Privacy Policy

← Back to Zolu

This Privacy Policy explains how Zolu Labs LLC ("Zolu", "we", "us") collects, uses and protects information when you use getzolu.com, app.getzolu.com, zolu.me, our Zolu Cards (including NFC cards and stands) and related services (together, the "Service").

If you have questions, write to privacy@getzolu.com.

1. Who is responsible for your data

For your account and workspace data (your profile, projects, tasks, docs and settings), Zolu is the controller.
For contacts collected through your cards and QR codes (for example, when someone taps "Exchange contact" on your card and leaves their details), you, or the workspace you belong to, are the controller, and Zolu processes that information on your behalf, following your instructions. If you are one of those contacts and want your data removed, you can contact the card owner directly or write to us and we will forward your request.

2. Information we collect

Information you give us

Account: name, email, password (stored hashed by our authentication provider) or your Google sign-in, profile photo, job title, language and time zone, and an optional phone number, which is private: we use it only to suggest your country code, never for marketing, and it is shared only if you turn on a Zolu Club sharing switch (section 5b).
Workspace content: projects, tasks, comments, docs, files and anything else you create or upload.
Shared pages and external guests: a page shared with a public link can be read by anyone with the link (it is hidden from search engines). If a workspace invites you to comment as an external guest, we receive your name and email from them, email you a PIN (we keep only a scrambled version of it), and keep your comments in that workspace, which is responsible for them (see section 1).
Cards and pages: the information you choose to publish on your Zolu Card or Link page (name, title, company, photo, logo, phone, email, links, bio). Anything you publish on zolu.me is public and can be seen by anyone with the link. Company cards and Link pages can be found in search engines by default, personal cards cannot; you can change this with "Show my page on Google".
Contacts: details that people share with you through your card (name, email, phone, company, note) and contacts you add or import yourself.
Zolu CRM — permission to be written to. When a card belongs to a workspace with Zolu CRM, the "Exchange contact" form shows an optional box, unchecked, that says "You can write to me on WhatsApp or SMS". If you check it, we save that permission for WhatsApp and for SMS, with the exact text you saw and the date. We never save your IP address. The card owner's workspace uses it to know that it may write to you; you can ask them, or us, to withdraw it at any time.
Zolu CRM — where you came from. We save which card you used and, if you arrived through one of that workspace's QR codes, which QR code. We also save the language of the form you filled in so they can write to you in it. Nothing about your device or connection is added.
Zolu CRM — deals and follow-ups. The workspace can open a deal for you and a first follow-up task (for example, "Write to Lucía"). They are part of that workspace's content (see section 1).
Zolu CRM — messages written from Zolu. Except the notices a person asks for on a form (section 5e), Zolu does not send WhatsApp messages, texts or emails for the workspace: it opens the team member's own app with a message ready. When they open it, we keep the text they wrote, the channel, the language and the date in your contact history, so the team knows what was said. They can remove it within 24 hours if they did not send it. When the workspace exports its contacts as a spreadsheet, only the number of messages and the date of the last one are included, never the text.
Zolu CRM — business cards read with AI. When a team member scans your business card in a workspace with Zolu CRM, our AI providers (section 5) also read the main language of the card, under the same rules as the rest of the scan.
Waitlist and reserved names: your email, language, how you found us (for example a campaign link) and the zolu.me name you reserve. To prevent abuse we keep a scrambled code of your connection, never your IP address.
"Notify me when Pro opens": if you ask us to tell you when a paid plan (Pro or Business) can be bought, in the app or on getzolu.com, we keep your email, the plan, your language and the exact consent you accepted. We use it only to email you once when that plan opens, never for anything else, and you can ask us to delete it anytime.
Purchases (when available): shipping name and address and order details. Payments are processed by Stripe; we never see or store your full card number.
Support and communications: messages you send us.
Applications and requests: if you apply to Zolu Ambassadors, ask for a quote or ask to be notified about a product, we keep what you send. Feedback: if you include a screenshot, it shows the page you were on, which may include your workspace's content. Reports: if you report a card or a club, we keep the reason and your comment, not your name or IP address.
Verification (Verified by Zolu badge): the links you submit, the result of our checks of those links, and, for businesses, the email at your domain and the DNS record we check. We do not ask for ID documents. When we approve, we save the name and photo published on your card at that moment.

