Privacy Policy

1. Introduction

This Privacy Policy is issued by Zeta AI, Inc., a Delaware corporation doing business under the commercial name of "Viktor" ("Zeta AI," "we," "us," or "our"). Zeta AI provides the Viktor service and related software, integrations, and documentation (collectively, the "Service"), which integrates with your communication workspace (such as Slack or Microsoft Teams) to help improve business operations using artificial intelligence ("AI").

This Privacy Policy explains how we collect, use, disclose, and safeguard personal data when you use the Service, and outlines your rights and choices. By using the Service, you agree to the practices described in this Privacy Policy.

Our roles. Where data protection laws distinguish between a "controller" and a "processor" (or a "business" and a "service provider"), we act in two capacities. For Customer Data, meaning the content submitted to or processed by the Service on behalf of the organization operating a Viktor workspace (the "Customer"), we act as a processor or service provider on the Customer's behalf, under our Data Processing Addendum available at viktor.com/legal/dpa (the "DPA"). For the data we collect for our own purposes, such as account, billing and workspace administration data, service logs and usage data, website visitor data, and our marketing and support communications, we act as the controller.

We review this Privacy Policy at least annually to ensure it remains accurate, complete, and compliant with applicable laws and our internal data governance standards.

Key definitions

Customer Data means data submitted to or processed by the Service on your behalf, including: connection credentials (e.g., OAuth tokens), basic workspace/user identifiers, workspace settings, files stored in Viktor, conversations and outputs generated in Viktor, scheduled tasks, approval decisions, and service logs.

2. Information We Collect

We collect only the information necessary to provide, maintain, and secure the Service.

A. Slack workspace and user information

When you install or use Viktor, we may store:

• Slack workspace identifiers (e.g., workspace/team ID) and limited workspace metadata needed to operate the integration.
• Administrator information for the person who installs Viktor (name and email address as provided by Slack).
• User identifiers for users who interact with Viktor (e.g., Slack user ID, display name, and email address if provided by Slack).
• Slack-to-internal user mapping data to associate actions/permissions with users (e.g., workspace/team ID, Slack user ID, email, username).
• Onboarding email consent records for workspace members who opt in to onboarding emails (Section 7.D): the email address you confirmed or entered, your workspace and user identifiers, the wording and time of the prompt and of your answer, and any withdrawal. No record is created for members who are not asked or who decline.

B. Connection credentials

We store credentials necessary to maintain integrations, including:

• Slack OAuth tokens (access/refresh tokens), token scopes, and expiration metadata.
• Credentials or tokens for other third-party integrations you enable (if applicable).
• Integrations in Viktor are workspace-shared. Related credentials and tool settings may therefore be available for use by authorized members of that workspace through Viktor.

C. Content and records inside Viktor

We store content needed to provide continuity and run the Service, including:

• Workspace files created or uploaded in Viktor (e.g., company notes, team profiles, run logs, reports, todo lists, and other documents).
• Conversation threads and messages between users and Viktor, including agent outputs and tool calls.
• Approvals/permission decisions (approval or rejection records) related to actions Viktor requests.
• Scheduled tasks configurations (e.g., task name/title, schedule/cron configuration, dependencies, and configuration metadata).

D. Slack message content

When you use Viktor in Slack, we access message content from channels Viktor has been invited to or has joined — including messages sent in those channels while Viktor is a member, not only messages that mention Viktor — as well as direct messages with Viktor and thread replies. When Viktor joins a channel, it may retrieve up to approximately 90 days of that channel's prior history to establish context. Where an individual user separately grants Viktor Slack search permissions through Slack's OAuth consent screen, Viktor may search and read Slack content accessible to that user under the granted scopes (which may include private channels and direct messages). This data is used to process your requests, maintain conversation context, and provide the Service.

E. Service logs and usage data

We collect and store limited operational data, such as:

• Service logs and audit/security logs (e.g., timestamps, error logs, request/response metadata).
• Usage events needed to operate and improve reliability (e.g., tasks executed, approvals granted, feature usage signals).

F. Communications with us

If you contact us (e.g., support tickets or email), we collect the information you provide in those communications.

