1. Introduction
Zorka Lab (“Zorka Lab”, “we”, “our” or “us”) is a B2B SaaS company providing AI-powered sales development agents. Our services include a browser extension and CRM integrations (e.g. HubSpot) that automate tasks like lead research, qualification, personalized email outreach, and CRM updates. This Privacy Policy explains how we collect, use, and protect personal data when you use Zorka Lab’s websites, extensions, and services (collectively, the “Services”). By using our Services, you agree to the collection and use of information as described in this Policy. If you do not agree, please discontinue use of the Services.
2. Data We Collect
We only collect data necessary to provide and improve our AI sales assistant Services. This includes:
- Account and Contact Information: When you sign up or contact us, we collect business contact details such as your name, work email, company name, job title, and password. This data is used to create your account, authenticate you, and communicate about account-related matters.
- Prospect and CRM Data: Our platform processes personal data about your sales leads/prospects that you or your CRM provide. This may include prospect names, job titles, company names, industry, publicly-available company details, and business contact information (like work email addresses and LinkedIn profile URLs). For example, if you connect a CRM (such as HubSpot), we access lead contact fields and update records (e.g. logging emails or qualification notes) with your permission. We do not use prospect data for any purpose other than delivering the Services you’ve requested (e.g. crafting personalized outreach).
- Content of Communications: The AI agent may draft or send emails and other messages on your behalf. Our system will process the content you input or that is generated (e.g. email body text, meeting notes) in order to perform the requested task. This content is only used within your sales workflows and is not analyzed for any other purpose.
- Usage and Interaction Data: We collect metadata about how you interact with the Services to help us improve functionality. For example, we may log when the extension engages with a prospect (time, date, type of interaction), the number of emails sent, or whether an AI-generated email was accepted or edited by you. We may also gather standard technical information when you use the Services, such as browser type/version, device type, operating system, and IP address, to ensure compatibility and security. This data does not include the actual content of your sales communications, and it is only used to monitor service health, personalize your experience, and enhance our product.
- Cookies and Website Data: If you visit our marketing website or web app, we may use cookies or similar tracking technologies to remember your preferences and analyze site traffic. You can set your browser to refuse cookies; however, some site features might not function properly as a result. (Our browser extension itself does not use advertising cookies.)
We do not intentionally collect any sensitive personal data (such as home addresses, birthdates, financial or health information) through our Services. We ask that you refrain from inputting any sensitive data that is not required for using the platform.
3. How We Use Your Data
Zorka Lab uses the collected information strictly to operate, maintain, and improve our Services, and to support your sales development needs. Key uses of data include:
- Providing and Personalizing the Service: We use your data to carry out the core functionality of our platform – for instance, using a prospect’s name and company info to automatically generate a tailored outreach email, or logging an AI-qualified lead in your CRM. All personal data is processed to deliver the specific features you use, such as lead qualification insights or email drafts customized to each prospect.
- AI-Powered Outreach (In-Session Only): When our AI generates content (like email copy or lead research summaries) for you, it does so in real-time during your session. We do not use your data to train AI models – neither Zorka Lab nor our AI providers use your customers’ personal data or your content to improve any general AI system beyond your individual sessions[1][2]. The inputs you provide and the AI outputs we return are only used to serve you in that moment. Once the AI has generated the result, your data remains within our system and is not fed into any public machine learning training set.
- Service Improvement and Analytics: We may analyze usage trends and interaction data (in aggregate form) to debug issues, gauge feature performance, and make enhancements. For example, understanding that a certain email template is frequently edited helps us improve our AI’s suggestions. Analytics may also help us ensure our AI responses are relevant and accurate. These analyses are done in-house or with privacy-focused third-party analytics tools, and do not include identifying information about leads or end-users.
- Communication and Support: We use your account and contact information to send product updates, respond to inquiries, provide customer support, and inform you about new features or security updates. We will only send you marketing emails if you have opted in, and you can opt out at any time.
- Legal and Security Purposes: We may use data as necessary to comply with legal obligations, resolve disputes, enforce our Terms of Service, or protect Zorka Lab’s rights and the rights of our customers. This includes using data to detect and prevent fraud or misuse of the Services and to keep our platform secure.
We will never sell your personal data to third parties for marketing or any other purposes. We only use and share data as described in this Policy, and always in accordance with applicable laws.
4. Third-Party Services and Data Processors
To provide our Services efficiently, Zorka Lab relies on a few trusted third-party service providers (subprocessors). These third parties only process your data on our behalf and under our instructions. We vet our partners for strong privacy and security practices and ensure they are bound by confidentiality and data protection obligations. The key third-party tools involved in Zorka Lab’s platform include:
- AI Language Generation (OpenAI API): We integrate with OpenAI’s large language model API to generate email content and conversational responses. When you ask the AI agent to draft an email or qualify a lead, relevant context (e.g. prospect first name, company, and a prompt) is sent securely to OpenAI’s servers, which return a generated text. OpenAI is prohibited from using our data for any purpose other than providing the response[1]. According to OpenAI’s policies, API data is not used to train their general models by default, and is stored only transiently for abuse monitoring[2]. Zorka Lab does not send any more personal information than necessary to produce the AI output.
