Zadoosh is operated by Mayank Agarwal (sole proprietorship), registered at 3rd Floor, Plot No. 128/P2, EPIP Industrial Area, Whitefield, Bengaluru, Karnataka 560066, India ("Zadoosh", "we", "us"). For the purposes of the UK and EU General Data Protection Regulation, we are the data controller for the personal data described in this policy.
You can contact us about anything in this policy at [email protected].
Your name, email address and authentication identifiers. If you sign in with Google or Microsoft, we receive your email address and basic profile information from that provider. We never receive or store your password for those accounts. If you sign in with an email and password, authentication is handled by Google Firebase and we do not store the password ourselves.
The information you enter to configure a workspace: your brand name and domain, brand aliases, competitor names, the prompts you choose to track, the locations and AI engines you monitor, and any team members you invite.
Responses that AI assistants return for your tracked prompts, the citations contained in them, and the metrics we derive. This is collected by querying public AI assistants with your tracked prompts. It is not collected from you.
If you connect a third-party account such as Google Search Console, the data we read from it. See section 3.
Subscription status, plan, and billing history. We never see or store your card details. Payments are processed by DodoPayments, which acts as merchant of record and handles all card data.
Pages viewed, features used, approximate location derived from IP address, browser and device type, and server logs. Used to operate, secure and improve the service.
Zadoosh's use and transfer of information received from Google APIs to any other app will adhere to the Google API Services User Data Policy, including the Limited Use requirements.
Connecting Google Search Console is entirely optional. Zadoosh works fully without it. If you do connect it, this section governs that data and takes precedence over anything more general elsewhere in this policy.
A single read-only scope,
https://www.googleapis.com/auth/webmasters.readonly, described by
Google as "View Search Console data for your verified sites". We request the
read-only scope deliberately. It cannot submit sitemaps, request indexing, add or
remove users, or change any property setting, and we have no use for permissions
that could.
We do not read, and do not request access to, your Gmail, Drive, Calendar, Contacts, or any other Google service.
That is the complete list. We do not use it for anything else.
The exceptions, which are the only ones permitted: with your explicit consent (for example, if you ask our support team to look at a problem), where required by law, or where strictly necessary for security purposes such as investigating abuse.
To produce prompt suggestions we send the search query text to Anthropic, which provides the language model that performs the grouping and rewriting. Anthropic processes this as our service provider under contract and does not use data submitted through its API to train its models. No other third party receives your Search Console data.
The access credential Google issues us is stored encrypted at rest on our servers and is never displayed in the product or written to logs. The query data we read is stored in your workspace so the product does not have to re-fetch it on every page load.
You can disconnect at any time from Settings. Disconnecting revokes our credential with Google immediately and deletes the Search Console data we hold for that workspace within 30 days. You can additionally revoke our access at any time, without visiting Zadoosh, from your Google Account permissions page.
We do not sell your personal data, and we do not use your workspace data to train machine learning models.
If you are in the UK or the EEA, we rely on the following bases under GDPR Article 6.
| Purpose | Legal basis |
|---|---|
| Providing the service you subscribed to | Performance of a contract |
| Billing and financial records | Contract, and legal obligation for tax records |
| Reading connected Google Search Console data | Consent, given when you connect and withdrawable at any time by disconnecting |
| Product analytics and service improvement | Legitimate interests in operating and improving the service |
| Security, abuse prevention, and fault diagnosis | Legitimate interests in keeping the service safe |
| Marketing email | Consent, withdrawable by unsubscribing |
We share personal data only with service providers who process it on our behalf under contract, and only as needed to run the service. We do not sell it.
| Provider | Purpose | Location |
|---|---|---|
| Amazon Web Services | Hosting, backups, and outbound email | United States |
| Google Firebase | Authentication and sign-in | United States |
| Anthropic | Language model processing for prompt generation and analysis | United States |
| DataForSEO | Querying AI assistants with your tracked prompts | United States |
| DodoPayments | Payment processing as merchant of record | United States |
| PostHog | Product and website analytics | United States |
| Plausible Analytics | Website analytics, cookieless | European Union |
| Google Analytics | Website analytics | United States |
| Endorsely | Affiliate referral attribution | United States |
We may also disclose data where required by law, to enforce our terms, or as part of a merger or acquisition. If ownership changes, we will tell you before your data becomes subject to a different privacy policy.
The application uses strictly necessary cookies to keep you signed in. These cannot be turned off without breaking sign-in.
On our public website we use Plausible Analytics, which is cookieless and does not collect personal data, alongside Google Analytics and PostHog, both of which set cookies. We use Endorsely to attribute referrals from affiliate partners. You can block analytics cookies through your browser settings or a content blocker without affecting your use of the product.
PostHog runs on both our website and inside the application. If you visit the website and later create an account in the same browser, PostHog links those earlier visits to your account. We use this only to understand how people find and start using the product.
PostHog also records browsing sessions. A recording is a reconstruction of the pages you viewed and how you moved through them, including clicks, scrolling and mouse movement. Text you type into form fields is masked and is not captured. We use recordings to find where pages confuse people. You can prevent recording with a content blocker, and this does not affect your use of the product.
We are based outside the EEA and most of our providers are in the United States, so your data will be transferred internationally. Where we transfer personal data of UK or EEA residents, we rely on the European Commission's Standard Contractual Clauses, or on an adequacy decision where one applies, together with the additional safeguards those clauses require.
| Data | Retention |
|---|---|
| Account and workspace data | For the life of your account, then deleted within 90 days of closure |
| Visibility and citation history | For the life of your account, since the product's value is the trend over time |
| Google Search Console data | Deleted within 30 days of disconnecting, or of account closure |
| Billing records | As long as tax and accounting law requires, typically 7 years |
| Server and security logs | Up to 12 months |
| Backups | Rolling, overwritten within 90 days |
If you are in the UK or EEA, you have the right to access your data, correct it, have it erased, restrict or object to how we process it, receive it in a portable format, and withdraw consent at any time where we rely on consent. Withdrawing consent does not affect processing that already happened.
Email [email protected] to exercise any of these. We will respond within 30 days. There is no charge unless a request is manifestly unfounded or excessive.
If you are unhappy with how we handled your request, you can complain to your local supervisory authority. In the UK that is the Information Commissioner's Office. In the EEA it is the authority in the country where you live or work.
If you are a California resident, you have the right to know what personal information we collect, to have it deleted, to correct it, and not to be discriminated against for exercising those rights. We do not sell personal information or share it for cross-context behavioural advertising.
Data is encrypted in transit using TLS. Access credentials for connected accounts are encrypted at rest and are never rendered in the product or written to logs. Access to production systems is restricted to personnel who need it. No system is perfectly secure, but if a breach affects your personal data we will notify you and the relevant supervisory authority as the law requires.
Zadoosh is a business product and is not directed at anyone under 16. We do not knowingly collect data from children. If you believe a child has given us personal data, contact us and we will delete it.
We may update this policy. The date at the top always reflects the current version. If a change materially affects how we handle your data, we will email account holders before it takes effect.
Mayank Agarwal (sole proprietorship)
3rd Floor, Plot No. 128/P2, EPIP Industrial Area, Whitefield, Bengaluru, Karnataka 560066, India
[email protected]