Information we collect automatically

Card and QR analytics: when someone views your card, taps your NFC card or scans your QR code, we record the date and time, approximate country and city (from network headers), device type, operating system, browser language and the source (for example NFC, QR or link). We do not store visitors' IP addresses in these analytics.
Usage and diagnostics: pages and features used, errors and performance data, to keep the Service working and improve it. To count visits to our websites we use Vercel Web Analytics, without cookies: it doesn't store your IP address and counts visits with a code that is discarded after 24 hours. On zolu.me we count visits and taps anonymously, without cookies, to improve Zolu (PostHog).
Cookies and similar technologies: see section 7.

3. How we use information

We use information to:

provide, maintain and secure the Service (including sign-in, sync and backups);
show your public card and deliver the contacts people share with you;
create the follow-up tasks and reminders you ask for;
send service emails (invitations, notifications, security alerts, receipts);
process orders and ship physical products;
measure and improve the Service, and fix errors;
prevent abuse, fraud, spam and malicious links (for example, checking the destinations of QR codes and short links);
comply with legal obligations.

We do not sell your personal information, and we do not use your workspace content or your contacts to advertise to you or to anyone else.

AI features: when you scan a business card, the photo is sent to our AI providers (Google Gemini API, with Anthropic Claude API as a backup) only to read the contact details. In Zolu Docs, when you use Zolu AI, the text you select (or, for "Ask the wiki", parts of the pages you can see) is sent to the same providers only to generate the answer. Under their paid API terms, neither provider uses what we send, or the answers, to train its AI models (Google may use it only for the systems that detect misuse). They may keep it for a limited time to detect and prevent misuse, keep their services secure and meet legal requirements: Google keeps it for up to 55 days, and Anthropic deletes it within 30 days, unless it is flagged as violating Anthropic's usage policy, in which case Anthropic may keep it for up to 2 years. These time limits are the ones each provider publishes as of the date of this policy. If you keep "Save photo" on, the photo is stored with the contact in your workspace and is deleted when you delete the contact. We record which model was used and how many tokens it took (never the content) to measure costs. AI answers can be wrong: review them before using them.

AI follow-up messages (Zolu CRM): if you ask Zolu AI to write a follow-up message, we send the contact's first name, company and title, where and when you met, your latest note about them, the channel and language, and your name to Google (Gemini) or Anthropic (Claude) only to write that draft. They don't use it to train their models. Zolu never sends the message: you review it, edit it and send it yourself from WhatsApp, your phone or your email. We keep a record of each request and its cost, but not the draft, unless you send it and it's saved in the contact's timeline.

Integrations you turn on: if a workspace owner or admin sets up a webhook, Zolu sends the event (for example, a new contact from a card or a QR scan, without IP addresses) to the address they chose, such as Zapier, Make or their own server. If a workspace owner asks us to connect their customer relationship management (CRM) tool, new contacts from their cards are sent to that tool. In both cases the workspace decides, and that tool's own terms apply to what it receives. The weekly contacts export is emailed only to the owners and admins the workspace chooses. With Zolu CRM, the workspace's webhooks can also receive new contacts and deal changes (created, moved to another stage, won or lost). If the workspace asked us to connect its CRM tool, that tool receives the people who shared their details through a card or a club, and the people that become a deal in Zolu: their name, email, phone and company, which part of Zolu they came through (Cards, Club or CRM), the stage of the deal, and whether they gave permission to be written to on WhatsApp, by text message or by email. It never receives the deal's amounts, notes, messages, the language, or the card or QR code they used. Contacts that are only imported or added by hand are not sent to that tool unless they become a deal.

