What we do with your information

Zuva Digital Ltd is a company registered in England and Wales, company number 17331992, registered office 49 Roman Road, Abbeymead, Gloucester, GL4 5HR, England. We build and run AI-assisted software for our clients.

For your own account, and for anything you send us while deciding whether to buy, we decide what is done with your information. For the records your business keeps in its office, your business decides, and we handle them on its behalf and on its instructions.

For anything on this page, write to support@zuvadigital.com. A person reads it.

Three different things, and it is worth keeping them apart.

Your account. Name, email address, and what you are allowed to do in the product. We need this to let you in and to attribute actions to the person who took them.

Your work. The documents you upload, the calls you record and have transcribed, the notes you write, the contacts you keep, and the messages you exchange inside the product, including your planning conversations in a Brief. This is your material. We hold it so the product can do its job.

Files you connect. If you connect a place you already keep files or contacts (Google Drive, Google Contacts, or a folder on your own computer), we read what you choose so the assistant can work with it. We read what you select and nothing else.

Payments. What you bought and when. Card details stay with our payment provider.

When you connect Google Drive we ask for one permission only: drive.file. That grants access to the individual files you pick, and to nothing else in your Drive. We cannot see, list or open anything you have not chosen, not because we promise not to, but because the permission we hold does not allow it.

We read those files to extract their text, so that the assistant can find the right passage when someone asks a question. We store that text, and a mathematical representation of it used for searching, inside your own office.

When you connect Google Contacts we ask for read-only access (contacts.readonly) and import the contacts you choose into your office. We never change or delete anything in your Google account.

Zuva Digital's use and transfer of information received from Google APIs to any other app will adhere to the Google API Services User Data Policy, including the Limited Use requirements.

We do not use Google user data for advertising, we do not sell it, and we do not use it, or let anyone else use it, to train any AI model. Disconnecting a source removes the text we extracted from it, and the record keeps only that it was there and that you removed it.

Running this product means other companies process some of your material on our behalf. Each one does a specific job, and receives only what that job needs:

• Neon · Databases

  Your account, your office's records, and our own records of your Brief and the emails you send us.

  Where: United States. Each office's database is in one US region (east or west); our own records are in the US east.

• Vercel · Runs this site and every office, and stores your files

  Everything the site and your office show you, and the files you upload.

  Where: United States. We also keep some of our own working files, for work we deliver, in London and Sydney; none of your office's records or files are held there.

• Google (sign-in, and Firebase) · Signing in

  Your name and email address, and the sign-in details for your office.

  Where: United States.

• GitHub · Keeps the code of each office

  The code built for you, and the shared parts of a Brief that the build works from.

  Where: United States.

• Anthropic · The AI behind the office assistant and Forge

  The text of a question or a conversation, and the passages relevant to it.

  Where: Stored in the United States. Processed in the United States and other regions.

• Resend · Sending and receiving email

  The emails the product sends for you, and replies to them.

  Where: United States.

• AssemblyAI · Turning calls and recordings into text

  The audio of calls and recordings you chose to make.

  Where: United States.

• Groq · Turning spoken feedback into text

  The audio of a voice note left with feedback on our own product.

  Where: United States.

• Voyage AI · Making what your office knows searchable

  The text of documents, transcripts and messages, to make them searchable.

  Where: Not stated by the provider.

• ElevenLabs · The spoken voice, when the assistant reads aloud

  The text of each reply you ask to hear, and the scripts of our narrated films.

  Where: United States.

• Stripe · Payments

  Your billing details and card. We never see or hold your full card number.

  Where: Set out in Stripe's own privacy policy.

• Tavily and Firecrawl · Web research by Forge and the office assistant

  Search words and the addresses of public web pages. Never your records.

  Where: Not stated by the providers.

We do not sell your information to anyone, and we do not share it with advertisers. The web research services work differently from the rest: a search is written by the assistant from your conversation, so it can name your business, a supplier, a person or a product you mentioned, because that is what is being looked up. Their terms let them keep and use what they receive, including to train their own systems. If a search should not name something, tell the assistant, or write to support@zuvadigital.com.

We do not use your material, or your clients' material, to train AI models. The assistant in your office learns from what is in your office, and that learning stays there.

Three of the services above (the one that turns recordings into text, the one that makes your office's knowledge searchable, and the spoken voice) train on the data they receive unless the customer switches that off. We switched it off with all three on 21 October 2026. The other services that hold or process your records do not train on them, under their terms or our settings with them. Web research is the exception described above.

Your account, your office's records and files, and sign-in are held in the United States, by the services listed above. There is no option today to keep your information in another country; if that matters to you, write to support@zuvadigital.com and it is recorded.

We are in the United Kingdom, so holding your information in the United States is a transfer outside the UK. We make it under the contract terms each service provides for that purpose.

Your work stays until you remove it or close your account. Your office never deletes your data on its own. When you remove something, the stored copy of its content is deleted; what remains is the record that it existed and that it was removed, because a business needs to be able to answer "what happened to that?"

Material the assistant merely read while answering a question, such as a web page it consulted, is kept for a limited period and then discarded automatically unless somebody decides it is worth keeping.

What the services keep, under their own terms, after something is deleted or an account ends:

• Databases: kept until deleted, with a one-day history so a mistake can be undone. After an account ends, deleted within 30 days of our written request.
• Sign-in: when a person's account is deleted, it leaves the provider's backups within 180 days.
• Email: emails and their logs are kept for 30 days, and the rest is deleted within 90 days after our account with the provider ends.
• The AI behind the assistant and Forge: what it is sent and what it writes is deleted by the provider within 30 days. If the provider flags something as possible misuse, it can keep that for up to two years.
• Recordings turned into text: the recording is deleted by the provider within 48 hours, and its text within 30 days. Your office keeps its own copy of the text.
• Spoken feedback turned into text: the provider does not keep it.
• Searchable knowledge: since 21 October 2026, the provider keeps nothing.
• The spoken voice: the provider keeps the text and audio of each spoken reply in its history for as long as our account with it is open.

If you connect a Facebook Page (and the Instagram account linked to it), we receive the list of Pages you chose to share with us and an access token for each one. We use them for one thing: publishing the posts you have approved, to the Page you picked, at the time you scheduled. We read your Page's name and the Instagram account linked to it so you can see what is connected. We do not read your personal profile, your messages, or your followers.

To disconnect, choose Disconnect next to the connected Page in your office, or remove the app in Facebook under Settings, then Business integrations. Either way, nothing more is posted.

To have your Facebook data deleted, write to support@zuvadigital.com from the address on your account, saying which Page. We delete the stored access tokens and the Page details within 30 days and reply to confirm. Posts already published stay on your Page until you remove them there.

You can ask for a copy of what we hold about you, ask us to correct it, ask us to delete it, or object to how we use it. Write to support@zuvadigital.com and we will do it. If we cannot, because we are required to keep something, we will tell you which part and why. If your information is in a business's office, we will help that business answer you.

If you are not happy with how we have handled your information, you can complain to the Information Commissioner's Office at ico.org.uk. We would rather you told us first, so we can put it right.

If this page changes in a way that affects what we do with your material, we will say so rather than quietly updating the date at the top.