Privacy Policy

ZUBU.AI, INC., a Delaware corporation ("Zubu," "we," "us," or "our"), provides a legal hold, preservation, and data collection platform to organizations and their legal teams. This Privacy Policy explains how we collect, use, disclose, and protect personal information when you visit our websites (including zubu.ai), use our platform, applications, and APIs (the "Platform"), or otherwise interact with us, for example at events, through sales conversations, or by contacting support. We refer to the websites, the Platform, and our related services together as the "Services."

Please read this Policy carefully. If you have questions, contact us at privacy@zubu.ai.

1. Two Roles: When This Policy Applies and When Your Organization's Notice Applies

Zubu processes personal information in two distinct roles, and it matters which one applies to you.

Zubu as a business or controller. We decide how and why to process personal information about website visitors, prospective customers, event attendees, the individuals who administer and use accounts on behalf of our Customers, as defined below ("Authorized Users"), and people who contact us. For that information, this Policy applies in full.

Zubu as a service provider or processor. Our customers ("Customers") use the Platform to issue legal holds, send preservation notices, and identify, preserve, and collect data held in their own systems, such as Microsoft 365, Google Workspace, and cloud storage services ("Customer Source Systems"). In this role we process two kinds of data, and the distinction matters:

• Customer Source Data is the content that lives in Customer Source Systems: mailboxes, files, chat messages, and similar records, together with their metadata. The Platform operates on Customer Source Data in place, through interfaces the Customer authorizes, so that holds are applied and collections are performed inside the Customer's own environment. We do not retain copies of Customer Source Data. Where a Customer directs us to collect content, it passes through our environment while it is being delivered to a destination the Customer controls (such as the Customer's own cloud storage or review platform). During that process it may be held in temporary files within our environment; those files are deleted when the collection completes, and we keep no copy.
• Customer Hold Records are the records the Platform creates and stores to run the Customer's legal hold program: hold and matter details, custodian names and contact details, hold notices and acknowledgments, questionnaire responses, search criteria, metadata, indexes and search results derived from Customer Source Data, outputs of AI Features, and audit logs. Customer Hold Records are stored in our environment, as described in Sections 8 and 9.

We refer to Customer Source Data and Customer Hold Records together as "Customer Content." Our Customers determine what Customer Content is processed and why. We process Customer Content only on the Customer's documented instructions, under the written agreement between Zubu and the Customer (including its data processing terms). We do not use Customer Content for our own purposes except as our agreement with the Customer permits (for example, to secure and operate the Platform and to generate aggregated, de-identified operational statistics that identify neither the Customer nor any individual), and we do not sell it, share it for advertising, or use it to train or improve artificial intelligence or machine learning models. Our standard Data Processing Addendum is published at https://www.zubu.ai/dpa and applies unless the Customer has signed different data processing terms with us.

Connector credentials. To operate on Customer Source Systems, the Platform holds the credentials the Customer authorizes, for example OAuth tokens or service-account credentials for Microsoft 365 or Google Workspace. We use them solely to perform the operations the Customer has configured, request only the permission scopes those operations require, store them encrypted, and delete them when the Customer disconnects the source or the agreement ends. The Customer can revoke them at any time from within its own systems.

Google Workspace and Microsoft 365 data. Where a Customer connects Google Workspace, our use and transfer to any other application of information received from Google APIs will adhere to the Google API Services User Data Policy, including the Limited Use requirements. Where a Customer connects Microsoft 365, we access data only through Microsoft Graph and related Microsoft APIs, within the permissions the Customer's administrator has granted, and in accordance with Microsoft's applicable terms. In each case we use the data only to provide and secure the Services for that Customer; we do not use it for advertising; we do not transfer it to others except as necessary to provide the Services (including to our hosting providers and to deliver a Customer-directed collection to the Customer's chosen destination), for security purposes, or to comply with law; and we do not allow humans to read it except on the Customer's instruction, for security or abuse investigation, to comply with law, or when it has been aggregated and de-identified.

