Privacy Policy

ZeroTell (zerotell.com) is operated by ZeroTell SI Inc, a Wyoming profit corporation (Wyoming Secretary of State filing ID 2026-002105619), 30 N Gould St Ste R, Sheridan, WY 82801, USA. That company is the controller of the personal data described here.

Questions or requests about your data: use the Contact page and say that it is a privacy request. You can also write to ZeroTell SI Inc at the postal address above.

Account: your email address, and your name and profile picture if you sign in with Google, GitHub, Facebook or X. From X we also receive your X username. X sign-in needs a confirmed email address on your X account; if there is none, we refuse the sign-in and store nothing. Facebook and X are used only to sign you in: we never post for you and never read your friends, followers or posts. If your new account has no profile picture, we may give it a default one: an AI image service draws a friendly illustrated avatar from a generic style prompt chosen by us, and we never send it your name, email address, country or any other account data. The picture is stored on our cloud storage (Cloudflare R2); you can replace it with your own picture in Settings at any time, and it is deleted with your account. We also remember which sign-in method you used last. Sign-in links and one-time codes are sent by email; links expire after 5 minutes and codes after 10 minutes. We don't use passwords.

Billing: Stripe processes your payment. We receive and keep your plan, subscription status, renewal dates, invoice amounts, currency and Stripe's order and customer IDs, and with each order the pricing details of that checkout (pricing country, currency, the price list used and, if tests were running, the price or page tests and the groups you were in). We never receive or store your full card number. For introductory-price checkouts we keep the card fingerprint Stripe provides (a code that identifies the card without revealing its number), so each card gets the introductory price only once.

Pricing country and price tests: our prices depend on your country (see the Subscription Terms). On your first visit we work out your country from your IP address (no precise location) and keep it in a first-party cookie, so the prices you see don't change when you travel or use a VPN. When you first go to checkout, that country is stored on your account (pricing country) and used for your later checkouts, because a subscription keeps its currency. Site tests: we test versions of our prices (in some countries) and of our pages (for example a button text) against each other. A random device ID (the zt_did cookie, no personal details) puts you in a group by chance and keeps you there, so what you see doesn't change from visit to visit; for a price test the group is also kept in a cookie so you keep seeing the same prices. When you are signed in, your groups are stored with your account so you see the same version on every device; they are deleted with your account. The groups you are in are attached to our own first-party usage events (when you see a test as a guest, together with a keyed hash of the device ID so each device is counted once — never the ID itself), and only a price test's group is attached to your checkout; we only ever look at the results per group, never per person. If you decline optional cookies or your browser sends a GPC signal, we keep you out of page tests (you see the standard version), delete the device ID and, when you are signed in, remove your page-test groups from your account; a price test in your country still applies, so one person always sees one price. If you accept optional cookies, we also report to Google Analytics that you saw a price test (the test and group, no personal details). The cookies are listed in the Cookie Policy.

Usage: credits granted and used, which tools you ran and when, your free daily run count and, on a plan, fair use counters (how many runs, words, searches or messages you used per tool group in each UTC day, kept for the rolling 30-day fair use window). The free count is tied to a random device ID kept in your browser and to your IP address, and when you are signed in also to your account.

Activity: when you are signed in, we store the time you were last active (when you sign in or run a tool; updated at most once every 10 minutes). We use it for the automatic emails and the email grouping described under How we use information; it is deleted with your account.

Technical: IP address and browser details, used to rate-limit requests, prevent abuse and keep accounts secure. Our server and error logs record technical events such as failed requests; they may include your account email or IP address when something goes wrong with your account, but not the text or files you put into a tool.

First-party measurement (no cookies): to count visits and see where our sign-up and checkout steps lose people, our own server records which pages are viewed and which steps of our tools are used (for example "detection submitted", "paywall shown", with numbers and fixed labels only, never your text). Each record carries the page path without its query string, the language, the approximate country, the general device category, operating system family and browser family (for example "mobile", "iOS", "Safari" — never versions or models) and a visitor code that our server computes from your IP address and browser details with a secret key that changes every day. If you accept cookies, it also carries the general kind of site that first brought you to us (for example "search: Google" or "referral") and the first page you landed on, without its query string. Your IP address and the full browser details themselves are not stored, the code cannot be linked from one day to the next, and nothing is stored in your browser for it, so it works without the cookie banner. We also record account and billing events (sign-up, checkout started, purchase, renewal, cancellation, refund, failed payment: plan, currency and amount, never card details). If you are signed in, these records are linked to your account; nothing is recorded while our staff view the site as you for support. We use this for our own aggregate statistics (our legitimate interest in understanding how the service is used) and, for an account, our staff may look at that account's own records to answer its support, billing or fraud questions; never for advertising profiles, and we share it with no one.

Marketing attribution: if you arrive from an ad or a tagged link, the ad click ID (gclid, gbraid or wbraid for Google ads, msclkid for Microsoft ads, oppref for ChatGPT ads), UTM tags, landing page and referring site are saved in a first-party cookie (zt_attr). The cookie is set whatever you choose on the cookie banner, so that it can record the source of your sign-up (see Sign-up source below). Only after you click Accept is it attached to your checkout, so we can tell which campaigns lead to subscriptions, and only with an Accept does an ad platform receive your click ID. If you decline, it is used for your sign-up source and nothing else.

