Privacy Policy

01What this policy covers

This Privacy Policy explains how ZIRA AI PTE. LTD., a company incorporated under the laws of Singapore with registered address at 266A South Bridge Road, #02-01, Singapore 058815 and operator of ZIRAX ("ZIRAX", "we", "us"), collects and processes information when you use our Sandbox, model-as-a-service and data context infrastructure, websites, APIs and dashboards (the "Service"). It covers information about account holders, end users of applications built on the Service, and website visitors.

02Information we collect

We collect information in the following categories:

• Account information: name, company, email and authentication details when you register or contact us.
• Service data: requests, prompts, documents and other content you submit; configuration, access policies, metadata, tokens and usage metrics; sandbox runs, tool calls and audit traces.
• Technical data: IP address, device and browser information, log data, and diagnostic information needed to operate and secure the Service.
• Communications: messages and form submissions sent to hello@zirax.ai or through the dashboard.

03How we use information

We use information to provide and maintain the Service, authenticate users, route and execute requests, enforce quotas and billing, prevent abuse and security incidents, provide support, comply with law, and communicate about service changes. We process information on the documented instructions of the customer responsible for an account.

04Customer content

Content submitted through the Service is processed to deliver requested outputs and security features such as policy enforcement, masking and audit logging. Unless your order expressly permits training use, we do not use customer content to train foundation models, and content in dedicated or private deployments is logically or physically separated as configured.

Customers control retention, deletion and access settings for their content and are responsible for providing notices to their own end users.

05Third-party model providers

When a request is routed to a third-party model, the minimum content needed to fulfill that request is transmitted to the provider. Such processing is also governed by the provider's privacy and data terms, including whether they retain requests. Enterprise and private plans may restrict routing to providers that do not retain or train on requests.

06Subprocessors

We use a limited set of subprocessors for cloud hosting and compute, model inference, data storage, security and business communications. A current list and their processing locations is available on request.

07Sharing

We do not sell personal information. We share information only with subprocessors and service providers under appropriate agreements, to complete a transaction you request, or where required by law, legal process, or to protect the rights, property or safety of users and the public.

08Data security

The Service is designed with per-agent runtime isolation, access controls, encryption in transit and at rest, network egress controls, and audit logging. No system is perfectly secure; where your plan includes private VPC deployment, single sign-on or residency controls, those controls should be configured for regulated workloads.

09Retention

We retain account information for the life of the account and as required for legal and accounting purposes. Customer content is retained according to your configured settings, after which it is deleted or anonymized. Audit traces and operational logs are retained for the period stated in your plan or a default of 90 days, unless a longer period is required by law.

10International transfers

The Service operates across regions. Where information crosses borders, we use appropriate safeguards such as standard contractual clauses and regional deployment options available on enterprise plans.

11Cookies

Our websites use only the cookies and local storage necessary for authentication, security and basic analytics of site usage. We do not use advertising cookies.

12Your rights

Depending on your location, you may have rights to access, correct, export or delete personal information, and to object to or restrict certain processing. Account holders can manage most data through the dashboard; end users of a customer's application should direct requests to that customer. You may also contact us directly at hello@zirax.ai.

13Children

The Service is not directed to children, and we do not knowingly collect information from children. The Service is intended for business and developer use.

14Changes

We may update this policy. Material changes will be indicated by revising the "last updated" date and, where appropriate, notified through the dashboard or by email.

15Contact

For privacy questions or requests, contact hello@zirax.ai.