Privacy Policy

1. Who is responsible

The controller is Warike UG (haftungsbeschränkt), Frobenstraße 10, 10783 Berlin, Germany. Write to [email protected] about anything in this policy.

We act in two roles. For your account, payments, the website and the running of Zaistev, we are the controller. For the lists a customer builds and the emails they send, we process data on that customer's behalf, under section 8 of our Terms of Service.

2. Visiting the website

Our content delivery network and our servers process your IP address and browser details for a moment to deliver the page and keep it secure (Art. 6(1)(f) GDPR). Our request logs record the page, the time and the result, not your IP address.

We store your cookie choice in your browser. We load no advertising tools.

If you allow analytics in Privacy choices, the website loads PostHog to count visits. It records the pages you open and the buttons you press. It also records your browser, your device type, and the country and city your IP address points to. These are tied to a random identifier PostHog stores in your browser. What you type is never recorded. The data travels through our own address, and PostHog keeps it in the EU. You can withdraw your consent at any time in Privacy choices (Art. 6(1)(a) GDPR, § 25(1) TDDDG).

Some links carry campaign tags, which name the campaign that shared them. While your tab is open, the website keeps those tags, the site that sent you and the first page you opened. It passes them to sign-up. If you create an account, we store them with it once, to learn which campaign brought it (Art. 6(1)(f) GDPR). They are deleted with the account.

3. Your account

To give you an account we process (Art. 6(1)(b) GDPR):

• your name, email address, password (stored only as a strong hash), language, currency and time zone, and a picture if you add one;
• if you sign in with Google or LinkedIn, the identifier and email address that service sends us;
• if you add a passkey, its public key and a label;
• your organizations, your role, invitations and members;
• your sessions: a session cookie and your browser's description, kept at most 30 days.

To keep Zaistev secure we use your IP address, shortened, to limit repeated attempts, and keep a log of important actions in your organization for 365 days (Art. 6(1)(f) GDPR).

To give each person one welcome, we keep three things beside that decision (Art. 6(1)(f) GDPR): a random browser id in a cookie kept 400 days, your network block, and a hash of your email address. Your network block is your IP address cut short, never the full address.

The sign-up form runs Cloudflare Turnstile, which checks that a person, not a script, fills it in. Cloudflare's Turnstile privacy addendum explains what it reads.

You can erase your own account from Settings at any time. Doing so starts a 14-day grace period before anything is deleted; sign back in at any point during those 14 days and the account is restored, nothing erased. After 14 days, erasure runs and cannot be undone.

If you ask our staff to erase your account instead, for example because you can no longer sign in, they confirm your email address first. They record a reason, then erase it right away, with no grace period.

4. Payments

Card payments run through Stripe and bitcoin payments through Swiss Bitcoin Pay. We never see or store your card details.

We keep your billing name, email address, postal address, tax ID, invoices, credit movements and, if you tell us, why you cancelled (Art. 6(1)(b) and (c) GDPR).

Invoices and credit movements are kept for 10 years, the period German tax and commercial law gives us. Once your account is erased, your name, address and tax ID are cleared from the record; the amounts, dates and invoice numbers stay.

5. Emails and notifications we send you

We send the emails the service needs, such as sign-in links, invitations, receipts and alerts (Art. 6(1)(b) GDPR).

We send product news and tips only if you asked for them (Art. 6(1)(a) GDPR). Every such email has a one-click unsubscribe link.

If an email to you bounces or is marked as spam, we keep your address on a list that stops further sending.

If you allow push notifications, your browser's push service receives a notification address for your device. You can turn them off in your browser or in Zaistev.

6. AI features and agents

When an agent works on our model, the instruction and the material it needs are sent to Anthropic, which provides the model. It is not used to train the model.

You may sign an agent in to your own Claude or Codex account, or store a website login in your vault. We encrypt those credentials with keys held in AWS Key Management Service. They are used only for the tasks you give.

7. How our team learns about events

Our team is told in a private Slack workspace when someone signs up (name and email address), when a payment arrives, and when an email to a customer fails. This keeps support responsive (Art. 6(1)(f) GDPR).

If you join the waitlist or write to us, we keep your email address and message to answer you.

8. If Zaistev has read your public profile

This section is for people who never signed up, whose public Instagram profile was read at a customer's request (Art. 14 GDPR).

What we read: your username, name, biography, website, and follower and following counts. Also whether the account is verified or a business, its category and its city. We read an email address or phone number only if you made it public on your profile. We may add simple derived fields, such as language or likely field of work.

Where it comes from: your public profile, through a specialised data provider. We never sign in to your account or read private profiles or messages.

Why: our customers look for business contacts in their market. We and they have a legitimate interest in finding them in what you chose to make public (Art. 6(1)(f) GDPR).

Who receives it: only the customer whose search found your profile.

How long: it stays in that customer's workspace until the customer deletes it or ends their account.

Your rights: you may object at any time, and ask what we hold or that we delete it. Write to [email protected] with your username. We delete your profile from every list we hold. A customer who exported it before must answer for their own copy; we tell you who they are on request.

9. Who receives data

We do not sell personal data. These providers process it for us, each only for its task:

• Amazon Web Services (Ireland): servers, database, backups, logs, encryption keys, and sending our emails;
• Cloudflare (United States): content delivery, protection of the website and app, and the sign-up check;
• PostHog (data kept in the EU): website analytics, only after you allow it;
• a specialised provider of public Instagram data: reading public profiles;
• Stripe (Ireland and United States): card payments;
• Swiss Bitcoin Pay (Switzerland): bitcoin payments;
• Resend (United States): sending our emails, alongside Amazon;
• Anthropic (United States): the model behind agents;
• Slack (United States): our team's notices; once a message is posted, it cannot be recalled;
• your browser's push service, if you allow push notifications.

Google and LinkedIn receive data only if you choose to sign in with them, under their own policies.

We disclose data to authorities only when the law obliges us to.

10. Transfers outside the EU

Where a provider processes data outside the EU or the EEA, we rely on an adequacy decision or on the EU Standard Contractual Clauses. Adequacy decisions include the EU-US Data Privacy Framework and the one for Switzerland.

11. How long we keep data

• Account data: while the account exists, then a 14-day grace period before deletion; signing back in during those 14 days cancels it. An erasure staff carry out at your request, for example because you can no longer sign in, runs immediately, with no grace period.
• Sessions: at most 30 days.
• Organization activity log: 365 days.
• A record of staff actions on your account: kept indefinitely, so the action can always be checked; your name is cleared from it.
• Your address on our do-not-email list is kept indefinitely, even after everything else about you is erased. This follows once a message to you has bounced or you reported one as unwanted.
• Server logs: 30 days. Database backups: 7 days.
• Invoices and credit movements: 10 years.
• Profiles in a customer's lists: until the customer deletes them or ends their account.

12. Security

Data travels encrypted. The database is encrypted and not reachable from the internet. Passwords are stored only as strong hashes, and secrets in the vault are encrypted with managed keys.

Only staff who need it can reach customer data. Their access is granted per person, logged, and watched by alarms.

13. Your rights

You may ask for access to your data, its correction or deletion, a restriction of its use, or a copy to take elsewhere. You may object to processing based on legitimate interest, and withdraw a consent at any time without affecting what happened before.

Write to [email protected]. We answer within one month.

You may also complain to a data protection authority. Ours is the Berliner Beauftragte für Datenschutz und Informationsfreiheit.

We make no decision about you that has legal or similarly significant effects by automated means alone. Lead scores help our customers sort their own lists.

14. Changes

We update this policy when what we process changes. The date at the top shows the current version; we email account holders about material changes.