Privacy Policy

ZeroGen LLC (“ZeroGen”, “we”, “us”) operates the ZeroGen platform, a workspace where creative teams generate, organize and deliver images, video and audio with AI models. This policy explains what personal information we collect when your organization and its people use ZeroGen, how we use it, and the choices you have.

ZeroGen is sold to organizations. Your organization (our “customer”) decides who gets access and what content goes into its workspace. Where our agreement with your organization says something different about customer data, that agreement controls.

This policy covers the ZeroGen web app, the ZeroGen Agent, our MCP connector for AI assistants, and our LucidLink integration. It does not cover third-party services you connect to ZeroGen, which have their own policies.

We collect what you and your organization give us, what the service records as you use it, and what connected services send us.

INFORMATION YOU OR YOUR ORGANIZATION PROVIDE

• +Account details: your name, email address, organization, and role. Sign-in runs through our identity provider; we do not store your password.
• +Workspace content: files you upload, prompts, reference images, generation settings, the images, video and audio you generate, and how you name and organize them in folders.
• +Agent conversations: messages you send the ZeroGen Agent, files you attach, and the Agent’s replies and actions.
• +Billing details: your organization’s name, billing contact, and purchase history. Our payment processor collects your card details; we never see or store full card numbers.
• +Model-provider keys: if your organization brings its own API keys for an AI model provider, we keep them as encrypted secrets and never write them to logs.
• +Messages to us: support requests, and your email address if you join our waitlist.

INFORMATION COLLECTED AUTOMATICALLY

• +Usage and billing records: which models you run, how much you generate, credits spent, and when.
• +Audit records: security-relevant actions, such as approvals of spending and grants of staff support access.
• +Technical data: IP address, browser and device type, request logs, and error reports.
• +Cookies and browser storage: see section 6.

INFORMATION FROM CONNECTED SERVICES

• +Single sign-on: if your organization signs in through its own identity provider, we receive your name, email address, and organization membership from it.
• +LucidLink: when you browse a connected LucidLink filespace, we read file and folder names. Files you import are copied into your ZeroGen workspace, and files you export are written to your filespace.
• +AI assistants: if you connect ZeroGen to an AI assistant through our MCP connector, we receive the requests that assistant makes on your behalf.

We use your information to run ZeroGen for your organization, and we never use your workspace content to train or fine-tune AI models, including any models of our own.

• +Provide the service: sign you in, store and show your files, run the generations you request, and run the Agent.
• +Bill accurately: measure usage, charge your organization, and keep financial records.
• +Keep the service secure: keep each organization’s data separate, detect abuse, and investigate incidents.
• +Support you: answer requests and fix problems. Staff see workspace content only when needed to help, under the controls in section 8.
• +Improve the service: study usage patterns and error reports to fix bugs and plan features.
• +Communicate with you: send service and billing notices and, if you joined our waitlist, product updates you can unsubscribe from.
• +Meet legal obligations: keep required records and respond to lawful requests.

When you generate media or talk to the Agent, we send the content that request needs to the company that runs the AI model, and store what comes back in your workspace.

• +Generations: your prompt, settings, and any reference files go to the provider of the model you chose: OpenAI, BytePlus, fal, ElevenLabs for speech, or sync.so for lip sync. fal hosts models from many developers, such as Google and Ideogram.
• +The Agent: your messages, attachments, and the workspace items the Agent works with go to the company that runs the model in use: Anthropic, OpenAI or Google, or Baseten, reached through Vercel’s AI Gateway.
• +Your own keys: if your organization uses its own API key for a provider, that provider processes the request under your organization’s account and agreement with it.

These providers process requests under their own business or API terms, not ours, and those terms differ. Some providers commit not to train their models on content sent through their APIs. Others, including fal and some of the model developers it works with, may use that content or data derived from it to improve their services. Providers may also keep content for a limited time, for example to monitor for abuse.

When you use ZeroGen through an AI assistant such as Claude or ChatGPT, that assistant’s provider handles your conversation with it under its own privacy policy.