QR reader: the camera is read on your phone and images are never sent to us. If the code is a link, we check it with Google Web Risk before you open it. If it is a Zolu card and you save it, we save only what that card shows publicly and count one anonymous scan for its owner.

Cards we prepare for businesses. We may prepare a free preview card for a business using information from its public website, with the help of our AI providers, and send it to the business's public contact details. We keep the business name and the contact details we used, and count how many times the link was opened (without recording who). If the business does not claim the card within 30 days, we delete the preview. The business can ask us to stop at privacy@getzolu.com.

Emails on behalf of card owners. If you leave your details on someone's card, or they send you their card from Zolu, we email you on their behalf ("<Name> via Zolu"). Every such email has a link to stop receiving them from that person; we keep only a scrambled version of your email to respect that choice.

4. Legal bases (EEA and UK users)

We process personal data to perform our contract with you, based on our legitimate interests (security, product improvement and preventing abuse), with your consent where required (for example, marketing emails), and to comply with the law. We do not use analytics or advertising cookies, so we do not ask for cookie consent; the cookies we use are listed in section 7.

5b. Zolu Club and Collabs

Zolu Club lets you join clubs (for example running clubs), use a digital pass to get perks at local businesses, and check in to club events. Collabs lets creators apply to offers from businesses. The first partner clubs are called "Ambassador Club". This section explains what is shared, with whom and for how long.

Age. Zolu is for people 16 and older, but Zolu Club and Collabs are only for people 18 and older. You must confirm you are 18 or older to join a club, create one, turn on your pass, use perks for everyone on Zolu Club, create a creator profile or apply to a Collabs offer. We only ask you to confirm it; we do not ask for ID documents.

What a club organizer sees. When you join a club, its organizers (and the owners and admins of the workspace that runs the club) see your name, your profile photo, your role, when you joined, the events you said you would attend, your check-ins and how many people joined with your invitation link. Your email and phone are not included unless you turn on sharing (see below). Other members only see you if you turn on "Appear on the club's public page", which is off by default; then anyone who visits the club's page sees your name, and the title and photo of the Zolu card you joined with (if you have no published card with a photo, your profile photo). If you are an approved Zolu Ambassador, your first name and your number of invites appear in your campus ranking.

Sharing your contact: only with your permission. Your name, email, phone (if you added one to your profile) and job title are shared with a business or a club organizer only if you turn it on, with one of these switches:

"Share my contact with <business>" on your pass: your contact reaches that business when you redeem a perk there.
"Share my contact with the organizer" in a club: your contact reaches the organizer when you check in to one of the club's events, and it appears in the members file the organizer can download.
The optional box, unchecked by default, when you apply to a Collabs offer: your contact reaches that business when you apply.

All of them are off by default. Once shared, your details are saved in that business's or organizer's Contacts in Zolu, and they may store and use them in their own tools, for example through a webhook or a CRM they connect. For what they do with your details there, that business or organizer is responsible (see section 1). Turning a switch off stops future sharing, but it does not remove what was already shared; to have it removed, ask that business or organizer, or write to us and we will forward your request. If you leave a club, or the organizer removes you, sharing with that organizer stops.

Sharing is not permission to send you marketing. Turning on sharing never signs you up to a newsletter or a mailing list. You only receive newsletters if you sign up for them separately, and every one of them includes a link to unsubscribe.

Your sharing history. Every time you turn sharing on or off, or give permission when you apply to an offer, we record the date, the business or organizer, and where it came from (your pass, a club or a Collabs offer). We never record your IP address. You can see this history in your account, in Settings → Contact sharing. A business only sees the date and where the contact came from, never your history.