G. Website/app analytics, advertising, and attribution data

When you visit our website, use product surfaces, or begin checkout flows, we may collect:

• Cookie, pixel, and similar online identifiers used for analytics, advertising measurement, and referral attribution.
• Device and browser metadata, IP address, pages viewed, and interaction events.
• Approximate location inferred from your IP address when you create an account and when you use the Service while signed in; for signed-in use we keep only the most recent location, updated at most once a day (for example, country, region, metro area, city, partial postal code, and network provider; in most countries, only country and region). We do not collect precise location, such as GPS coordinates.
• Attribution and referral metadata associated with signup or billing events (for example, campaign/referral identifiers or partner discount metadata).

Sensitive data

We do not knowingly collect sensitive personal data (such as financial account numbers, health information, or children's data) unless necessary for the Service and provided by you.

3. How We Use Your Information

We use the information described above to:

A. Provide and operate the Service

• Authenticate users and workspaces.
• Maintain Slack and other integrations you enable.
• Execute tasks, respond to requests, generate outputs, and provide context continuity in Viktor.

B. AI processing to generate outputs

• Relevant portions of Customer Data may be processed by AI systems to produce responses, reports, and other outputs at your direction.
• We do not use Customer Data for advertising.
• We do not train our own or third-party foundation models on Customer Data, and we do not permit AI providers to do so.
• We may use Customer Data to develop internal, service-specific quality models — for example, a model-selection router that chooses which AI provider serves a given request. These internal models are narrow classifiers used solely to operate and improve the Service, are not general-purpose AI models, do not generate content, and are never made available to third parties.

C. Maintain security, safety, and integrity

• Detect and prevent fraud, abuse, and unauthorized access.
• Investigate incidents and maintain audit trails where appropriate.

D. Service improvement (aggregated or de-identified)

We may use aggregated or de-identified data (that cannot reasonably identify you) to understand usage patterns and improve reliability and product experience.

E. Communications

• Send service-related communications (e.g., product updates, security notices, billing/administrative messages).
• Provide customer support.
• Send onboarding emails to workspace members who separately opt in inside Slack or Microsoft Teams (Section 7.D).

F. Analytics, advertising, and attribution

• Measure product and website usage, campaign performance, and conversion events.
• Measure advertising effectiveness by geographic area (for example, comparing results across regions).
• Decide whether an offer that depends on where you are, such as a gift delivered by a local partner, can reach you.
• Associate referrals, partner programs, and discount programs with subscriptions and billing records.
• Prevent abuse, fraud, and misuse of marketing/referral programs.
• Maintain advertising exclusion lists so that our advertisements are not shown to existing customers.

G. Compliance and protection

Comply with legal obligations and enforce our Terms of Use, and protect the rights, safety, and property of our users and Zeta AI.

Automated actions and decision-making. The Service can execute automated actions (for example sending messages or emails) only as enabled and configured by the Customer, which decides whether such actions require prior human approval. We do not use personal data to make decisions producing legal or similarly significant effects concerning individuals; automated activity operates under the Customer's configuration and instructions.

4. How We Disclose or Share Information

We do not sell your personal data for monetary consideration.

We may share certain identifiers and usage data with analytics, advertising measurement, and attribution partners to operate and improve the Service. Depending on your jurisdiction, this may be considered a "sale," "sharing," or "targeted advertising," and you may have rights to opt out. Section 7.G describes how to opt out, including the "Your Privacy Choices" link on our website and Global Privacy Control signals.

We share information only as necessary to provide and support the Service, and subject to appropriate safeguards:

A. Service providers (subprocessors)

We use vendors to host and operate the Service and its infrastructure (for example, hosting, storage, monitoring, communications, support tooling, and billing). These providers may process Customer Data on our behalf solely to provide, secure, and support the Service.

Some of the providers listed below are not our vendors but integrations that the Customer itself chooses to connect to its workspace (marked "if enabled by customer", for example Google Workspace, Microsoft, HubSpot, Meta Ads, Google Ads, QuickBooks, Shopify, Amazon Selling Partner API, Notion, Moz, and BrightData). These providers receive data because, and only to the extent, the Customer connects and configures them, and they act under the Customer's own agreements with them. They act on our behalf only where we independently engage them to help provide the Service. We notify Customers before adding or replacing the vendors that act on our behalf; following the pending notification, this list will additionally include Expo (EAS Update), which delivers over-the-air updates of the mobile app code and receives IP addresses and app version and runtime identifiers.

