Zenyto Flow · last updated 26 September 2026
This policy describes how Zenyto ("we") handles personal data when you use Zenyto Flow. Where your organization is a customer, we act as a data processor for the content your organization stores in its workspace, and as a data controller for account and billing information about you as an individual.
| Category | Examples | Why |
|---|---|---|
| Account | Name, email, role | Sign-in, permissions, notifications |
| Workspace content | Projects, issues, comments, attachments, timesheets | The product itself |
| Usage | Sign-in times, feature usage, audit log entries | Security, support, product improvement |
| Technical | IP address, user agent, device | Security (rate limiting, session binding), fraud prevention |
Where a feature sends ticket text to a language-model provider (for example, drafting a reply), we apply a redaction pass for common identifiers (email addresses, phone numbers, government ID-shaped values) before that text leaves the workspace. AI providers do not train on your data through our integration, and every AI-assisted action is logged and attributed to a named, governed actor — never to a real employee's identity, and never unattended by default.
Every workspace's data is enforced at the database level to be invisible to every other workspace (row-level security), independent of any application-layer bug. This is the same mechanism verified by our own automated tenant-isolation tests on every release.
We retain workspace content for as long as the workspace is active, plus a limited window after cancellation to allow export. Security and audit logs are retained separately for a fixed period to support incident investigation. On request, we delete personal data we hold as a controller, subject to legal retention obligations.
Depending on where you're located, you may have rights to access, correct, export or delete your personal data, and to object to certain processing. Requests about workspace content should go through your workspace administrator first, since we act as a processor for that data; requests about your own account can be sent directly to us.
Data is encrypted in transit (TLS) and at rest. Access to production data is limited to what's needed to operate the Service, is logged, and every workspace enforces its own row-level isolation independent of application code.
We may update this policy from time to time. Material changes will be announced through the product or by email to workspace administrators before taking effect.
Questions about this policy, or to exercise a data-subject request: privacy@zenyto.com.