- Data Enrichment Providers (BrightData, Jina.ai): To enrich and verify company or prospect information, we may use external data services. For example, BrightData may be used to retrieve public web data about a company (such as recent news or size) and Jina.ai might assist in parsing and searching through relevant information. These providers help us supply up-to-date context for personalized outreach. They receive limited query data (for instance, a company name or domain) and return relevant public information. They are not permitted to store or reuse the query data for any other purpose.
- CRM Integration (e.g. HubSpot): If you connect a third-party CRM system to Zorka Lab, our Service will exchange data with that system to streamline your workflow. For example, our platform may read lead records from your CRM (names, emails, status) and write updates back (like creating a contact note or task). This happens through secure API integration. Zorka Lab only accesses the CRM data needed to perform actions you initiate, and we do not alter or extract your CRM data outside of providing the agreed Services. Your CRM provider remains responsible for the data in your CRM account; we recommend reviewing their privacy policy as well. We treat any CRM-sourced personal data in line with this Policy and only use it on your behalf.
Aside from the above, Zorka Lab uses standard infrastructure and tooling providers (for hosting, storage, email delivery, etc.), all of which are under strict data processing agreements. We will gladly provide a full list of our subprocessors upon request. Rest assured, any third-party that processes personal data on our behalf is required to maintain equal levels of privacy protection.
5. Data Sharing and Disclosure
Zorka Lab does not share your personal information with third parties except in the limited cases described below, in accordance with privacy laws:
- Service Providers: As noted, we share information with our service providers and subprocessors who need the data to perform tasks on our behalf (such as the AI and data services above, cloud hosting, or analytics). They are contractually bound to use the data only for assisting us in delivering the Services, and not for their own purposes.
- Business Transfers: If Zorka Lab is ever involved in a merger, acquisition, investment, or sale of all or part of its assets, personal data may be transferred to the new owner as part of that transaction. If that happens, we will ensure the successor honors the commitments we’ve made in this Privacy Policy, and we will notify you (for example, via email or a notice on our website) of any change in data ownership.
- Legal Requirements: We may disclose your information if required to do so by law or lawful request, such as to comply with a subpoena, regulation, court order, or other legal process. We may also disclose data if we believe in good faith that it is necessary to prevent or respond to fraud, defend our rights or property, protect the safety of our users or the public, or investigate violations of our terms or the law.
- Affiliates and Corporate Group: We may share data with any subsidiaries, affiliates, or entities under common ownership with Zorka Lab, in which case we will require them to honor this Privacy Policy. (At present, Zorka Lab operates as a single unified entity with no separate affiliates handling user data.)
Importantly, we do not sell personal data. In other words, we do not provide your personal information to third parties in exchange for money or other valuable consideration, as “sale” may be defined under laws like the California Consumer Privacy Act (CCPA). We also do not share personal data with third-party advertisers. Any sharing that does occur is solely for legitimate business needs as outlined above.
6. Data Retention
We retain personal data for only as long as necessary to fulfill the purposes described in this Privacy Policy, or as required by law or legitimate business needs. In practice:
- Account information and user-provided data will be kept for the duration of your account’s life with Zorka Lab. If you terminate your account or cease using the Services, we will delete or anonymize personal data associated with your account within a reasonable period, except for any data we are required to keep longer to comply with legal obligations or to resolve disputes.
- Prospect and lead data that you process through our platform is generally stored only to facilitate your ongoing outreach and to maintain records of interactions. For example, email logs or lead qualification notes may be retained so you and your team can refer back to them. You have control via your CRM or account to delete or export such data at any time. If you remove a prospect from our system, we will also remove any associated personal data in our possession, except where retention is legally required.
- Usage logs and technical metadata are retained to monitor service integrity and improve performance. We typically keep such logs for a short period (e.g. a few months) unless needed longer for security analysis. Aggregate analytics data that contain no personally identifiable info may be retained longer for historical analysis.
- AI request data (prompts and outputs) is not stored in a personally identifiable form long-term. Any temporary caching of AI interactions is only to facilitate the session and ensure quality. Generally, content you or the AI generate is saved only if it’s explicitly part of your records (e.g. an email saved to CRM). Transient AI processing data is discarded after use.
- Communication records (like emails to support) may be retained as long as needed to assist you or as required by law.
When we have no ongoing legitimate need to use your personal data, we will securely delete it or anonymize it. If deletion is not immediately possible (for example, because the data is stored in encrypted backups), we will isolate and secure it until deletion is feasible.
7. Data Security
We take the security of your data very seriously. Zorka Lab implements industry-standard administrative, technical, and physical safeguards to protect your personal information from unauthorized access, disclosure, alteration, or destruction. These measures include encryption of data in transit (e.g. TLS for communications between your browser extension and our servers) and at rest, firewalls and network security measures, regular security assessments, and restricting access to personal data only to authorized personnel on a need-to-know basis. We also ensure that our employees and contractors are trained on data protection.