Sign-up source (only when sign-up source tracking is on; whatever you choose on the cookie banner): when you create an account we save the campaign or referral link you came from, any ad click ID, your landing page and referring site, your IP address and approximate country, and browser details (browser, operating system, device type and model, screen size, language and time zone). We use it to understand which channels (search, ads, partner and referral links) bring sign-ups, our legitimate interest in knowing where our users come from. It is kept while your account is open and deleted with it. Ad platforms receive your ad click ID only if your latest cookie choice is Accept; Decline or a Global Privacy Control signal keeps it from them.

Sign-up details (no cookies needed): when you create an account we keep how you signed up (for example Google, a magic link or an e-mailed code), the approximate country, and the general device category, operating system family and browser family of that sign-up request (for example "mobile", "iOS", "Safari" — never versions or models). Whatever you chose on the cookie banner, we also keep the general kind of site that first brought you to us (for example "search: Google") and your first landing page without its query string. We use this to understand which sign-up options and devices work, keep it while your account is open and delete it with your account.

Messages: what you send through the contact form, the live chat or the feedback form (which needs you to be signed in), plus the email address and name you give us or that your account holds.

To provide the service: run the tools you request, manage your account, credits and subscription, and send the emails the service needs (sign-in codes, receipts, renewal-related messages).

To keep it safe: rate limits, abuse prevention, fraud checks and investigating failures.

To improve and market it: aggregate analytics and ad-conversion measurement (only with your consent where required), and a welcome email when you create an account. Marketing emails (tips, product news and offers) are sent only with your consent: tick the optional box when you sign up (it is never pre-ticked), switch on "Marketing emails" under Settings in your dashboard, or subscribe to the newsletter — without an account we first email a confirmation link and add the address only after that link is used; if it isn't, the address gets no further email from us. We record when and how you gave consent (sign-up, settings or newsletter). Creating an account alone does not add you to our marketing list. Every marketing and welcome or tips email has an unsubscribe link and a one-click unsubscribe that works without signing in; unsubscribing (or turning the setting off, or reporting one of our emails as spam) stops all of these emails at once and removes you from our email contact list. Emails you need for your account — sign-in codes, receipts, billing and security notices — are still sent. To keep our emails deliverable, our email provider tells us whether each email was delivered, opened or clicked, bounced or reported as spam; we store that as an event linked to your account (or to a pseudonymous code of your address, never the address or the email's content). An address that bounces permanently, or that unsubscribed or reported spam, goes on our do-not-email list.

Emails triggered by what you do: when we have switched them on, we send a few automatic emails based on your account and billing events, each at most once per occasion: a reminder when a checkout you started expires without payment (with a link back to the plan you chose); a nudge about one and four days after sign-up if you haven't bought anything; a tips email when you have an active plan but haven't used ZeroTell for 7 days (based on your last-active time); and come-back emails about 7 and 30 days after a plan you cancelled has ended, sometimes with a discount code — a single-use promotion code that Stripe creates for your Stripe customer account, valid for at least 14 days. The checkout reminder, the sign-up nudges and the come-back emails are marketing emails and go only to people who agreed to marketing; the tips email is a service email about your plan. All of them stop when you unsubscribe, and the reminders and come-back emails stop once you buy or resubscribe. Notices about a failing payment are billing emails you need for your account. To choose who receives these emails and our marketing emails, we group accounts by plan (no plan, current plan and billing interval, past customer, never paid), country, language and activity (for example active, or not active, in the last 30 days). We do this only to choose the recipients of an email; it has no legal or similarly significant effect on you.

We don't sell your personal data. We don't use the text or files you submit to train AI models. We send it to providers through their paid API services, not their consumer apps, and under the API terms of the providers we use, API inputs aren't used to train their models by default.

