سياسة الخصوصية · Privacy Policy

ZOK AI ("we") provides an AI business operating system for business owners in the UAE. [Legal entity name, license number, and registered address: pending the company's final trade-name approval — will be completed here once available.]

• At registration: full name, email, company name, sector, and password (stored bcrypt-hashed — we never have access to your actual password).
• Business data you enter yourself: customers, products, orders, invoices, company notes.
• When you use AI features: the conversation content you send to an AI agent.
• When you upload a trade-license document (optional, AI extraction feature): the content of that document.
• When you use the Business Navigator (optional): your business problem description and your answers to clarifying questions — used to generate a structured diagnosis without any AI model or third party involved.
• Internal data about your use of the platform (e.g. your pilot-journey stage and any decline reason you choose to give) to improve the product — never shared with any third party.
• Limited technical logs for security purposes (e.g. IP address, used only for rate-limiting and abuse prevention).

To run the dashboard and its features, to run AI agents when you ask us to, and to protect your account (rate limiting, abuse prevention). We do not use your data for targeted advertising, and we do not sell it to any third party.

Tenant data isolation: every customer/product/order/invoice query in the code is scoped to your company's companyId — actually verified via automated tests confirming another company cannot see your data.

Third parties process specific data only when you use a feature that depends on them:

• Anthropic (Claude API) — only when you use an AI agent; your conversation content is sent for processing.
• Resend — for transactional email (e.g. password reset), when configured.
• Shopify — only if you choose to connect your own store.
• Hosting and database providers (Vercel, and a managed Postgres provider) to technically run the service.

On infrastructure managed via Vercel and a managed Postgres database. [Exact data-center geographic region: pending technical/legal confirmation — we do not assert a specific location commitment until verified.]

We retain your account and business data for as long as your account is active. You can export a full copy of your data, or permanently delete your account and all your company's data yourself, at any time, from the "Account & Data" page inside the dashboard.

You have the right to request access to, correction of, or deletion of your data. To reach us about any of these requests: [official contact channel: pending the founder providing one].

Passwords are bcrypt-hashed, your session is protected by JWTs in HttpOnly and Secure cookies, and rate limiting is active on login/register routes. We do not claim any formal security certification (e.g. ISO 27001 or SOC 2) because we do not currently hold one.