Privacy policy
ZeroIdentity gives AI agents their own email addresses, keys and inboxes. This page says what we collect to do that, what we do with it, and what you can do about it.
Last updated October 4, 2026
1. Who we are
ZeroIdentity is operated by ZeroIdentity (“we”). If you have a question about this policy or about your data, write to support@zeroidentity.app.
2. What we collect
- Your account. Your email address, and your password if you set one. Passwords are stored only as a salted hash, so we cannot read them. If you sign in with Google or GitHub we receive your id with that provider and the email address it has verified, and nothing else.
- Your agents. Their names and addresses, the messages they send and receive (email, webhook payloads and, for accounts in early access, texts and calls), a log of what each agent did, their SSH and API keys, and any webhook addresses you add. Keys are encrypted before they are stored.
- Usage. How many emails, texts and call minutes your account has used this month, so plan limits can be applied.
- Billing. If you upgrade, Stripe takes your payment details. We keep the ids Stripe gives us for your customer record and subscription, never your card number.
- Technical records. The network address a request comes from is counted for a short time to slow down repeated sign-in attempts, and our hosting provider keeps ordinary server logs.
- What sent you here. If you allow it, the site that linked to us, any campaign tags on the link, and the first page you saw. It is saved with your account when you sign up.
Messages sent to your agents by other people are stored in your account like any other mail. If you write to an agent, its owner can read what you sent.
3. What we use it for
- To run the service: deliver messages, show them to you, and give your agents their tools.
- To keep it safe: prevent abuse, spam and attempts to break in.
- To bill you, if you are on Pro.
- To write to you about your account: confirmation codes, password links and notices about the service.
- To learn which sites and campaigns bring people to us, when you have allowed that.
We do not sell your data, we do not show advertising, and we do not use the contents of your agents' messages to train AI models. We read message contents only when it is needed to run the service, to investigate abuse, to fix a problem you have asked us about, or because the law requires it.
6. How long we keep it
- Your account and your agents' messages are kept until you delete them.
- Deleting an agent removes its address, keys, messages and activity log straight away.
- Deleting your account, from Settings, removes everything under it and cancels any subscription.
- Records of webhook deliveries are kept for seven days. Sign-in counters are kept for a few hours. Sessions end after 30 days.
Copies in our providers' backups can take a little longer to disappear. Stripe keeps payment records for as long as the law tells it to.
7. Security
Connections to the service are encrypted. Passwords are hashed, API keys and SSH keys are encrypted at rest, and each agent's API key reaches only that agent's data. No service can promise perfect security. If we learn of a breach that affects you, we will tell you.
8. Your choices and rights
You can read everything your agents hold in the console, delete an agent or your whole account there, and change your cookie answer at any time. For a copy of your data, a correction, or anything else, write to support@zeroidentity.app.
Depending on where you live, the law may give you the right to see, correct, move or erase your data, to object to or limit how it is used, and to complain to your data protection authority. Where the law asks for a legal basis: we process account and agent data to provide the service you asked for, security records because we have a legitimate interest in keeping the service safe, and the record of what sent you here only with your consent. We do not sell or share personal information as California law defines those words.
9. Where data is processed
The companies above may process data in countries other than your own, including the United States. Where the law requires it, those transfers are covered by standard contractual clauses or an equivalent safeguard.
10. Children
ZeroIdentity is a tool for developers and businesses. It is not meant for anyone under 16, and we do not knowingly collect their data.
11. Changes
When this policy changes we will update the date at the top. If the change matters to how your data is used, we will email account holders before it takes effect. The terms cover the rest of your agreement with us.