Custodians and the custodian portal. If you receive a hold notice, acknowledgment request, or questionnaire through the Platform, you are using a service we provide to your organization. The information you submit (acknowledgments, questionnaire responses, and any documents you attach) and technical data about your use of the portal, such as IP address, browser type, and timestamps, are Customer Hold Records, processed on the Customer's behalf and visible to your organization's legal team. The portal uses only cookies that are strictly necessary for it to function.

If you are a custodian, employee, or other individual whose information is contained in Customer Content, the Customer, not Zubu, is responsible for the privacy notice that governs that information and for responding to your requests about it. Please direct privacy questions and requests to the organization that issued the legal hold or collected your data. If you contact us instead, we will refer your request to the relevant Customer where we can identify it and are permitted to do so.

If this Policy and a Customer agreement conflict. Where a written agreement between Zubu and a Customer addresses the processing of Customer Content or the personal information of that Customer's Authorized Users, the agreement governs as between Zubu and the Customer. Nothing in this Policy creates contractual rights or obligations beyond those required by applicable law.

This Policy does not apply to job applicants or Zubu personnel, who receive a separate notice, or to third-party websites or services that link to or integrate with the Services.

2. Personal Information We Collect

"Personal information" means information that identifies, relates to, describes, or is reasonably capable of being associated with a particular individual or household. It does not include information that has been de-identified or aggregated so that it can no longer reasonably be linked to you. The categories below describe information we collect in our role as a business or controller; the parenthetical references map each category to the categories enumerated in the California Consumer Privacy Act ("CCPA"). This Policy also serves as our notice at collection under California law. We have collected each of the categories below in the twelve months preceding the Last Updated date. You are not required to provide personal information to us, but if you do not, we may be unable to provide the Services to you or your organization, respond to your inquiries, or register you for events.

A. Information you provide to us

• Contact and professional details (CCPA: identifiers; professional or employment-related information): name, business email address, business telephone number, employer, job title, department, and mailing address, for example when you request a demo, register for a webinar, subscribe to communications, or are set up as an Authorized User.
• Account and authentication details (CCPA: identifiers; customer records information under Cal. Civ. Code § 1798.80(e); sensitive personal information, as to credentials): username, credentials (stored in hashed form), single sign-on identifiers, role and permission settings, security preferences, and multi-factor authentication data.
• Commercial and transaction details (CCPA: commercial information): subscription and license details, order and contract history, billing contact information, and payment records. Payment card details are collected and processed by our payment processor; Zubu does not store full card numbers.
• Communications (CCPA: identifiers; audio or electronic information): the content of emails, support tickets, chat messages, web form submissions, survey responses, and notes from calls and meetings with our sales, support, or success teams. Calls or video meetings may be recorded or transcribed where we tell you at the time and applicable law permits.
• Event and marketing information (CCPA: commercial information): registration details for events, webinars, and partner programs, and your communication preferences.

B. Information we collect automatically

• Device and connection data (CCPA: internet or other electronic network activity information; identifiers): IP address, browser type and version, operating system, device identifiers, language settings, and approximate location derived from IP address (country or region level).
• Usage and log data (CCPA: internet or other electronic network activity information): pages viewed, features used, links clicked, referring and exit pages, dates and times of access, session duration, error and diagnostic logs, and security and audit logs generated when Authorized Users take actions in the Platform (for example, creating a hold or exporting a collection). Platform audit logs are also part of the Customer's Customer Hold Records and are retained for the Customer's defensibility record.
• Cookie and tracking data: information collected through cookies, pixels, tags, software development kits, and similar technologies, described in Section 6.

