Privacy Policy
Zoldyck Business Solutions LLC, doing business as ZBS Marketing ("ZBS", "we", "us"), runs lead generation services for businesses, using our own software platform (the "Platform"). This policy explains what information we collect, how we use it, who we share it with, and the choices you have. It covers our website at zbs-marketing.com and the Platform.
Who this policy covers
- Clients and their team members: businesses that hire us, and the people they invite to use the Platform.
- Prospects: people at businesses we may contact on a client's behalf.
- Website visitors.
Information we collect
From clients and their team members
- Account details: name, email address and password. Passwords are handled by our authentication provider, and we never see them in plain text.
- Business details you give us: company name, website, industry, services, postal address, ideal-customer criteria, approved email templates, case studies you approve, and meeting preferences.
- Billing details: billing contact, plan and invoices. Card payments are processed by Stripe, and we do not receive or store card numbers.
- Data from a connected Google account, described in its own section below.
About prospects
- Business information: company name, address, phone, website, category and size, from open data sources (such as Overture Maps), the company's own public website, public news, and lists our clients confirm they are allowed to use.
- Business contact details: name, job title and work email, where available from those sources.
- Email activity: messages sent to you on a client's behalf, your replies, and opt-out requests.
- Meetings you agree to book with a client.
We do not collect, and do not use for lead scoring, sensitive characteristics such as race, religion, health, sexual orientation or political views.
Website visitors
Our website sets no cookies and uses no analytics or advertising trackers. It loads fonts from Google Fonts, which means Google receives your browser's IP address when the page loads. The Platform uses only the cookies it needs to keep you signed in and secure.
Data from Google accounts
A client can connect their own Google account so that emails are sent from their own address and meetings land on their own calendar. Connecting is optional. It is done by an administrator of the client's workspace through Google's sign-in screen, and we never ask for a Google password.
| Google permission | What we do with it | What we keep |
|---|---|---|
Basic profile and email (openid, email, profile) | Identify which Google account was connected and show it in the Platform. | Email address and display name. |
Send email on your behalf (gmail.send) | Send only emails the client's team has reviewed and approved, plus test emails to the person requesting them. We cannot read, search or delete anything in the mailbox with this permission, and we don't try. | A copy of each email we send (recipient, subject, text, time) so the client can see what went out. |
Check calendar availability (calendar.freebusy), optional | See which times are busy so meetings aren't double-booked. This shows only busy and free blocks, not event titles or details. | Nothing. Busy times are checked when needed and not stored. |
Create meeting events (calendar.events), optional | Create, and if needed cancel, the calendar events and invitations for meetings booked through the Platform. | The ID of each event we created, so it can be updated or cancelled. |
- Storage and security. Google's access tokens are encrypted (AES-256-GCM) before they are stored. They are kept where Platform users cannot read them, and are used only by our servers to carry out the actions above.
- Sharing. We do not sell Google user data or share it with anyone except as needed to provide these features (for example, our hosting and database providers store it for us), for security, or when required by law.
- No advertising, credit decisions or AI training. We never use Google user data for advertising, to decide creditworthiness, or to train artificial-intelligence or machine-learning models. We do not send data obtained through Google's APIs to AI providers.
- People reading data. Our staff do not read Google user data unless the client asks us to (for example, to troubleshoot a specific email), it is needed for security, or the law requires it.
- Disconnecting. A workspace administrator can disconnect the account at any time on the Platform's Email setup page. We then revoke our access with Google and delete the stored tokens. You can also remove access at myaccount.google.com/permissions.
How we use information
- To provide our services: find and research businesses that match a client's criteria, prepare outreach for the client's approval, send approved emails, track replies, and book meetings the prospect agrees to.
- To honor opt-outs: every email includes an unsubscribe option, and anyone who opts out is added to a do-not-contact list that is checked before any email is sent.
- To run our business: billing, support, security, preventing abuse, and meeting legal obligations.
Use of AI
We use AI models (currently Anthropic's Claude) to help research public information about businesses, suggest an opening line for emails, and sort replies into categories such as "interested" or "not interested". AI suggestions are only drafts. A person on the client's team approves every email before it can be sent. AI is never given data obtained through Google's APIs.
Who we share information with
We do not sell personal information. We share it only with:
- The client the work is for. Each client sees only their own workspace. Prospect information gathered for one client is not shown to another client.
- Service providers who process data for us under contract: Supabase (database and sign-in), our web hosting provider, Cloudflare (website and email routing), Anthropic (AI processing as described above), Google (when a client connects their account), and Stripe (payments).
- Others when required: to comply with law or legal process, to protect rights, safety or security, or as part of a merger or sale of our business. Google user data is transferred in such a sale only with your prior consent.
How long we keep information
- Client data is kept while the client works with us. After the relationship ends, we delete or anonymize it within 90 days of a written request, except invoices and records we must keep by law.
- Do-not-contact entries are kept indefinitely so that an opt-out keeps being honored.
- Database backups are overwritten on a rolling schedule.
Security
Each client's data is separated at the database level, so one client cannot see another's. Connections are encrypted, Google tokens are encrypted at rest, access is limited by role, and changes are logged. No system is perfectly secure, but we work to protect your information and will notify affected people if the law requires it.
Your choices and rights
- Prospects: use the unsubscribe option in any email, or email us, and we will stop contacting you on behalf of that client. You can also ask what information we hold about you, or ask us to delete it.
- Clients and team members: you can access and update most information in the Platform, disconnect a Google account at any time, or email us to request a copy or deletion of your data.
- Depending on where you live, you may have further rights under local privacy laws. We will respond to verified requests as those laws require.
Our services are for businesses and are not directed to children. We do not knowingly collect information from anyone under 18.
Changes to this policy
We will post any change here and update the date above. If a change affects how we use Google user data, we will notify affected clients and ask for their consent before using the data in the new way.
Contact
Questions or requests: zoldyckbinfo@gmail.com