Current subprocessors:

B. AI technology partners

When you invoke AI features, relevant portions of data (e.g., the prompt/context needed to generate an output) may be sent to third-party AI providers to generate responses. We require these providers to use the data only to provide the service to us and to the Customer whose workspace you use, and not for advertising or for training their general-purpose models.

AI provider details:

• AI providers used: The Service routes AI workloads to the following providers, depending on the features used and the models selected for your workspace:
• Anthropic — core language models (accessed directly and through Google Cloud Vertex AI and Amazon Bedrock).
• OpenAI — language models, embeddings, image and video generation, speech synthesis and transcription (accessed directly and through Microsoft Azure OpenAI Service).
• Google — Gemini language models, embeddings and image generation; Veo video generation.
• Cohere — embeddings used for memory and search.
• Together AI — optional or legacy chat models (used only if selected for your workspace).
• fal.ai — video generation (used only when media-generation features are invoked).
• xAI — Grok language models; video generation (used only when media-generation features are invoked).
• Fireworks AI — open-weight language models (for example DeepSeek).
• ElevenLabs — voice synthesis and speech-to-text (used only when voice features are invoked).
• Current list: The authoritative, current list of AI providers is maintained in our Trust Center and updated in accordance with the subprocessor-change process in the DPA.
• Data residency: AI providers process data in the United States or other regions used by those providers in accordance with their enterprise/API terms.
• Data retention by AI providers: AI providers may temporarily retain data in accordance with their API retention policies for security and abuse monitoring. Data is not used for model training.
• Data tenancy: Your data is processed in isolated API requests and is not shared with or visible to other customers.
• No training: Your data is not used to train or improve AI provider models.

C. Analytics

We may use analytics, advertising measurement, and attribution tools (for example, PostHog, Google services, Meta, TikTok, Reddit, X, LinkedIn, and referral/attribution partners such as Dub and Rewardful, where enabled) to understand usage, attribute signups/subscriptions, and improve the Service. These tools may receive online identifiers, event metadata, and referral/campaign data. We do not use Slack message content for advertising. You can manage cookies through your browser settings and can contact us regarding workspace-level controls where feasible.

Cookies and similar technologies. Strictly necessary cookies (authentication, security, load balancing) do not require consent. Where consent is required (for example, in the EEA/UK for analytics, advertising, and attribution cookies and pixels), we rely on your consent, which you can withdraw at any time. You can manage cookies in your browser settings.

Advertising exclusion lists. So that our advertisements are not shown to people who are already our customers, we may share the email address associated with your account, in hashed (pseudonymised) form, with the advertising platforms we use, for example Meta. The platform uses the hashed address to match it against its own users and exclude you from our campaigns; it is not used to target you with advertising and, under our agreements with the platforms, may not be used by them for any other purpose. We never use data obtained through Slack or other connected workspaces for this purpose. You can opt out at any time by contacting us at support@viktor.com or through the options described in Sections 7.G and 7.H.

D. Slack platform

The Service integrates with Slack via Slack OAuth 2.0 and Slack APIs. Your use of Slack is subject to Slack's terms and privacy policy. We access Slack data only after you grant permission through Slack's OAuth consent screen, and you can revoke access at any time in Slack App Management. We affirm that Slack APIs are not used to develop, improve, or train generalized AI and/or ML models.

E. Legal compliance and protection

We may disclose information if required by law or valid legal process, or when we believe disclosure is necessary to:

• Comply with legal obligations,
• Protect the rights and safety of users and the public,
• Prevent fraud or abuse, or
• Enforce our Terms of Use.

F. Business transfers

If Zeta AI is involved in a merger, acquisition, restructuring, financing due diligence, bankruptcy, or sale of assets, information may be disclosed to advisors and successor entities, subject to appropriate confidentiality protections.

G. Third-party links

The Service may link to third-party websites/services. We are not responsible for their privacy practices.

