1. Controller
The controller is RiseSystems Bartosz Korzeniowski, ul. Gen. Józefa Longina Sowińskiego 46 lok. 1c, 40-018 Katowice, Poland, NIP 6282306462, REGON 545249507. For any privacy question or request write to [email protected]. We have not appointed a data protection officer.
2. Data we process
- Account: name, email address, profile image and the identifier of the sign-in provider you use (Google, GitHub or email link); time zone and notification settings.
- Sign-in and security: session records (creation and expiry time), short-lived request counters that include your IP address for rate limiting, and records of important actions in your workspace (activity log).
- Machines and Services: machine names, hostnames, operating system, agent version, resource metrics (CPU, memory, disk), service configuration and status, schedules, incidents and the results of operations you run. Service variables, Git tokens and webhook secrets are stored encrypted.
- Content you open through the panel: when you view logs or files, download files or export backups, that content passes through ZeroTerm to your browser. Transfer results are deleted after one hour. Backups themselves stay on your Machine.
- Billing: plan, subscription status and the Stripe customer reference. Card details, billing address and NIP/VAT ID are handled by Stripe and appear on invoices.
- AI assistant: when you use the assistant, your messages, relevant workspace context and the logs, metrics or file excerpts it reads within your permissions are sent to Google through the Gemini API. The configured model is Gemini 3.8 Flash. ZeroTerm does not persist chat history; it stores daily usage counts and proposed changes. Diagnostic operations may also leave temporary operation results as described above.
- Communication: emails you send us and our replies.
3. Purposes and legal bases
- Providing ZeroTerm, your account, paid plans, alerts and support: performance of the contract (art. 6(1)(b) GDPR).
- Invoicing and accounting: legal obligations under Polish tax law (art. 6(1)(c)).
- Security, abuse prevention, rate limiting and defending legal claims: our legitimate interests (art. 6(1)(f)).
- Weekly reports and alert emails are sent only if you turn them on in your settings. We do not send marketing emails or use your data for advertising.
4. Who receives data
We use these service providers (processors or independent controllers) and share only what each needs:
We disclose data to authorities only when the law requires it. We never sell personal data.
5. AI processing by Google Gemini
Google processes assistant requests under its Gemini API terms and applicable data processing terms. Processing can take place outside the EEA. For paid API use, Google states that prompts and responses are not used to improve its products; limited retention for security and abuse prevention can still apply.
ZeroTerm filters known credentials from diagnostic evidence and restricts access to protected files. These safeguards cannot identify every secret in arbitrary content. Share only information needed for your request and avoid submitting credentials or sensitive personal data in chat.
6. How long we keep data
- Account, machines and services: until you delete them or your account.
- Resource metrics: 8 days. Incidents: 90 days. Rate-limit counters: 2 hours. File transfer results: 1 hour.
- Invoices and billing records: 5 years from the end of the year in which tax became due, as required by Polish tax law.
- Database backups of the control plane: up to 30 days, after which deleted data disappears from them as well.
- Support correspondence: up to 3 years after the matter is closed, for the defence of claims.
7. Your rights
You have the right to access your data, have it corrected, erased or restricted, to object to processing based on legitimate interests and to data portability. You can download your data and delete your account yourself in Account settings; for anything else write to [email protected]. We answer within one month.
You may lodge a complaint with the President of the Personal Data Protection Office (Prezes Urzędu Ochrony Danych Osobowych, ul. Stawki 2, 00-193 Warszawa, uodo.gov.pl) or the supervisory authority in your country.
8. Data on your Machines
The Agent runs on your Machine and executes operations you request. ZeroTerm does not scan or copy your Services' data. For personal data your Services process, you are the controller and we act as your processor; business customers can request a data processing agreement at [email protected].
9. Security
Traffic is encrypted with TLS, secrets are encrypted at rest, agents authenticate with revocable credentials and every operation is checked against your permissions. Read more on the security page.
11. Children, automated decisions and changes
ZeroTerm is not intended for children under 16. We do not make decisions with legal or similarly significant effects based solely on automated processing. AI operations require your approval or the explicit automatic approval rules you enable on Pro. We will announce material changes to this policy by email and on this page.