Creators only see numbers. If you are a creator in Collabs, you see how many redemptions were made with your code, how many of them were new customers for the business and how many times your link was opened. You never see who those people are. The business you apply to sees your creator profile (built on your published Zolu card, with the numbers you report yourself), your message and your posts' links, plus whether each collab was done or missed. Your creator page on zolu.me is public: it shows your published Zolu card, the numbers you report yourself and how many collabs you completed or missed, never comments. The link you share with your code shows your first name and the business.

Your pass. When you open your pass on a phone with a connection, the phone receives a secret that stays on that phone (we also keep a copy, to check the codes), along with a short 4-character id for that phone. The code on your pass changes every 30 seconds and, once the pass is open, it keeps working without a connection. Signing out removes the pass from that phone, and you can close it on your other phones at any time. You can have up to 5 phones at a time.

What businesses see. A business only sees numbers about its perks: how many people viewed them, how many used them, how many came back and how many shared their contact. It never sees who viewed a perk, and it cannot see the list of redemptions. At the register, the person scanning your pass sees only your first name and your initials, while you are in front of them, so they know the pass is yours.

Location. "Perks near you" uses your phone's location only if you allow it, and the distance is calculated on your phone: your location is never sent to us or stored. When you check in at an event with the door QR code, sharing your location is optional: if you share it, it is sent once to compare it with the event's meeting point (within 300 meters), and we only keep whether it was verified or not. We never store your coordinates.

No IP addresses. Zolu Club does not store IP addresses. To count visits to a club page, views of a perk or opens of a creator's link without counting the same person twice, we use a code that is calculated with a key that changes every day; the key is discarded the next day, and these codes are deleted after about two days. Reports about a club are kept with that same kind of daily code, never with your IP.

How long we keep Club information

Your membership, check-ins, the events you said you would attend and your streaks: while you are in the club and your account exists. If an organizer removes you, the club keeps your membership as "removed" so it can be restored.
Redemptions: kept so businesses and clubs keep their numbers. If you delete your account, they stay as anonymous numbers, without any link to you.
Your sharing history: while your account exists. If you delete your account, it is deleted; the business's contact keeps only the date it was shared, where it came from (a redemption, a check-in or an offer application) and the business, and nothing else about you.
Your phones for the pass: while your account exists. A phone you closed can no longer be used.
Your requests to join a club that needs approval: while your account and the club exist (only to apply the limit of 3 requests per club). The organizer cannot see them.
Your creator profile: while your account exists.
Your Collabs applications: while your account exists. If you delete your account, each collab stays with the business as "Deleted creator", only with its numbers (the visit date, what was gifted, whether it was done or missed, the redemptions made with your code and how many times your link was opened), without your name, photo, message, post links or reply. Your creator code (it starts with your first name) is replaced by one that does not identify you, also on the redemptions, and your link stops working.
Collabs pauses: if you miss three collabs, your access is paused for 90 days. We keep the dates, the number of misses, the explanation you send and the Zolu team's decision and reason while your account exists, to apply the rule.
Shipping address for the Zolu Card you earn with 25 invites: used only for that shipment, and deleted if the request is rejected, 90 days after the card ships, or 90 days after it was approved if it was never shipped (the reward then shows "Expired" and you can request it again with a new address).
Daily codes used to count visits and views: deleted every day (they are never kept for more than about two days).
Visit, perk-view, link-open and sponsored counts: kept only as daily totals, with no information about who.
What was shared into a business's or organizer's Contacts: it belongs to that business or organizer and stays until they delete it.

If you delete your account, we delete your club memberships, the events you said you would attend, your check-ins, your streaks, your phones for the pass, your sharing switches and history, your creator profile and your Collabs pauses. Your Collabs applications stay with each business only as "Deleted creator" with their numbers, without anything that identifies you. What was already shared into a business's or organizer's Contacts is not deleted, because it is theirs (you can ask them to delete it); for each one, the business keeps only the date, the origin (redemption, check-in or offer application) and that it came through Zolu Club, never your sharing history. Your redemptions stay only as anonymous numbers.

