Privacy — usezn evidence and retention

Overview

zn ("we", "our", or "us") is committed to protecting your privacy. This Privacy Policy explains how we collect, use, and safeguard your information when you use our prompt injection detection service.

Information We Collect

Account Information: Email address, company name (optional), and billing information when you subscribe to a paid plan.

Usage Data: API call counts, latency metrics, and aggregate statistics about your usage patterns.

Evidence Data: When our service analyzes input for prompt injection, we generate evidence records for audit purposes.

AI Processing and Retention

Evidence Only: We store evidence records (verdict, confidence, threat classification, timestamps) but do NOT retain the original prompt content after analysis.

No Prompt Retention (paid plans): On paid plans, your actual prompt text is processed in memory and discarded immediately after analysis. We never store, log, or train on paid-plan prompt content. (The free Contributor tier is the documented exception below.)

SHA-256 Hashing: Evidence records include a SHA-256 hash of the analyzed input for verification purposes. This hash cannot be reversed to recover the original content.

Retention Period: Evidence records are retained for up to 90 days. We do not retain your prompts. You can request earlier deletion at any time.

Encryption: Evidence records and account data are encrypted at rest with AES-256 using AWS KMS-managed keys.

Exportable: Evidence records can be exported as CSV or JSONL at any time.

Your eyes only: Evidence records are visible exclusively to the account that generated them, in your dashboard Evidence Vault. No admin product surface reads customer payloads; paid-plan payloads are never persisted anywhere, so there is nothing to read.

Contributor Research Telemetry (Opt-In)

Members of the free Contributor plan grant permission to use anonymized, PII-scrubbed routing telemetry to train open zn models. Inputs are scrubbed of PII and credentials before only non-reversible attention vectors are stored. Participation is voluntary and limited to the Contributor tier.

Zero Data Retention for Paid Plans

All paid tiers (Starter, Growth, Enterprise) run under strict Zero Data Retention: inputs are evaluated in volatile memory and purged immediately after the verdict. Paid plans never train models on customer data.

How We Use Your Information

To provide and maintain our service
To process your subscription and billing
To send you service-related communications
To improve our detection algorithms (using aggregate, anonymized data only)
To comply with legal obligations

Data Security

We implement industry-standard security measures including encryption in transit (TLS 1.3) and encryption at rest (AES-256) with AWS KMS-managed keys. Our infrastructure runs on AWS, whose data centers hold SOC 2 Type II and ISO 27001 certifications. zn itself is not yet SOC 2 or ISO 27001 certified; our compliance roadmap is published on the Security Policy page.

Your Rights

You have the right to:

Access your personal data
Request deletion of your data
Export your data in a portable format
Opt out of marketing communications

Contact

For privacy-related inquiries, contact us at privacy@usezn.com or reach out on X @use_zn.

For security reports, safe harbor, and our compliance roadmap see the Security Policy. For subprocessors and data processing terms see DPA & Subprocessors.