Privacy policy

Who we are

Zazen (https://app.getzazen.com) is bookkeeping software run by Zazen, LLC. You keep your books in it yourself, through its web app, or through an AI assistant you connect to it (the Zazen connector).

Zazen, LLC is based in Palm Beach, Florida.

The records in your books, including your customers, vendors, invoices and the other people and businesses they mention, are your data. You decide what goes in and who can see it; we hold and process it on your behalf, only to provide Zazen to you.

What we collect

• Your account: your name and email address, from the sign-in service, and when you last signed in.
• Your books: accounts, transactions, journal entries, reconciliations, rules, tags, saved views and notes — whatever you or your connected assistant record.
• Names of the people and businesses in your books (vendors, customers and other parties) and the details your documents carry about them.
• Documents you upload (receipts, invoices, bills, bank and card statements) and the details read from them, such as dates, amounts and reference numbers.
• Bank and card activity you import from files: dates, amounts and descriptions. Zazen does not connect to your bank.
• Bank and card account numbers: the fields we keep hold only the last four digits. A document you upload is stored exactly as uploaded, so a full number printed on it is in the stored file — black it out before uploading if you don't want it kept.
• Connected assistants: which assistants you have authorized, the name shown for each, when it was first authorized and last used, and the access level you set for it.
• An audit trail of changes: who or which assistant made each change, when, the record before and after, and the reason an assistant gave for it.
• Your organization: its members, their roles, and which books each person can see.
• Technical data: the hosting provider's request logs and page-performance measurements, kept for up to 60 days.

What we do not collect

• Your conversations with an AI assistant. The connector receives only the requests the assistant sends to it (for example, "record this receipt" with its details) and returns the data asked for. It does not receive or store your chat history.
• Full card or account numbers, bank passwords or bank login credentials: Zazen never asks for them, and its own fields keep only the last four digits (see above for uploaded documents).
• Advertising or cross-site tracking data. We show no ads and do not track you across other sites.
• Tax identification numbers, such as an SSN, EIN or ITIN. Please don't upload documents that show one (for example a W-9); Zazen doesn't need them.

Why we use it

• To run the service: keep your books, produce your reports, and show you and your connected assistants what you have access to.
• To keep it secure: sign you in, enforce who can see and change each book, and keep the audit trail.
• To fix and improve it: an assistant can report a problem with the connector, which opens an issue for our team. Those reports carry the assistant's own description of the problem and internal record ids; we do not attach your amounts or transaction text.

Who processes it

We use these service providers to run Zazen. We do not sell your data, share it with advertisers, or use it for advertising.

• Vercel — hosts the app and stores uploaded documents (Vercel Blob); also measures page performance (Vercel Speed Insights).
• Neon — the Postgres database that holds your books.
• WorkOS — sign-in and account identity, and the authorization of connected assistants; it also sends the sign-in and invitation emails.
• GitLab — receives the problem reports an assistant files through the connector.

When you connect an AI assistant (such as Claude or ChatGPT), it receives the data you ask it to read or change through the connector. What that assistant's provider does with it is governed by your agreement with that provider, not this policy.

How long we keep it

Your books, documents and audit trail are kept while your account is active, so your records stay complete. If your books have been read-only for 90 days because the free period ended without a subscription, we may delete them; we will email you first. When you ask us to delete your account, we delete your books and documents; copies in our providers' backups expire on their own within 30 days. Hosting logs are kept for up to 60 days.

Archiving a book hides it but keeps everything in it. When you delete a document, its record is removed at once and its file is erased from storage just after; if that erasure fails, it stays queued and is retried. Copies in backups expire within 30 days. The audit trail is permanent while the book exists and records only that a document was deleted, not its contents.

Your choices

• Export: download a book's reports and ledger for any period as a spreadsheet workbook, from the Reports page.
• Connected assistants: see each one, lower what it may do (read only, record but not post, or post), or disconnect it at any time, in Settings › Connected agents.
• Access: the people who manage your organization decide who can see each book, and can remove a person's access.
• Corrections and deletion: correct your records in the app. To have your account or books deleted, email us at info@getzazen.com and we will delete them within 30 days.
• Your rights: you can ask us what data we hold about you, for a copy of it, or to correct or delete it, by emailing info@getzazen.com. We will respond within 30 days.

Security

How we protect your books:

• Every book is separated in the database itself: each request can read only the books its user has been granted, and the app connects with a restricted database role that cannot turn that check off.
• Each person has their own access level on each book, from read-only to admin.
• Uploaded documents are kept in private storage with no public address. A file is handed out only after the same access check. A download link given to an assistant is signed, works for one file and one person, and expires within minutes.
• Our own fields keep only the last four digits of card and bank account numbers; the database refuses anything longer.
• We never see or store your password: sign-in is handled by WorkOS.
• Changes to your books are recorded in an audit trail showing who made each change and, for an assistant, the reason it gave.
• The app is served only over HTTPS, and browsers are told never to load it any other way.

Connected assistants:

• An assistant signs in through your own account; you never give it a password or key.
• Each assistant is limited to the access ceiling you set for it, and never more than your own access.
• An assistant can never manage your organization or grant anyone access; only a person can.
• You can disconnect an assistant at any time.

Our providers: the database (Neon) and document storage (Vercel Blob) encrypt stored data with AES-256, and every connection to the database is encrypted in transit.

On our side, access to production data is limited to people who need it for their job responsibilities.

If we learn of a security breach that affects your data, we will notify you without undue delay, and as required by law. To report a security issue, email info@getzazen.com.

Changes and contact

If we change this policy, we will update the effective date above and email account holders about the change. Questions: info@getzazen.com.

Zazen is for businesses and is not intended for anyone under 18. We do not knowingly collect data from children.