Legal

Privacy policy

How Zenday collects, uses, shares and protects personal information.

Last updated October 26, 2026

1. Who we are

Zenday AI Inc. (“Zenday”, “we” or “us”) makes software for finance teams and accounting firms. Its AI agents prepare the month-end close inside a customer’s accounting system, and the customer’s team reviews and approves the work.

This policy explains what personal information we collect, how we use and share it and the choices you have. It covers our website at zenday.com, our software and its agents (the “Service”) and our sales, support and marketing.

2. Customer Data we process for our customers

Customers connect their ledger, their bank and card feeds and other business systems to the Service. The records that come through, such as transactions, invoices, bills, payroll records and supporting documents, are “Customer Data”. Data connected for a free review is Customer Data too.

Customer Data often includes personal information about a customer’s employees, vendors, clients and other people. We process it on the customer’s behalf and on its instructions, under our customer agreement and our data processing agreement (“DPA”).

For Customer Data, the customer is the controller (or the “business”, under US state privacy laws) and we are its processor (or “service provider”). Where this policy and a customer’s agreement or DPA differ about Customer Data, the agreement or DPA applies.

If your information is in a customer’s books and you want to see, correct or delete it, please contact that customer. We’ll help them respond.

For everything else in this policy, including our website, our marketing and the accounts people use to sign in, we are the controller.

3. Information we collect

Information you give us

Contact and account details: your name, work email, phone number, company, job title and sign-in details.
What you tell us: when you book a demo, ask for a free review, contact support or answer a survey.
Billing details: the billing contact and the information we need to invoice you and take payment.

Customer Data

The records customers connect to the Service, described above. We use Customer Data to provide the Service to the customer it belongs to, and otherwise only as our agreement with that customer allows.

Usage and device information

When you visit our website or use the Service, we collect information such as your IP address, browser and device type, the pages and features you use, the time of each visit and the page that referred you.

In the Service we also record sign-ins and actions, such as who prepared, changed or approved an entry. That record is the audit log customers rely on.

Cookies and similar technologies

Our website doesn’t use analytics or advertising cookies. It stores two settings in your browser, light or dark and whether motion is paused, so they hold from page to page. They stay on your device.

When you book a demo, the booking calendar is Cal.com’s, opened on our page. Cal.com may set its own cookies, under its own privacy policy.

The Service uses cookies to keep you signed in and secure. You can block or delete cookies in your browser, though the Service may then stop working.

Information from other sources

We may receive information about you from a colleague who invites you to the Service, from your company’s identity provider when you sign in with single sign-on, from event and marketing partners and from public sources such as professional networking sites.

4. How we use information

To provide the Service: connecting your systems, running the agents and the second review, keeping the audit log and supporting your team.
To keep the Service secure: verifying who is signing in, investigating incidents and preventing fraud and misuse.
To communicate with you about your account, the Service and changes to our terms.
To improve the Service: understanding how features are used, fixing problems and building new features.
To market the Service where the law allows: telling people about it, running events and measuring our marketing. You can opt out of marketing emails at any time.
To meet legal obligations: keeping the records the law requires, responding to lawful requests and enforcing our terms.

AI processing

The Service uses AI models to prepare and check accounting work. An agent prepares each entry and a second model, from a different AI provider, recomputes it before it posts. To do that, we send the relevant Customer Data to those models.

Our AI providers may process Customer Data only to return results to us. Our contracts with them don’t allow them to train their models on it.

One company’s records never appear in another company’s answers. Models learn from de-identified outcomes under the customer’s agreement, and a shared pattern, like how a vendor is usually coded, is used only once twenty or more companies agree.

AI output can be wrong, which is why a second model checks every entry. Entries above the thresholds a customer sets wait for a person, and the customer’s team signs off the close.

We don’t use AI to make decisions about individuals that have legal or similarly significant effects on them.

De-identified and aggregated information

We may turn information into de-identified or aggregated data that can no longer reasonably identify a person or a customer. We use it to run and improve the Service, and we don’t try to re-identify it.