While we strive to protect your information, no method of transmission over the Internet or electronic storage is 100% secure. Therefore, we cannot guarantee absolute security of data. However, in the unlikely event of a data breach that affects your personal information, we will notify you and the relevant authorities as required by law, and we will take all reasonable steps to mitigate any damage. We continuously update our security practices to adapt to new threats and to keep your data safe.
8. International Data Transfers
Zorka Lab is a global service, and your data may be transferred to or stored on servers located in countries different from your own. Specifically, we primarily operate in Europe and North America. If you are located in the European Economic Area (EEA), the United Kingdom, or Switzerland, please note that your personal data may be processed in the United States or other jurisdictions outside your home country.
Whenever we transfer personal data out of the EEA/UK, we ensure a similar degree of protection is afforded to it by implementing appropriate safeguards. For example, we may use the European Commission’s Standard Contractual Clauses (SCCs) or rely on an adequacy mechanism (such as compliance with the EU-U.S. Data Privacy Framework) to legitimize data transfers. These measures contractually require the recipient of the data to protect it to EU privacy standards. You can contact us for more information on the safeguards we use for international transfers.
For users in other regions (such as the U.S. or Canada), by using our Services or providing information to us, you understand that your data may be transferred to and processed in countries which may have different data protection laws than your country. In all cases, Zorka Lab will handle your personal data in accordance with this Privacy Policy and applicable law, wherever it is processed.
9. Your Privacy Rights
Rights for EEA/UK Individuals: If you are in the European Union, United Kingdom, or a similar jurisdiction, you have robust data protection rights under the General Data Protection Regulation (GDPR) and local laws. These include the right to: access the personal data we hold about you; rectify (correct) any inaccurate or incomplete data; erase your data (the “right to be forgotten”), provided we have no ongoing lawful reason to keep it; restrict or object to certain processing of your data (for example, you can opt out of any direct marketing); and data portability, which allows you to obtain a copy of your personal data in a commonly used, machine-readable format and to transfer it to another controller. If our processing is based on your consent, you have the right to withdraw consent at any time (this will not affect the lawfulness of processing before the withdrawal). We will not subject you to decisions based solely on automated processing (including profiling) that have legal or similarly significant effects without your explicit consent.
Rights for California Residents: If you are a California resident, you are protected by the California Consumer Privacy Act (CCPA) (as amended by the CPRA) and related regulations. In summary, California residents have the right to: know what personal information we collect, use, and disclose; access the specific pieces of personal information we hold about you; request deletion of your personal information (subject to certain exceptions allowed by law); and opt out of the “sale” or “sharing” of personal information (as noted, Zorka Lab does not sell personal data, and we only share it with service providers for the purposes outlined in this Policy). California users also have the right to not receive discriminatory treatment for exercising their CCPA rights.
If you are a resident of other U.S. states with privacy laws (such as Virginia, Colorado, etc.), you may have similar rights to access, delete, or correct your data, and to opt out of certain data uses. We intend to honor all applicable privacy rights across jurisdictions.
Exercising Your Rights: You may exercise any of your applicable privacy rights by contacting us at the email or address provided in the Contact section below. For example, if you wish to access or delete your data, or you want to object to a certain use, simply send us a request. We will verify your identity (to protect your security) and respond within the timeframe required by law (typically within one month for GDPR requests and 45 days for CCPA requests, with extensions if necessary). There is no fee for making a reasonable request. If we cannot fulfill your request for a legitimate reason (e.g., we cannot delete data we are legally required to keep), we will explain that in our response.
Additionally, EEA/UK individuals have the right to lodge a complaint with their local Data Protection Authority (DPA) or the UK Information Commissioner’s Office if they believe we have infringed their privacy rights. We encourage you to contact us first, and we will do our best to address your concerns.
10. Children’s Privacy
Our Services are intended for business use by adults. We do not direct our platform to anyone under the age of 18, nor do we knowingly collect personal information from children. If you are under 18, please do not use the Services or provide any personal data to us. In the unlikely event that we discover we have collected personal information from a child, we will promptly delete such information from our servers. If you are a parent or guardian and believe your child has provided personal information to Zorka Lab, please contact us so we can investigate and take appropriate action.
11. Changes to This Privacy Policy
We may update this Privacy Policy from time to time to reflect changes in our business, technology, legal requirements, or for other operational reasons. When we make changes, we will revise the “Last updated” date at the top of the Policy. If the changes are material, we will provide a more prominent notice (for example, by email notification or a notice in the product). We encourage you to review this Policy periodically to stay informed about how we are protecting your information. Your continued use of the Services after any update to this Policy will signify your acceptance of the changes, to the extent permitted by law.
12. Contact Us
If you have any questions, concerns, or requests regarding this Privacy Policy or how your data is handled, please contact us at:
Email: support@zorkalab.com
Address: Zorka Lab Sp. z o.o., REGON: 541999737; NIP: 5214121212; KRS: 0001178523, DOMANIEWSKA, str. 17/19, r. 133, 02-672, Warsaw, Poland.
We are committed to respecting your privacy and will do our best to resolve any issue to your satisfaction. Thank you for trusting Zorka Lab with your sales data – we’re dedicated to keeping that trust.
