Privacy policy

This policy explains how Kanary Labs, LLC ("Zeebra", "we") handles personal data when you use https://zeebra.ai: the website, the app, the API, the MCP server and the CLI. It covers two different kinds of data, and our role is different for each:

• Your account (you and your team members): we decide what we keep and why, so we are the controller.
• Your contacts (the people your workspace keeps and emails): you decide, and we keep and send for you, so you are the controller and we are your processor. If you are one of those contacts, see If you got an email from one of our customers.

Questions about privacy: write to hello@kanarylabs.com.

What we keep about you

When you create an account or are added to a workspace:

• Account details: your name, email address, password (stored only as a one-way hash), and if you turn them on, your two-factor secret and recovery codes (encrypted) or your passkeys (public keys only).
• Profile and preferences: a profile photo if you upload one, light or dark appearance, the summary email you chose, and whether you closed the "Get started" guide.
• Workspaces: the workspaces you belong to and your role in each (owner, admin or member), invitations you sent or received, and the workspace's settings: name, company name, postal address, logo, brand colour, time zone (taken from your browser when you sign up) and default country (from the country header described below).
• Billing: your plan and its period. Stripe holds your card and invoices; we keep only the Stripe customer id, the card's brand and last four digits, and your subscription's status.
• API and integrations: API keys (stored only as hashes, shown once), apps you connected through OAuth, webhook endpoints and their recent deliveries.
• Signing in with Google: if you choose "Continue with Google", Google sends us your name, your email address, whether Google has verified that address, and your Google account's id. We use them only to create your account or sign you in, and we keep the id so a change of address at Google still finds your account. We ask for nothing else from your Google account (no Gmail, contacts, files or calendar), and we don't share, sell or use this data for advertising. Our use of information received from Google APIs follows the Google API Services User Data Policy, including its Limited Use requirements.
• Sign-in and security: a session while you are signed in (in our database, with your IP address and browser, as Laravel keeps sessions), how and when you last signed in (password, Google or passkey; your browser also keeps that in a cookie to mark it "Last used" on the sign-in page), and short-lived counters of sign-in attempts per address to stop password guessing.
• What you write to us: emails to support and what you tell us there.

We use this to run your account, bill you, keep the service secure, answer you, and send you the emails the service needs (sign-in and password emails, invitations, alerts about your sending, the summary you chose). We don't sell it and we don't use it for advertising.

What we keep for your workspace (your contacts)

Your workspace keeps what you or your sign-up forms, imports, API calls and integrations put in it:

• Contacts: email address, first and last name, job title, company, phone, city, country, your own properties, tags, lists and topics, and their status (subscribed, unsubscribed, bounced, complained, dormant).
• Consent: how and when each contact joined (sign-up form, import, API, added by hand), who added them, and a note. For sign-up forms, the note keeps the page they signed up on and their IP address, as your proof that they asked.
• History and engagement: when each campaign was sent to them and whether it was delivered, opened or clicked, plus a history of their status changes.
• Campaigns, templates and images you create, and the companies and lists you build.

We process this data only to provide the service to you, as you instruct us through the app and the API: to keep it, send your campaigns, track them and protect delivery for everyone. We never sell it, never use one workspace's contacts for another workspace, and never email your contacts for ourselves. Workspaces you connect in a business group share the contacts you choose to share between them.

You are responsible for having a lawful reason to keep and email your contacts, and campaigns in Zeebra only ever go to contacts who opted in (see the Acceptable use policy).

Country without the IP address

A contact's country comes from a header the network in front of our app adds to each request (Cloudflare's CF-IPCountry), read when they sign up, confirm or first click a link. We never look their IP address up ourselves and don't keep it for this.

Opens and clicks

Campaign emails carry a tiny image that tells us when an email is opened, and their links go through our address first so we can count clicks. We record the time of the first open and of clicks on each link, not the IP address or browser of the person opening or clicking. Opens by machines are kept apart and never count as a sign of life: Apple Mail Privacy Protection (which loads every image on delivery from Apple's network), security scanners, and fetches within seconds of sending. Clicks by link scanners don't count either. Unsubscribe and preference links are never tracked.

Address checks

To protect delivery we check contacts' email domains for mail servers and throwaway-inbox services, suggest fixes for obvious typos, and recheck domains from time to time. This looks up domains, not people.

If you got an email from one of our customers

The company that emailed you uses Zeebra to keep its contact list and send its emails. It decides what it keeps about you; we keep and send it on its behalf. To unsubscribe, use the link at the bottom of any of its emails (or your email app's unsubscribe button): it works at once and nobody can undo it for you without your new consent. For anything else about your data, ask that company first; if you can't reach it, write to hello@kanarylabs.com and we'll pass your request on and help it answer.

When you unsubscribe, bounce or mark an email as spam:

• Unsubscribe or spam complaint: you go on that company's do-not-email list, so it can't email you again from Zeebra, even if it imports you again.
• Hard bounce (the mailbox doesn't exist): the address goes on our shared never-email list for 180 days, counted again from each new bounce, so no workspace sends to it. Addresses that are spam traps stay on it for good. This shared list holds only keyed hashes of addresses, never the readable address.