5c. The Zolu app (iOS and Android)

The Zolu app for iPhone and Android uses the same account and the same rules as the rest of the Service. This is what it collects and why:

Your account: your name and email address, to sign you in and run your account. When you sign in, Cloudflare Turnstile checks that you are a person, not a bot.
Photo: only the profile photo you choose, if you add one.
Find my logo: if you use "Find my logo", we read the public website you enter to find your logo. We only keep the image you choose and, for one hour, an anonymous search counter to prevent abuse.
Your user ID: to connect the app to your account.
Customer email: if you resend a customer's loyalty card from the app, we use that customer's email address to send it.
Camera: only to scan the code on a customer's card. We do not save photos or video from the camera.
NFC: only to read Zolu chips. We do not read other cards.
Face ID or fingerprint (optional): handled by your phone. Zolu never receives your face or fingerprint data.
Notifications: only if you allow them. We keep your device's notification token to send you notices about your account and your cards. Promotional notices are optional.
Technical data and errors (Sentry): app version, phone model, operating system and crash and performance details, linked only to your user ID, to fix errors.

The app does not collect your location, the contacts on your phone, your browsing or search history, purchases, financial or health information, messages or audio. We do not sell your data, the app has no ads, and we do not track you across other companies' apps or websites.

Age. You must be 16 or older to use the app.

Deleting your account. In the app, go to Account → Delete account. On the web, go to app.getzolu.com → Settings → Security. Learn more in our help center: zolu.info/account/trash-and-delete-account.

5d. Instagram and Facebook (Meta)

If you connect your Instagram or Facebook account to Zolu, we will receive from Meta only what you approve on its permission screen:

your Instagram ID and username;
your name and profile picture;
the messages and comments we process to send the automatic replies you set up.

We will use this information only to run the automatic replies you turn on. We will not sell it, use it for advertising or use it to train AI models.

Disconnect and delete. If you connect it, you can disconnect it in the app at Settings → Integrations → Instagram → Disconnect, and we will delete the information we received from that account. You can also remove Zolu in Meta's settings (Apps and websites), delete your Zolu account, or email privacy@getzolu.com. If you write to us, we confirm we received your request within 7 days and finish within 30 days. Step by step: getzolu.com/data-deletion.

5e. Text messages (SMS)

Zolu may send text messages in two cases only:

Sign-in codes: when you type your mobile number on the Zolu sign-in screen and ask for a code, we text you a one-time code. We use your number to sign you in and to keep your account secure.
Notices you ask for on a business's form: when you fill out a form on a business's Zolu page (for example a catering or event request), the form has a separate box, unchecked by default, to receive text messages about that request. We only text you if you check it. We save the exact text you agreed to and the date.

Message frequency varies. Message and data rates may apply. Reply STOP to stop receiving texts and HELP for help, or write to us at hello@getzolu.com. Stopping texts does not affect your account or your request.

We send texts through our text-message provider (Telnyx), which receives your number and the message only to deliver it. We do not share or sell mobile phone numbers or SMS opt-in data with third parties for their marketing purposes. Text messaging originator opt-in data and consent will not be shared with any third parties.

6. International transfers

Zolu is based in the United States and our providers may process data in the United States and other countries. When we transfer personal data from the EEA, the UK or other regions, we use appropriate safeguards such as Standard Contractual Clauses.

7. Cookies

We use:

Essential cookies to keep you signed in, protect forms from bots (Cloudflare Turnstile) and remember your language.
A referral cookie (up to 30 days) to remember which partner or campaign brought you to Zolu.
Functional cookies that remember what you were doing before signing up (for example a name you were claiming, an NFC card you were activating or a club invitation), for up to 30 days; that you unlocked a password-protected QR code (12 hours) or signed in as a guest on a shared page (30 days); and that a device is connected as a club register (1 year). On your device we also store your theme and menu preferences and, to work offline, a copy of Docs pages you opened (deleted after 7 days without opening them, or when you sign out) and your Zolu Club pass.

