential tracking immediately. Your consent choice is stored in your browser's localStorage. You can change your cookie preference at any time from your Profile → Data & Privacy settings. For full details see our Trust Centre — Cookies & Analytics.
10. International Data Transfers
Our Azure OpenAI resource is located in West Europe and AI model inference is processed within Microsoft's EU Data Zone. Other categories of information may be processed in the United Kingdom, the European Economic Area, or other countries in which our service providers operate. Where information is transferred internationally, we use appropriate safeguards and comply with applicable data protection laws. The separate web-grounding processing described in section 4 may occur outside the EU Data Zone.
11. Children's Privacy
Our service is not intended for children under 13. We do not knowingly collect personal information from children under 13. If we become aware of such data collection, we will delete it immediately.
12. Changes to This Policy
We may update this privacy policy periodically. Significant changes will be communicated via email or platform notifications. Continued use of our service after changes constitutes acceptance.
13. Contact Us
For privacy-related questions or to exercise your rights, contact us at:
- Email: hello@gozigzag.com
- Self-service: Profile → Data & Privacy
- Trust Centre: gozigzag.com/trust