C. Information we receive from other sources

• From your organization: your employer or the Customer that administers your account may provide your contact details and role so that we can provision access or communicate with you about the Services.
• From business and marketing partners: referral partners, resellers, event co-hosts, and lead-generation or contact-enrichment providers may provide business contact information and firmographic data about you and your organization.
• From public and professional sources: publicly available business information such as company websites, professional networking profiles, and legal-industry directories, used to identify and contact organizations likely to be interested in the Services.
• From integrations your organization authorizes: if a Customer connects the Platform to an identity provider or similar system to provision Authorized Users, we receive your account details from that system in accordance with the Customer's configuration and the third party's terms. Information about custodians and data sources received from Customer Source Systems or HR systems is Customer Hold Records, processed on the Customer's behalf (Section 1).

D. Inferences

We may derive limited inferences from the information above, for example which product features are likely relevant to your organization or whether an account may need support, to operate and improve the Services and to tailor our communications (CCPA: inferences).

E. Sensitive personal information

We do not seek to collect sensitive personal information (such as government identification numbers, precise geolocation, racial or ethnic origin, religious beliefs, health information, or biometric identifiers) in our role as a business. Account credentials are the only category of sensitive personal information we routinely collect, and we use them solely to authenticate you and secure your account. Sensitive information contained in Customer Content is processed solely on the Customer's behalf as described in Section 1.

3. How We Use Personal Information

We use personal information for the following business and commercial purposes:

• To provide and operate the Services: create and administer accounts, authenticate Authorized Users, deliver Platform functionality, process transactions, and provide customer support.
• To communicate with you: send service, security, and administrative messages (which you cannot opt out of while you hold an account), respond to inquiries, and, subject to your choices, send product updates, release notes, newsletters, event invitations, and other marketing communications.
• To secure the Services: monitor, detect, investigate, and prevent fraud, abuse, unauthorized access, and security incidents; enforce our Terms of Service and Customer agreements; and maintain audit trails.
• To improve and develop the Services: analyze usage, performance, and trends; troubleshoot and debug; conduct research and development; and test new features. Where we do so, we use aggregated or de-identified data wherever practicable.
• To manage our business: perform accounting, billing, audit, and record-keeping functions; manage relationships with Customers and partners; and plan and evaluate our business.
• To comply with law and protect rights: comply with legal obligations, respond to lawful requests, court orders, and regulatory inquiries; establish, exercise, or defend legal claims; and protect the rights, property, safety, and security of Zubu, our Customers, Authorized Users, and others.
• With your consent, for any other purpose we disclose at the time of collection.

In our role as a business, we do not use personal information for automated decision-making that produces legal or similarly significant effects on you, and we do not engage in profiling of that kind. Decisions about whom to place on legal hold and what to collect are made by our Customers, with human review, as described in Section 4.

Legal bases (EEA, United Kingdom, and Switzerland)

If you are located in the European Economic Area, the United Kingdom, or Switzerland, we rely on the following legal bases under the EU General Data Protection Regulation and the UK General Data Protection Regulation (together, "GDPR") and, for Switzerland, the corresponding provisions of the Swiss Federal Act on Data Protection:

Where we rely on legitimate interests, we have assessed that those interests are not overridden by your interests or fundamental rights. You can obtain more information about that assessment by contacting us.

4. Artificial Intelligence in the Platform

The Platform may include features that use machine learning and other artificial intelligence techniques, for example to classify documents, identify custodians and data sources, suggest scope, and summarize content ("AI Features"). Because our Customers are legal teams handling privileged and sensitive material, we apply the following commitments to AI Features:

• No training on Customer Content. We do not use Customer Content, or personal information about Authorized Users, to train, retrain, fine-tune, or otherwise improve AI models, whether our own or a third party's.
• Analysis of source content runs in the Customer's environment. AI Features that analyze Customer Source Data execute inside the Customer's own cloud environment. Our environment receives only the resulting outputs, such as classifications, summaries, and hit reports, which are stored as Customer Hold Records. AI Features that operate on Customer Hold Records run within Zubu-controlled infrastructure hosted on Amazon Web Services and Microsoft Azure.
• No third-party model providers. We do not send Customer Content to third-party large-language-model or AI service providers for processing.
• Human oversight. AI Features produce suggestions and analyses for review by the Customer's authorized personnel. They do not make legal determinations and do not make decisions that produce legal or similarly significant effects on individuals without human review.
• Customer-directed integrations are different. If a Customer chooses to connect the Platform to a third-party AI tool or assistant, for example through our API or a connector the Customer enables, data flows to that tool under the Customer's configuration and the third party's terms, not under the commitments above.