H. Shopify platform

The Service integrates with Shopify via Shopify OAuth 2.0 and Shopify's Admin GraphQL API. Your use of Shopify is subject to Shopify's terms and privacy policy. We access Shopify data only after you grant permission through Shopify's OAuth consent screen, and you can revoke access at any time by uninstalling the Viktor app from your Shopify admin. We affirm that Shopify APIs are not used to develop, improve, or train generalized AI and/or ML models, and we do not sell or share Shopify data for advertising.

5. Data Storage and Security

A. Data center location

United States.

B. Data storage and hosting

Customer Data is stored with reputable cloud service providers in U.S. regions, using encryption at rest and in transit, access controls, and service monitoring appropriate to the nature of the data.

C. Security measures

We maintain industry-standard safeguards, including:

• Encryption in transit (TLS 1.2+ / 1.3),
• Encryption at rest (AES-256 with cloud-provider key management),
• Access controls (RBAC, MFA, least-privilege access),
• Audit logging and monitoring,
• Incident response processes, including notification to affected customers and/or authorities where required by applicable law.

You are responsible for maintaining appropriate security in your Slack workspace (e.g., limiting channel access, managing Slack admin permissions).

6. Data Retention

We retain Customer Data only as long as needed to provide the Service, meet contractual obligations, and comply with law.

A. Active production systems

When an account is closed or we receive a validated deletion request, we delete Customer Data from active production systems typically within ~30 days.

B. Backups

Encrypted backups are used only for business continuity. Remaining copies are removed as encrypted backups age out on their normal rotation (currently ~35 days), after which they are automatically overwritten or purged.

C. Exports

Where legally permitted, customers may request an export prior to deletion.

D. Derived data

Derived or transformed data (such as indexes, embeddings, or other internal representations) will be deleted or disassociated from Customer Data when the underlying Customer Data is deleted, subject to backup retention and legal obligations.

E. Data we process as controller

Billing and transaction records are retained for the periods required by tax and accounting law; service, audit, and security logs are retained on a rolling basis for the limited period needed to operate and secure the Service and then expire automatically; support communications are retained after the matter is closed. Where no exact period is stated, we retain personal data no longer than necessary for the purpose for which it was collected. Onboarding email consent records and messaging profiles (Section 7.D) are deleted when you withdraw your consent and, in any event, within fourteen (14) business days after Viktor is removed from your workspace, subject to backup retention.

F. Operational logs

Service and security logs (operational logs) may incidentally contain limited Customer Data (for example identifiers, request metadata, or excerpts of requests). These logs are not deleted individually when an account is closed or a deletion request is received. Instead, they are removed through our standard deletion process, which runs on the logs' regular retention cycle and takes as long as that cycle requires.

7. Your Rights and Choices

Depending on your location, you may have the following rights:

A. Access and correction

You can request access to personal data we hold about you and request correction of inaccurate or incomplete data.

B. Deletion

You may request deletion of your personal data (including workspace files, conversation threads, and related records). For workspace-level Customer Data, we may require the request to come from an authorized workspace administrator or account owner, or we may direct individual members to their workspace administrator where appropriate.

Upon receiving a verifiable deletion request, we will delete Customer Data from active production systems typically within ~30 days, and backups will age out on their normal rotation (currently ~35 days). Operational logs are removed through our standard deletion process on their regular retention cycle (Section 6.F).

C. Withdrawal of consent / disconnecting Slack

You can revoke Viktor's access to Slack at any time via Slack App Management. After revocation, we stop collecting new Slack data immediately. Revoking access or uninstalling does not by itself delete previously stored data. If your account is deleted or closed, or we receive a verifiable deletion request, we delete previously stored data in accordance with Section 6 (Data Retention). You can also contact us to request deletion.

D. Marketing and onboarding email preferences

If you opt in to marketing communications, you can opt out at any time via unsubscribe links or by contacting us. You will still receive essential service communications. You can opt out of the ad exclusion described in Section 4.C in the same way.

