Privacy Policy

This Privacy Policy applies to information collected through:

• The Zorex Decision Intelligence website and application;
• Administrator and team member accounts;
• Documents uploaded for extraction;
• Commitment, counterparty, and organizational records;
• Email notifications sent by the Services;
• Customer support interactions.

This Privacy Policy does not apply to third-party websites, applications, or services that may be linked from or integrated with the Services.

Zorex provides software services to businesses and other organizations (“Subscribers”) that use the Services to track their own contracts and commitments.

For information a Subscriber submits through the Services — including uploaded documents and the records generated from them — the Subscriber determines why and how that information is collected and used, and Zorex processes it on the Subscriber's behalf solely to provide the Services. Subscribers generally act as the party responsible for determining the purposes and means of processing their own business data, while Zorex acts as a service provider or processor.

A Source Document you upload may itself contain personal information about third parties named in it — for example, a counterparty's employees, signatories, or contacts. Zorex processes that information only as part of processing the document on the Subscriber's behalf; the Subscriber remains responsible for ensuring it has the right to share such information with Zorex.

We use information to:

• Provide, maintain, secure, and improve the Services;
• Authenticate users and manage accounts and organization membership;
• Extract structured terms from uploaded documents;
• Send Decision Engine email alerts about upcoming commitment dates;
• Respond to support inquiries;
• Monitor security, prevent fraud and abuse, and comply with legal obligations.

When you upload a document, its contents are sent to a third-party AI provider (identified in Section 7 below) to generate structured terms (dates, amounts, parties, and similar fields). This processing is automated and the resulting data is not reviewed by a person at Zorex before it is shown to you.

Extracted terms are intended to support faster data entry and do not replace human review — the Services mark every extraction as Unverified until a user confirms it. See Section 6 of our Terms of Service for more detail.

We do not sell personal information and have not sold personal information during the preceding twelve (12) months. We do not share personal information for cross-context behavioral advertising.

The Services currently use the following subprocessors to store, process, and deliver information:

• Supabase — database, file storage, and authentication.
• Anthropic — AI-based extraction of structured terms from uploaded documents.
• Resend — delivery of Decision Engine alert emails.
• Vercel — application hosting.

Each subprocessor is contractually or by policy restricted from using your information for any purpose other than providing its service to Zorex. We will update this list as our subprocessors change.

We retain information for as long as reasonably necessary to provide the Services, maintain security, comply with legal obligations, and resolve disputes.

Following termination of a Subscriber account, Zorex generally retains Subscriber Data, including uploaded documents, for up to ninety (90) days to facilitate export, after which it may be deleted. Subscribers may also request earlier export or deletion at any time by contacting us.

Subscribers remain solely responsible for maintaining their own copies of any records required by applicable law. Zorex is not a records custodian or archival service.

We maintain commercially reasonable administrative, technical, and physical safeguards designed to protect information against unauthorized access, disclosure, alteration, and destruction, including encryption in transit, access controls, and authentication safeguards. No security system is perfect, and we cannot guarantee absolute security.

If Zorex becomes aware of unauthorized access to personal information resulting from a security incident affecting the Services, Zorex will notify affected Subscribers without unreasonable delay as required by applicable law.

Depending on your jurisdiction, you may have rights regarding your personal information, including rights to access, correction, deletion, data portability, and objection to certain processing activities.

To submit a privacy request, contact us using the information in Section 16 below.

California residents may have rights under applicable California privacy laws, subject to applicable exceptions, including the right to request:

• Access to personal information;
• Correction of inaccurate personal information;
• Deletion of personal information;
• Data portability;
• Information regarding categories of personal information collected and disclosed.

Zorex does not sell personal information and does not share personal information for cross-context behavioral advertising. California residents may exercise these rights by contacting us using the information in Section 16; we will respond within the timeframe required by applicable law.

The Services are not intended for individuals under eighteen (18) years of age. We do not knowingly collect personal information from children.

The Services are primarily intended for businesses located within the United States. Information may be processed and stored in the United States and other jurisdictions where our subprocessors operate. By using the Services, you consent to such transfers where permitted by applicable law.

We may update this Privacy Policy from time to time. For material changes, Zorex will provide at least fourteen (14) days' notice through the Services, email, or website notice. The “Last Updated” date above indicates when this Policy was most recently revised.

If you have questions regarding this Privacy Policy or wish to exercise a privacy right, contact: