Privacy policy

1. What we collect

• Account data. Email address and a hash of your password. We never store your plaintext password.
• Workspace data. Workspace name, plan tier, billing state, and Stripe customer reference (if you've subscribed to a paid plan).
• Connected apps. When you allow an app such as Claude or ChatGPT to use your account, the app's name as it states it, the site it returns to, when you connected it and when it last used your account. Its sign-in tokens are stored only as hashes. You can disconnect it at any time from the API keys page.
• Scene content. The diagrams you create: nodes, edges, labels, layout, styles, and revision history. It is stored in our database, which encrypts all data at rest (AES-256), and returned only to your own authenticated requests unless you publish a diagram or report a problem with it. We keep the image of each saved version in Cloudflare R2, which also encrypts it at rest. A version's image never changes. A deleted diagram's images are removed within a day of the diagram itself.
• Problem reports. When you report a problem: the version it covers, your one-line description, the app that sent it and when you confirmed. An anonymized report also keeps the anonymized copy you can see, encrypted like your diagrams; a report sent as it is keeps no copy. A report lasts until you withdraw it or the diagram is removed.
• Operational telemetry. For each request to our API: timestamp, route, status code, owner identifier, and a truncated user-agent. We do not log request bodies, response bodies, or scene content in operational telemetry.
• Audit log. Account creation, deletion, plan changes, and access to diagram content. Retained for 7 years for security and compliance.

2. How we use it

We use your data to provide the service - storing your diagrams, rendering them on request, validating your operations, and managing your subscription. Operational telemetry feeds engine improvements (which diagnostic codes fire most often, which diagram families need better defaults). Scene content is not used for anything other than serving your authenticated requests.

We do not sell your data. We do not share it with advertisers. We do not use it to train AI models, and we do not send it to third-party AI providers.

3. Who we share it with

We use a small set of subprocessors to run the service. The full list is in Appendix A; the summary:

• Neon - Postgres database hosting. Encrypts all data at rest (AES-256, including backups) and in transit (TLS).
• Fly.io - API hosting.
• Cloudflare - website + agent front-door hosting (Pages), and storage of each saved version's image (R2), encrypted at rest.
• Stripe - payment processing for paid plans.
• Resend - transactional email delivery (verification codes, account-deletion confirmations, support replies).

No AI / LLM subprocessors. Our subprocessor list does not include OpenAI, Anthropic, Google, or any other large-language-model vendor. The agent that uses Zindex (Claude Code, Cursor, etc.) is your own LLM session - Zindex never sees it.

4. Your rights

Under GDPR (if you're in the EU/UK) and CCPA (if you're in California), you have the following rights. They apply to every Zindex user regardless of residence; the legal frameworks just give them more teeth in some jurisdictions.

• Access. Request a copy of the personal data we hold about you. Email [email protected].
• Correction. Update inaccurate data via your account settings, or by emailing support.
• Deletion. Delete your account from Settings → Account. See §7 for the full mechanics.
• Portability. Download any version as SVG, PNG, Mermaid or JSON, or a diagram's whole history in one file, from the dashboard or the API. Every scene is a JSON document you fully control.
• Objection / restriction. Tell us not to process your data for a specific purpose, or to restrict processing pending a complaint.
• Complaint. Lodge a complaint with your local data-protection authority. We hope you'll talk to us first - [email protected].
• Non-discrimination. We will not retaliate against you for exercising any of these rights.

5. Internal access

We don't look at your diagrams. Our admin tooling, used by Zindex staff for billing, account management, and platform operations, shows metadata only: workspace name, plan, scene count, and last-modified time. It does not show diagram content.

Staff see a diagram's content in two cases only:

• You report a problem with a diagram, typically a rendering issue. A report covers one version. It is anonymized unless you turn that off: we keep that anonymized copy, staff see only it, and you can see the same copy on the diagram's page. Without anonymizing, staff can read that one version until you withdraw the report or delete the diagram.
• You made a diagram public and someone reports it for abuse. Moderators open it through its public link, the same way any visitor can.

Every support view is recorded in an internal audit log with the staff member who viewed it, which supports our forensics and operational review. Views of a public diagram, a moderator's included, are recorded without identifying the viewer. The log does not surface in a customer-facing dashboard.

6. AI / training

Zindex does not use customer scene content to train models. We do not send customer scene content to third-party language model providers. There is no opt-out flag because there is no AI in our processing pipeline.

A note on customer-engaged LLMs. The question worth getting ahead of: many of you use Zindex through a coding agent (Claude Code, Cursor, ChatGPT) that runs on top of a large language model. The agent's LLM is your sub-processor (or simply your tool of choice) - not ours. The data flow is your LLM session → your agent → Zindex's API: we receive the resulting API call but have no relationship with the LLM. The LLM's handling of your data is governed by your contract with the LLM provider (Anthropic, OpenAI, etc.), not by us. The same model applies to any IDE, editor, or automation layer you choose to pipe in front of the Zindex API.

