Privacy Policy
Introduction
This Privacy Policy explains how Tal Shelef Inc. ("Zekal", "we", "us") collects, uses, discloses, and safeguards personal information in connection with the Zekal platform. It applies to visitors of zekal.ai, customers who sign up for a workspace, and users who are invited to a workspace. Where Zekal processes personal information on your behalf as a service provider, your own privacy policy governs your relationship with the people whose information you upload.
Information we collect
Account information: your name, email, hashed password (if you set one), workspace role, and the business name you provide. If you sign in with Google, we also receive your Google profile email, name, and the stable subject identifier Google issues per user (googleSub). We do not request or store your Google password.
Customer Data: the business records you upload or create in your workspace — leads and their contact details, properties/projects you track, uploaded documents (including PDFs you index), lot and listing data, call recordings and transcripts (only when you enable call recording), SMS and email bodies you compose through the platform, agent drafts awaiting your approval, and the metadata around all of the above.
Usage logs: HTTP request logs, API call records, feature usage metrics, agent runs, credit debits, audit log entries, and error telemetry. These contain limited personal information (user id, tenant id, IP, user-agent).
Cookies: a single session cookie ("scale-session") that keeps you signed in, and a short-lived state cookie used during Google sign-in. We do not place advertising or cross-site tracking cookies on the application.
We do not deliberately collect special-category personal information (health, sexual orientation, biometric, government identifiers) and we ask you not to upload such information to the platform.
How we use information
We use the information above to:
- operate your workspace, authenticate you, and keep the Service running
- execute the features you invoke — AI drafts, Market Intel scrapes, document indexing, campaign generation, agent runs
- route outbound messages through Twilio and Resend when you send them
- generate backups, maintain audit logs, and detect abuse or security incidents
- bill you for subscription fees and AI credit usage
- communicate operational notices (service availability, outages, security alerts, Terms changes)
- improve the Service (debugging, reliability, aggregate feature usage). We do not use Customer Data to train AI models
Legal basis under PIPEDA
In Canada, we rely on the Personal Information Protection and Electronic Documents Act (PIPEDA) and provincial equivalents where applicable. We collect and use personal information with your consent — either express (when you sign up, accept an invitation, or opt into a feature) or implied where consent is reasonable in context (sending you operational emails to the address you registered). For personal information about third parties that you upload (your leads, contacts, applicants), the consent chain remains yours; see "Your obligations" below.
Sub-processors
We rely on the following service providers to deliver features. Each processes personal information in the regions noted; data may be transferred to and processed in the United States.
- Vercel (United States) — application hosting
- Supabase (us-east-1, United States) — database and object storage
- Anthropic (United States) — AI model inference for Claude
- Twilio (United States) — SMS and voice calling, call recording storage
- Resend (United States) — transactional email delivery
- Firecrawl (United States) — web scraping on sources you configure
- Voyage AI (United States) — text embeddings for document search
- Google (United States) — OAuth sign-in (profile, email, sub)
We update this list from time to time. Material changes will be posted here before they take effect.
Cross-border transfer
Personal information processed through Zekal is stored primarily in the United States at our hosting and database providers. If you access the Service from outside Canada, your information will be transferred to Canada and the United States. All sub-processors above are bound by contractual safeguards that require protections comparable to Canadian law.
Retention
We retain Customer Data for as long as your account is active. On termination, we delete remaining Customer Data within 90 days, subject to backup rotation and any legal hold. Call recordings follow the retention setting you configure in your workspace. Audit logs are retained for 24 months. Usage logs and error telemetry are retained for 12 months.
Your obligations for personal information you upload
When you upload personal information about third parties — your leads, contacts, applicants, past clients, employees — you are the controller of that information under applicable privacy law. You represent that you have the right to upload it, that you have given the required notices, that any required consents are in place, and that your use of the Service complies with the privacy law of each person's jurisdiction. We will process this information strictly as described in these Terms and the Privacy Policy, and as instructed by you through your use of the features.
Your rights
If you are a user of a workspace, you have the right to access, correct, and delete the personal information we hold about you (as opposed to Customer Data held on behalf of the workspace, which is managed by your workspace owner). To exercise these rights, email hello@zekal.ai with a description of your request. We will respond within 30 days. If you ask us to delete your account, we will do so subject to backups and legal holds.
Google API Services — Limited Use
Zekal's use and transfer to any other app of information received from Google APIs will adhere to the Google API Services User Data Policy, including the Limited Use requirements. Zekal uses Google OAuth solely to verify identity (openid, email, profile) and sign the user into their Zekal workspace. We do not transfer this data to third parties except as necessary to provide user-facing features, to comply with applicable law, or as part of a merger or acquisition with equivalent protections. We do not use this data for serving advertisements, and we do not allow humans to read this data unless we have the user's affirmative consent, we need it for security purposes (such as investigating abuse), to comply with applicable law, or the data is aggregated and used for internal operations.
Children
Zekal is not directed to persons under 18. We do not knowingly collect personal information from anyone under 18. If you believe we have, please email hello@zekal.ai and we will delete it.
Security
We protect the Service with industry-standard measures: TLS for every connection; passwords hashed with bcrypt; JWT session cookies that are httpOnly and secure in production; secrets stored in our hosting provider's secret manager, never in source control; least-privilege access to the production database; audit logs on sensitive actions; and sub-processor contracts that bind each provider to equivalent protections. No system is perfect — if you discover a vulnerability, email hello@zekal.ai and we will respond quickly.
Changes to this Policy
We will update this Policy as needed. If a change is material, we will give you 30 days' notice by email or in-app before it takes effect. The current effective date is at the top of this page.
Contact
Questions, requests, or complaints about this Policy or your personal information: hello@zekal.ai. If you are not satisfied with our response, you can contact the Office of the Privacy Commissioner of Canada (priv.gc.ca).