The data product (when available)

Zeebra is building a database of companies and the business contacts who work there (name, job title, company, work email, work phone, LinkedIn page), for customers to search and unlock. It is not open to customers yet. When it is, this section applies:

• We are the controller of that database. We get its data from data providers (listed on the Subprocessors page) and from public sources about companies, and we keep only business contact details, not private life.
• Our lawful basis is legitimate interests: helping businesses find the right person at another business. Customers who unlock a contact must use it lawfully, and those contacts never get campaigns unless they opt in.
• Anyone can ask us at any time to stop showing or selling their details on the Remove my data page, by email, phone or LinkedIn page. We then hide them for every customer, unsubscribe them where customers saved them as prospects, and keep the detail they gave us on our do-not-sell list so they stay removed.

AI

We use AI models, through OpenRouter, to check the content of campaigns and of sign-up forms' emails for phishing, scams and other abuse before they go out, and to suggest tips for more opens. The check reads the email itself (subject, text and links, with merge tags filled with their fallbacks), never your contact list. When the data product is on, AI also turns a search sentence into a search, and compares company names to spot duplicates. We send the AI only what each of these needs.

Who else handles it

We use a small number of service providers to run Zeebra: Amazon Web Services to send email, Stripe for payments, Cloudflare for DNS and the network in front of the app, OpenRouter for AI checks, our hosting provider, Google for domain-level Gmail statistics, and Telegram for our own team's alerts. The Subprocessors page lists each, what it gets and where.

We may also share data when the law requires it, to protect people or the service from fraud and abuse, or with a buyer if Zeebra is sold (who would then be bound by this policy).

Where it is processed

Our app, its database, stored files and backups are in Amsterdam, the Netherlands (DigitalOcean). Emails are sent through Amazon SES in AWS's us-east-1 region, in the United States, and Stripe and our other providers may process data in the United States and elsewhere. Where the law requires it (for example for data from the European Economic Area, the United Kingdom or Saudi Arabia), we rely on the safeguards our providers offer for such transfers, such as the European Commission's standard contractual clauses.

How long we keep it

• Your account: while you have it. When you delete it, it waits 14 days (signing in again or the emailed link restores it), then it is deleted. A workspace whose last owner was deleted is kept for our team to give it a new owner.
• Contacts: until you delete them, or the workspace is deleted. Deleting a contact deletes its history too; an address that unsubscribed stays on the workspace's do-not-email list so it is never emailed again.
• Contact imports: the uploaded CSV file is deleted as soon as the import finishes, or after a day if the import is never started.
• Contacts exports: the CSV file is kept for a day.
• Suppression lists: the do-not-email lists for good; hard bounces on the shared list for 180 days after the last bounce; spam traps for good.
• In-app notifications: 90 days. Webhook deliveries: the newest 100 per endpoint. Gmail statistics: 120 days.
• Billing records: as long as tax and accounting law requires.
• Backups and logs: encrypted database backups are made every 4 hours and thinned out over time: all of them for 7 days, then one a day for 16 days, one a week for 8 weeks, one a month for 4 months and one a year for 2 years. Server logs are kept for 14 days. Both are only used to recover from failures and investigate security problems.

How we protect it

All traffic is encrypted (HTTPS). Passwords, API keys and the shared never-email list are stored as one-way hashes; two-factor secrets are encrypted. Each workspace sees only its own data, and every request checks it. Signed links protect tracking, unsubscribe, restore and download links, and webhooks are signed so you can check they came from us. Access to production systems is limited to the people who run Zeebra, and our team sees a workspace's data only to support it, review abuse or keep the service running.

No system is perfectly secure. If a breach affects your personal data, we will tell you and the authorities as the law requires.

Your rights

Depending on where you live (for example under the GDPR in Europe, the UK GDPR, Saudi Arabia's Personal Data Protection Law or US state privacy laws), you can ask us to:

• tell you what we hold about you and give you a copy;
• correct it, or delete it;
• give it to you in a portable format;
• stop or limit using it, or object to how we use it;
• withdraw a consent you gave.

Much of it you can do yourself: edit your profile in Settings, export your contacts as CSV from the Contacts page, and delete your account in Settings → Profile. For anything else, write to hello@kanarylabs.com from the address on your account. We answer within 30 days, and may need to confirm who you are first. You can also complain to your data protection authority.

If you are a contact of one of our customers, see If you got an email from one of our customers.

Cookies

We use only the cookies the service needs, and no advertising or analytics cookies:

Cookie	What it does	How long
zeebra-session	Keeps you signed in	120 minutes after your last visit
XSRF-TOKEN	Protects forms against cross-site request forgery	Same as the session
remember_web_…	Keeps you signed in, only if you tick "Remember me"	Until you sign out, at most 400 days
appearance	Light, dark or system appearance, so pages open in the right colours	1 year
sidebar_state	Whether the app's sidebar is open or folded	7 days
zeebra_last_login	How you last signed in on this device, marked "Last used"	400 days
zv…	On a public page: counts your view once a day	1 day

Your browser also keeps your appearance choice in its local storage. Stripe's checkout and billing pages, which open on Stripe's site, set their own cookies.

Children

Zeebra is a service for businesses. It is not meant for anyone under 18, and we don't knowingly keep data about children.

Changes

When we change this policy, we update the date at the top. If a change matters, we tell account owners by email or in the app before it applies.

Contact

Kanary Labs, LLC, 30 N Gould St, Ste R, Sheridan, WY 82801, USA. Email: hello@kanarylabs.com.