Legal bases in the EEA and the UK

If you’re in the European Economic Area or the United Kingdom, we rely on these legal bases:

Contract: to provide the Service and respond to your requests.
Legitimate interests: to secure, improve and market the Service, where your rights don’t override those interests.
Consent: for some marketing. You can withdraw it at any time.
Legal obligation: to keep the records the law requires and respond to lawful requests.

We don’t sell personal information. We share it only in these cases:

Scheduling: when you book a demo, Cal.com collects your name, email and the time you choose, so we can hold the call.
Subprocessors and service providers: companies that host and secure the Service, provide the AI models, send email or process payments for us. They may use it only to provide those services to us, under contracts that protect it. Customers can ask for our current list of subprocessors.
The connections you choose: when you connect a ledger, bank or other tool, information moves between it and the Service as you direct. That tool’s own terms and privacy policy apply to it.
Your organization: if you use the Service through your employer or an accounting firm, its administrators can see your activity, including the audit log.
Legal and safety reasons: when the law requires it, or to protect the rights, property or safety of our customers, other people or us.
Business transfers: if we’re involved in a merger, acquisition, financing or sale of assets, information may transfer as part of that deal. It stays protected by this policy.
With your permission: for anything else, when you ask us to or agree to it.

6. How long we keep information

We keep personal information only as long as we need it for the purposes in this policy or as the law requires.

Customer Data is kept for the term of the customer’s agreement. We delete it when the customer asks or when the agreement ends, as the agreement and DPA set out. Copies in backups are deleted as the backups expire.

Account and usage information is kept while an account is active and for a reasonable period afterwards, for our records, security and legal obligations.

7. How we protect information

We use administrative, technical and physical safeguards to protect personal information, including access controls, logging and monitoring.

No system is perfectly secure, so we can’t guarantee the security of information. If a breach affects your personal information, we’ll tell you and the authorities as the law requires.

Our Security page describes our controls in more detail.

8. International transfers

We’re a US company. We and our subprocessors may process information in the United States and other countries, whose data protection laws may differ from yours.

When we transfer personal information out of the European Economic Area, the United Kingdom or Switzerland, we use safeguards the law recognizes, such as the European Commission’s standard contractual clauses.

9. Your rights and choices

Depending on where you live, you may have the right to:

Know what personal information we hold about you and get a copy of it.
Correct information that’s inaccurate.
Delete your information.
Object to or restrict how we use it, or receive it in a portable format.
Withdraw consent you’ve given, without affecting what we did before.
Opt out of the sale of your information, its use for targeted advertising or certain profiling.

You can opt out of marketing emails at any time with the link in each one. We won’t treat you differently for using any of these rights.

How to make a request

Contact us through our website, www.zenday.com. We may need to verify your identity before we act, and we’ll respond within the time the law allows.

An authorized agent can make a request for you, with proof that you’ve authorized them. If we turn down your request, you can appeal by replying to our decision.

If your information is Customer Data, we’ll pass your request to the customer it belongs to and help them respond.

In the EEA, the UK and Switzerland

You can also complain to your local data protection authority.

In US states with privacy laws

California and several other states give residents rights to know, access, correct and delete their personal information and to opt out of its sale or use for targeted advertising. The sections on what we collect, how we use it and how we share it describe the categories, sources and purposes those laws ask about.

The categories of personal information we collect are:

Identifiers and contact details, such as your name, work email and IP address.
Professional details, such as your company and job title.
Commercial and billing information.
Internet and device activity on our website and in the Service.

We use sensitive personal information, such as account sign-in details, only to provide and secure the Service.

We don’t sell personal information or use it for targeted advertising.

10. Children

The Service is for businesses, and our website isn’t directed at children. We don’t knowingly collect personal information from anyone under 16. If you think we have, contact us through our website, www.zenday.com, and we’ll delete it.

11. Changes to this policy

We’ll update this policy as the Service and the law change, and the date at the top shows when it last changed. If a change is material, we’ll tell customers by email or in the Service before it takes effect.

12. Contact us

Questions or requests about this policy or your personal information: contact us through our website, www.zenday.com.