Onboarding emails in Slack and Microsoft Teams. If you use Viktor in a Slack or Microsoft Teams workspace without creating an account, Viktor may once, after you have used it several times, ask you in a direct message whether you would like to receive a short series of onboarding emails. In Slack, the prompt shows the email address from your Slack profile; in Microsoft Teams, you enter or confirm your address yourself. Nothing is pre-selected, we send the emails only if you say yes, and if you decline or do not respond we do not ask again. The emails contain onboarding help only, each of them includes an unsubscribe link, and we do not otherwise contact you outside Slack or Microsoft Teams. Your workspace administrator can disable the prompt for the whole workspace. You can withdraw your consent at any time via the unsubscribe link or by contacting us; we then stop the emails and delete your consent record and messaging profile as described in Section 6.E.

E. Data portability (where applicable)

Where required by law (e.g., GDPR), you may request a copy of your data in a machine-readable format.

F. Authorized agents (where applicable)

If permitted by law (e.g., certain U.S. states), you may designate an authorized agent to submit requests on your behalf; we will verify identity and authority as required.

G. U.S. state privacy rights (where applicable)

Residents of certain U.S. states may have rights to know, access, delete, correct, and opt out of certain data uses, including "sale," "sharing," or targeted advertising as defined under applicable law. You can opt out of "sale," "sharing," or targeted advertising at any time by contacting us at support@viktor.com, and we honor opt-out preference signals (including Global Privacy Control) where required by applicable law. We will not discriminate against you for exercising applicable privacy rights.

To help us process your request, please provide sufficient information for verification (and, if applicable, authorized agent authorization). After receiving a verifiable request, we will respond within the timeframe required by applicable law (typically within 45 days, or with a permitted extension where allowed by law and notice is provided).

If we deny your request in whole or in part, you may appeal by contacting support@viktor.com with "Privacy Appeal" in the subject line within the period required by applicable law. We will review and respond to appeals within the timeframe required by applicable law.

H. Additional EEA/UK rights (where applicable)

If you are located in the EEA or UK, you may also have the right to object to certain processing, request restriction of processing, and lodge a complaint with your local supervisory authority.

To exercise rights, contact us at support@viktor.com.

8. Children's Privacy

The Service is not intended for children and we do not knowingly collect personal data from anyone under the age of 18 (or the age of majority in their jurisdiction, if higher). If we learn we have collected such data, we will delete it promptly. Contact support@viktor.com if you believe a child has provided personal data.

9. Slack Marketplace Compliance

Viktor accesses the following Slack data:

Our commitments

• We use Slack data only to provide and operate the Service.
• We do not sell Slack data.
• We do not use Slack data for advertising, including to target or serve advertisements.
• We do not use Slack data to contact you outside Slack. The only exception is the onboarding emails described in Section 7.D, which we send solely to members who gave us their separate permission inside Slack; that permission is recorded and can be withdrawn at any time.
• We affirm Slack APIs are not used to develop, improve, or train generalized AI/ML models.
• We do not train our own or third-party foundation models on Customer Data.

Revoking access

You can uninstall Viktor or revoke access at any time in Slack App Management. After revocation, we stop collecting new Slack data immediately. Uninstalling or revoking access does not by itself delete previously stored data. If your account is deleted or closed, or we receive a verifiable deletion request, we delete previously stored data in accordance with Section 6 (Data Retention). Onboarding email consent records and messaging profiles for members of an uninstalled workspace are deleted within fourteen (14) business days of uninstallation (Section 6.E).

10. Shopify Marketplace Compliance

Viktor accesses the following Shopify data on behalf of merchants who have explicitly connected their Shopify store:

Our commitments

• We use Shopify data only to provide and operate the Service for the connected merchant.
• We do not sell Shopify data.
• We do not use Shopify data for advertising.
• We affirm Shopify APIs are not used to develop, improve, or train generalized AI/ML models.
• We do not train our own or third-party foundation models on Shopify data.
• We do not persist Shopify customer, order, or store data. Each request fetches the data needed to answer the merchant's question, processes it in memory, returns the response, and discards it. Only OAuth tokens are persisted. Tokens are stored with strict access controls and encrypted at rest at the infrastructure layer, with retention aligned to Shopify's expiring offline tokens (60-minute access tokens, 90-day refresh tokens).