We do not sell your personal information or share it for cross-context advertising. We share it only in these cases:

• +Within your organization: other members of your ZeroGen organization can see shared workspace content according to their roles. Your organization’s admins manage membership and access.
• +Service providers: the companies on our subprocessor list process data on our behalf, under contracts that limit their use to providing services to us.
• +Legal reasons: to comply with law or a valid legal request, or to protect the rights and safety of our users, the public, or ZeroGen.
• +Business transfers: to a successor if ZeroGen is involved in a merger, acquisition, or sale of assets, subject to this policy’s protections.
• +With your direction: when you connect an integration, export to LucidLink, or otherwise ask us to share.

Our subprocessor list names each service provider, what it does for ZeroGen, and the data it handles.

ZeroGen uses the cookies and browser storage it needs to work, plus analytics to improve the website and the app. We use no advertising cookies or trackers.

• +Sign-in cookie: keeps you signed in and identifies your session. It is encrypted and cannot be read by page scripts.
• +Display cookie: remembers a small layout detail, such as how many folders a Library has, so pages load without flicker.
• +Browser storage: remembers interface preferences on your device, such as panel sizes and the last tool you used. This stays in your browser.
• +Error monitoring: records errors and performance timings for a sample of page loads. It does not record your screen or keystrokes.
• +Analytics: measures how people use our website and the app, such as which pages they visit, so we can improve them. We use Vercel Web Analytics, which sets no cookies.

You can clear or block cookies in your browser, but ZeroGen cannot keep you signed in without the sign-in cookie.

We keep personal information only as long as we need it for the purposes in this policy.

• +Account details: while your account is active.
• +Workspace content: until your organization closes its account or asks us to erase it. Deleting a file or conversation in ZeroGen removes it from view; to have it erased from our systems, email privacy@zerogen.com.
• +Billing and usage records: as long as tax and accounting laws require, even after the content they relate to is erased. They show which models ran, how much was generated and what was charged, not the prompts or files.
• +Logs and error reports: for a limited time, to run and secure the service.

We protect your information with technical and organizational safeguards suited to a multi-organization creative platform.

• +Separation between organizations: every request is checked against your organization and role, so one organization cannot reach another’s data.
• +Encryption: data is encrypted in transit and at rest. Model-provider keys your organization supplies are kept as encrypted secrets outside our database and are never logged.
• +Private file links: files are delivered through short-lived signed links, not public addresses.
• +Limited staff access: only a small number of authorized ZeroGen staff can enter an organization’s workspace, and only to provide support or operate the service.
• +Scrubbed diagnostics: error reports exclude secrets and are configured not to collect personal data by default.

No system is perfectly secure. If a breach affects your personal information, we will notify your organization and, where the law requires, you.

You can ask to see, correct, export, or delete your personal information, and we will respond as the law where you live requires.

Your organization controls its workspace. For workspace content and the accounts of its members, your organization decides how the data is used, and ZeroGen processes it on your organization’s instructions as its processor (a “service provider” under California law). Send requests about that data to your organization’s ZeroGen admin first; we will help them respond. Where we decide how data is used, such as for billing or our waitlist, contact us directly.

CHOICES YOU CAN MAKE NOW

• +Remove files and Agent conversations from view in ZeroGen, or ask us to erase them (see section 7).
• +Unsubscribe from product emails through the link in any of them.
• +Clear or block cookies in your browser (see section 6).

RIGHTS THAT DEPEND ON WHERE YOU LIVE

Depending on your location, you may have the right to:

• +know what personal information we hold about you and get a copy;
• +correct inaccurate information;
• +delete your information, except what we must keep, such as billing records;
• +object to or restrict certain processing, or withdraw consent you gave;
• +complain to your local data protection authority.

California residents also have the right not to be treated differently for exercising these rights. We do not sell or share personal information as California law defines those terms.

To make a request, contact us using section 12. We may need to confirm your identity first, and we aim to respond within 30 days.

ZeroGen stores your information in the United States, and our service providers may process it in other countries. Data protection laws there may differ from those where you live.

ZeroGen is a professional tool for organizations and is only for people 18 or older. We do not knowingly collect personal information from anyone under 18. If you believe a child has given us personal information, contact us and we will delete it.

We may update this policy as ZeroGen changes. We will post the new version with a new effective date and tell your organization’s admins about material changes by email or in the app before they take effect.

Questions or requests about your privacy:

• +Email: privacy@zerogen.com