If our AI practices change in a way that affects these commitments, we will update this Policy and, where required, obtain consent or provide advance notice under our Customer agreements before the change takes effect.

5. How We Disclose Personal Information

We disclose personal information to the following categories of recipients, in each case only as necessary for the purposes described above:

• Service providers and sub-processors that act on our behalf and under written contracts restricting their use of the information, including cloud hosting (Amazon Web Services, Microsoft Azure, and Vercel), identity and authentication, security monitoring, payment processing, customer-relationship management, email delivery, analytics, customer support, and professional services. Because Customer Source Data remains in Customer Source Systems, our sub-processors do not retain it; our hosting providers' infrastructure handles it, including in temporary files, during a Customer-directed collection, and sub-processors that support the Platform may process Customer Hold Records. A current list of the sub-processors that process Customer Content, including their purpose and location, is published at https://www.zubu.ai/sp and is provided to Customers under their agreements; we notify Customers of changes to that list and give them the opportunity to object as provided in their agreements. Sub-processors are bound by written terms no less protective than those we owe the Customer.
• Your organization. If you are an Authorized User, the Customer that administers your account can access information about your use of the Platform, including audit logs, and may receive information about support requests you make.
• Affiliates, meaning any entity that controls, is controlled by, or is under common control with Zubu, for the purposes described in this Policy and subject to it.
• Business and channel partners, such as resellers, referral partners, and event co-hosts, only where you have engaged with us through that partner, registered for an event we co-host with it, or asked us to connect you with it; that is, at your direction. We do not otherwise provide your personal information to partners for their own use.
• Professional advisors, including lawyers, auditors, accountants, insurers, and bankers, where necessary to obtain their services.
• Government authorities, courts, and law enforcement, where we believe in good faith that disclosure is required by law, subpoena, or legal process, or is necessary to protect our rights or the safety of any person. Because we do not retain Customer Source Data, we are not in a position to produce it and will direct any requester to the Customer. Where a request concerns Customer Hold Records, we will, unless legally prohibited, notify the Customer and give it the opportunity to seek protective relief before we disclose anything; we will challenge requests we consider overbroad or improper, and we will disclose only the minimum required, consistent with our Customer agreements.
• Parties to a corporate transaction. If Zubu is involved in a merger, acquisition, financing, due diligence, reorganization, bankruptcy, receivership, or sale of some or all of its assets, personal information may be disclosed to the counterparties and their advisors and transferred as part of that transaction. Any successor will be bound by this Policy or will provide notice of any material change.
• At your direction or with your consent, including when you ask us to share information with a third party.

For purposes of the CCPA, the following table shows, for each category of personal information we collect, the purposes for which we use it (keyed to Section 3) and the categories of recipients to which we have disclosed it for a business purpose in the preceding twelve months:

We may also disclose de-identified or aggregated information (such as usage statistics) that does not reasonably identify any individual. Where we de-identify personal information, we maintain and use it only in de-identified form, do not attempt to re-identify it except to test our de-identification methods, and contractually require any recipient to do the same.

We do not sell personal information, and we do not "share" personal information for cross-context behavioral advertising, as those terms are defined under California law and comparable laws of other U.S. states. We have not done so in the preceding twelve months, and we have no actual knowledge of selling or sharing the personal information of anyone under 16 years of age. We also do not process personal information for "targeted advertising" as defined under those laws.