Concretely, on the Zindex side:

• Our rendering engine is deterministic code (planner → layout engine → SVG renderer). No LLM is involved in render, validate, normalize, diff, or any persistence path.
• Our subprocessor list (Appendix A) names no AI / LLM providers - and never has.
• The MCP server is a thin adapter to our HTTP API. We never originate an LLM call.

This commitment has no exceptions, no enterprise-only carve-outs, and no "by default" qualifier.

7. Deletion

You can restore a deleted diagram for 24 hours. After that, a daily cleanup job removes it and all of its revisions permanently, and a second job removes their stored images within the next day.

To delete your account, the "Delete account" button in Settings triggers a two-step flow: type the workspace name to confirm, then click the link in a confirmation email. The two steps protect against accidental deletion and against a compromised session triggering deletion on your behalf.

When you click the confirmation link, the following are removed in one transaction:

• Your user record (email is freed for re-signup immediately)
• Every API key you've issued (existing keys stop working at the next request)
• Every app you connected, with its sign-in tokens (they stop working at the next request)
• Every scene you've created, with all revisions (their stored images follow within a day)
• Your workspace record
• Operational telemetry that references you (request logs, plan-change history)
• Your Stripe customer record (subscription canceled in the same flow)

Backup snapshots containing the data age out within 30 days per our storage provider's retention window. After that, no copy exists on our side.

Two things are retained:

• The deletion audit log - kept for 7 years for compliance. The log records that an account was deleted; it does not include account contents.
• Stripe billing records - retained per Stripe's privacy policy and applicable tax law (typically 7 years), governed by your relationship with Stripe rather than us.

There is no recovery on our side. Support cannot restore a deleted account; if you change your mind after confirming, the account is gone.

8. Sub-processors

See Appendix A for the full sub-processor list with role, region, and the data each one receives. Material changes to the sub-processor list are announced with at least 15 days' notice via [email protected]; if you would like advance notice, email us and we'll add you to the notification list.

9. Contact

For privacy questions, data-subject requests, or to report a privacy concern, email [email protected]. We respond within 5 working days; statutory rights (GDPR access / deletion requests) are handled within the regulatory deadline (30 days under GDPR Article 12).

Appendix A: Data Processing Addendum

This appendix is the Data Processing Addendum (DPA) that governs Zindex's processing of personal data on your behalf. For Enterprise customers, a counter-signed bilateral DPA is available on request.

A.1 Roles

For the personal data you submit to Zindex (scene content, workspace metadata, account information), you are the controller and Zindex is the processor. You determine the purposes and means of processing; we process on your documented instructions.

A.2 Sub-processors

The current sub-processor list:

Material additions to this list are announced with at least 15 days' advance notice. We do not currently use any AI / LLM sub-processors; if that ever changes, the announcement will include the proposed provider, the data they would receive, and your right to object.

A.3 Security commitments

• Encryption in transit. TLS 1.2 or higher for every HTTP and database connection.
• Encryption at rest. All data, including every diagram and every prior revision, is encrypted at rest with AES-256 by our database provider, including backups, and every stored version image by Cloudflare R2.
• Access controls. Production database access is restricted to Zindex operators. Admin tooling shows metadata only. Staff open a private diagram's content only through a problem report you send, as described in section 5; moderators review a reported public diagram through its public link.
• Audit logging. Support access to diagram content is recorded with timestamp, scene id, and the staff member who viewed it. Views of public diagrams, moderators' included, are recorded without identifying the viewer.

A.4 Personal-data breach notification

If we become aware of a personal-data breach affecting your data, we will notify you without undue delay - within 72 hours of confirming the breach. Notification will include what we know about the breach, the categories and approximate number of data subjects affected, the likely consequences, and the measures taken or proposed to address it.

A.5 Audit rights

Enterprise customers may request a copy of our most recent independent security audit (when available) under NDA. For controllers requiring on-site or remote inspection, contact [email protected] to arrange access scoped to legitimate audit purposes.

A.6 International transfers

Zindex processes personal data in the United States and the United Kingdom. For controllers in the EU, UK, or Switzerland, transfers are governed by the European Commission's Standard Contractual Clauses (2021/914) and the UK International Data Transfer Addendum, incorporated by reference into this DPA.

A.7 Term and termination

This DPA is effective as long as Zindex processes personal data on your behalf. On termination of your account, we delete the personal data we hold about you per Section 7 of the privacy policy above.