Compliance webhooks

Viktor implements the three GDPR-mandated Shopify webhooks (customers/data_request, customers/redact, shop/redact). Each webhook is verified against Shopify's HMAC-SHA256 signature before processing; unsigned or forged webhooks are rejected. Because Viktor does not persist Shopify customer data, its response to customers/data_request is "no stored customer data" and customers/redact is processed as a no-op. On shop/redact (sent 48 hours after uninstall), Viktor invalidates its stored OAuth tokens for that shop.

Revoking access

A merchant may uninstall Viktor or revoke access at any time from their Shopify admin. After revocation, Viktor stops collecting new Shopify data immediately. Uninstalling or revoking access does not by itself delete previously stored data (which for the Shopify integration is only OAuth tokens). If the account is deleted or closed, or a verifiable deletion request is received, previously stored data is deleted in accordance with Section 6 (Data Retention).

11. Google Chat

When you use Viktor in Google Chat, Viktor receives the messages you send to it (messages that @mention Viktor in a space and direct messages to Viktor), any attachments in those messages, the sender's name, email address and Google Chat user identifier, and the names and identifiers of the space and thread. If you link your Google account to your Viktor account, Viktor also receives your basic Google profile (name, email address and profile picture). Viktor does not receive or read other messages in a space.

When a Google Workspace administrator connects Google Chat to a Viktor workspace, Viktor also receives the following:

• Admin check: once, when a Google Workspace domain is first connected, Viktor checks whether the person connecting is a super administrator of that domain. Viktor reads only that person's administrator status and keeps only the yes-or-no result. It does not list or read other users' accounts.
• People directory: when the administrator approves directory access at the workspace's first connection, Viktor reads the domain's directory profiles (name, work email address and Google user identifier of each person) once, at that first connection, so Viktor knows who your teammates are. Viktor does not read your contacts and never writes to your directory. To keep the Google Chat connection working, Viktor stores an OAuth refresh token for the administrator's Google grant; the token is kept with strict access controls and encrypted at rest at the infrastructure layer.
• Spaces and memberships: for the spaces Viktor has been added to, Viktor receives notices when people join or leave and when a space's name, type or access settings change, so that what Viktor learned in a space stays available only to that space's current members. These notices do not include message content.

We use this data only to carry out your requests, reply to you in Google Chat, link your Google account to your Viktor account, and keep the Service secure. We store it as Customer Data under Sections 5 and 6 of this Privacy Policy. We share it only with the subprocessors and AI providers listed in Sections 4.A and 4.B that help us provide the Service, where required by law, or as part of a business transfer described in Section 4.F. Our staff do not read it unless you ask us to (for example in a support request), it is needed to investigate security or abuse, or the law requires it.

We do not sell Google user data or use it for advertising. We do not use it to develop, improve or train generalized or non-personalized AI or ML models, including the internal models described in Section 3.B. Viktor's use and transfer of information received from Google APIs in connection with Google Chat adheres to the Google API Services User Data Policy, including the Limited Use requirements.

You can remove Viktor from a space or stop messaging it at any time. You can unlink your Google account, or an administrator can revoke the directory grant (which invalidates the stored refresh token), in your Google Account permissions at myaccount.google.com/permissions. A Viktor workspace administrator can also ask support@viktor.com to disconnect Google Chat from the Viktor workspace. Viktor then stops receiving new data. Removing or disconnecting Viktor does not by itself delete other stored data. To delete it, contact support@viktor.com, and we will delete it as described in Section 6 (Data Retention).

12. Changes to this Privacy Policy

We may update this Privacy Policy from time to time. If we make material changes, we will notify you by appropriate means (e.g., notifying workspace administrators and/or emailing the address associated with the account). The "Last Updated" date reflects the most recent revision. Your continued use of the Service after changes become effective indicates acceptance of the revised policy.

13. Contact Us

If you have questions or requests regarding this Privacy Policy or our data practices, contact:

Email: support@viktor.com (privacy requests, questions, and complaints) and legal@viktor.com (legal notices)

Address: Zeta AI, Inc. 2810 N Church St, PMB 20589 Wilmington, Delaware 19802, USA

EU representative (Article 27 GDPR): Paweł Siuciak, Zeta AI, Inc., ul. Towarowa 28, 00-839 Warsaw, Poland, pawel@viktor.com.