No analytics or advertising cookies. Zolu does not use analytics or advertising cookies anywhere. In the app, we count the pages you view linked only to your account ID, and nothing is stored on your device for this. On getzolu.com and zolu.me, analytics work without cookies and are anonymous. On zolu.me, the browser also keeps a note that lasts only for that session so the same contact download or sponsored place is not repeated or counted twice.

You can control cookies in your browser settings. Blocking essential cookies may break parts of the Service.

8. How long we keep information

Account and workspace data: while your account is active. Deleted items go to the Trash and are permanently deleted after 30 days, or earlier if an owner or admin deletes them forever.
Contacts: until you or your workspace delete them. Deleting a contact removes their details, the answers they submitted, notes and related records permanently.
Zolu CRM: permissions, where a contact came from, deals, tasks and messages written from Zolu stay while the contact exists in that workspace and are deleted with the contact or with the workspace.
Card analytics: kept in aggregated form; individual view records are kept for up to 13 months.
Waitlist: until you create an account or unsubscribe; we email you when Zolu opens.
Reserved names: kept for 90 days if you do not create an account.
"Notify me when Pro opens": until we send that one email, or earlier if you ask us to delete it (write to privacy@getzolu.com). That email will include a link to unsubscribe.
Verification records: kept with the card while it exists, so we can review or pause the badge; deleted when the card or your account is deleted.
Ambassador applications, quotes and product notices: kept until you ask us to delete them.
Orders and invoices: as long as required for tax and accounting purposes.
What we send to our AI providers: we do not keep the photos or text we send (only a scanned card's photo, if you keep "Save photo" on); our AI providers keep them for the limited time described in section 3.
Backups: deleted data and files may remain in encrypted backups (our database provider's and our own copy on Cloudflare R2) for up to 8 days before they are deleted.

When you delete your account (Settings → Security), we delete your profile, your private pages and your personal cards right away, and we remove your name, photo, phone and email from any team cards. Your zolu.me addresses stay blocked for 90 days so nobody else can take them and pretend to be you; we keep only the address and the date. What you created for your team (tasks, comments, shared pages, company cards and contacts) stays in its workspace, no longer linked to your account. For paid orders we keep only what tax law requires: the order number and dates, the products, quantities and amounts, the tax, the payment reference and the city, state, postal code and country of delivery. We remove your name, email, street address and engraving. Any other personal information is deleted or anonymized within 30 days, except where we must keep it for legal reasons.

For Zolu Club and Collabs, see section 5b.

9. Your rights

Depending on where you live, you may have the right to access, correct, delete, export or restrict the use of your personal information, to object to certain processing, and to withdraw consent. California residents have the right to know, delete and correct their information and to not be discriminated against for using these rights; we do not sell or "share" personal information for cross-context behavioral advertising.

Many of these actions are available directly in the app (edit profile, export contacts, delete items, delete account). In workspaces with Zolu CRM, owners and admins can also download everything the workspace keeps about one contact, as a JSON or CSV file, when that person asks for their data; each download is recorded. For anything else, email privacy@getzolu.com. We confirm we received your request within 7 days and respond within the time required by law (deletion requests are completed within 30 days). We may need to verify your identity. You can also complain to your local data protection authority.

10. Security

We use encryption in transit, access controls that isolate each workspace's data, the principle of least privilege for our team, and regular reviews. No system is 100% secure; if we learn of a breach that affects you, we will notify you as required by law.

Access by the Zolu team. Zolu staff may access account data, with limited and logged access, to provide support, diagnose problems, keep the service secure, or comply with the law. A read-only view does not change anything and does not notify you each time; it never shows full payment details or the content of private messages. Separately, to give support, investigate abuse or fix a problem, authorized members of the Zolu team may enter your workspace as a temporary administrator (for up to 2 hours) or use the Service as you would see it (for up to 1 hour). They always record a reason, every access and change is logged, and you get a notice in your Inbox. While doing this they cannot see your password, change your email or password, or make payments.