Account, billing and credit records are kept while your account is open and afterwards for as long as tax and accounting law requires. The texts, results and documents we store (History items, signed-in chats, humanizer results, detector reports, plagiarism match lists, extracted document text, PDF copies of documents and their file names) are encrypted at rest. Humanizer results and the text submitted for them: up to 24 hours. AI detector reports (scores, label and explanation, not the checked text): up to 7 days. Text extracted from documents that needed our converter: up to 6 hours. Keyed one-way fingerprints of humanizer results (never the text, which cannot be read back from them): 30 days, then deleted automatically; deleted with your account. Plagiarism match lists (matching pages and excerpts, stored encrypted under a keyed one-way fingerprint of the checked text): up to 3 days. Saved History items and signed-in chats: deleted automatically 30 days after they were saved (for a chat, after its last message), or sooner when you delete them. Rate-limit and free-run counters: about a day. Fair use counters: while your account is open; counters not updated for 40 days are removed over time, and all of them are deleted with your account. Attribution cookie: 90 days. First-party measurement records: 13 months, then deleted automatically; when you delete your account they are unlinked from it. Images uploaded to our storage for a media provider to fetch: 7 days. AI request log (which tool and model handled a request, the outcome, timing, tokens and cost, and a one-way fingerprint of the input — never the text itself): 30 days, then deleted automatically; when you delete your account it is unlinked from it. PDF copies of documents the AI reads page by page (AI Chat, document tools; stored encrypted, file name included): 24 hours, then deleted automatically. Server and error logs: only as long as needed to run and secure the service. Support messages: as long as needed to resolve the request. Marketing consent (whether you agreed, when and how, and when you unsubscribed): while your account is open, or for a newsletter-only address while it is subscribed and afterwards as proof of the opt-out. Email delivery events: 13 months, then deleted; deleted with your account. Records of the marketing and automatic emails we sent you (which email and when; for a discount offer, the Stripe subscription it refers to): 13 months, then deleted automatically; when you delete your account they are deleted or unlinked from it. Last-active time: while your account is open. Sign-up details (how you signed up, country, device and browser family, your first source and landing page): while your account is open; deleted with your account. Do-not-email list (only the address, the reason — bounce, spam report, unsubscribe — and the date): kept for as long as we send email, also after you delete your account, so we never email you again by mistake; ask us if you want it removed.

You can delete your account yourself under Settings in your dashboard, or ask us to do it. Deleting it cancels any active subscription immediately (the rest of the period is not refunded automatically — see the Subscription Terms), deletes your personal data, History, chats, usage records and sign-up source record, removes you from our email contact list and deletes your marketing consent record and email delivery events (an address on our do-not-email list stays there, as described above); the order records we must keep by law are kept without your account, reduced to payment IDs. The card fingerprint used for the introductory offer is kept without your account, so a deleted and re-created account can't claim the introductory price again with the same card. Stripe keeps its own records of your payments under its privacy policy. We send one last email to the account's address to confirm the deletion.

To delete your ZeroTell account and the data tied to it, sign in, open Settings in your dashboard and choose Delete account. This works the same whichever way you signed in: email, Google, GitHub, Facebook or X.

Deleting your account cancels any active subscription immediately and deletes your personal data, History, chats and usage records, as described under Retention. Order records we must keep by law are kept for as long as tax and accounting law requires, reduced to payment IDs and without your name or email. An address on our do-not-email list stays there. We send one last email to confirm the deletion.

If you can't sign in, use the Contact page: give the email address of your account and say that you want the account and its data deleted. We may email that address to confirm the account is yours before we delete it.

Removing ZeroTell from the apps connected to your Facebook or X account stops future sign-ins to ZeroTell through that provider. It does not delete your ZeroTell account or the data we hold; to delete them, follow the steps above.

Depending on where you live (for example the EU, UK, California or Australia), you can ask to access, correct, delete or receive a copy of your personal data, object to or restrict some uses, and withdraw consent at any time. You can also complain to your local data protection authority.

To change cookie choices, use "Cookie settings" in the footer or see the Cookie Policy. To make any other request, contact us; we may need to confirm that the account is yours before acting on it.

International transfers: ZeroTell SI Inc is based in the United States, so your data is processed in the United States, and our providers may also process it in other countries.

ZeroTell is not directed at children under 13 (or the minimum age in your country). Changes to this policy will be posted on this page with a new date. Last updated: 2 November 2026.

This notice tells California residents, at or before the point of collection, which categories of personal information ZeroTell collects, why, whether any of it is sold or shared, and how long each category is kept. It summarizes the sections above; the table below is the short form.

We don't sell personal information, and we have no actual knowledge of selling or sharing the personal information of anyone under 16. The one activity that California law may treat as "sharing" (cross-context behavioral advertising) is ad measurement by Google Analytics, the Google Ads tag, the Microsoft Advertising (UET) tag and — for visitors who arrive from a ChatGPT ad — the OpenAI ads pixel, and those tags load only after you click Accept on the cookie banner; the conversions our server reports to Google, Microsoft and OpenAI are sent only while your account's latest cookie choice is Accept. Our own first-party sign-up source cookies (zt_attr, user_tracking_data) are set whatever you choose, to record where your sign-up came from; they reach an ad platform only with an Accept. If you haven't made a choice and your browser sends a Global Privacy Control (GPC) signal, we treat it as Decline: none of these tags load and no ad conversion is reported. A choice you make yourself in Cookie settings takes precedence over the signal. See the Cookie Policy for every cookie we set.

We don't use sensitive personal information to infer characteristics about you, and we don't ask for it. We never receive your full card number (Stripe handles it), and sign-in works with email links or codes, or with Google, GitHub, Facebook or X, so we hold no password. Please don't put sensitive details into the tools unless you need to; whatever you paste is handled as described under "What happens to the text and files you submit".

You can ask to know what personal information we hold about you, to get a copy of it, to correct it and to delete it, and you can opt out of the sale or sharing of personal information. We won't treat you differently for using any of these rights.

To opt out of sharing, use "Cookie settings" in the footer (choose Decline), turn on Global Privacy Control in your browser, or follow the steps on Do Not Sell or Share My Personal Data. To delete your account and its data, use Settings in your dashboard. For any other request, contact us and say it is a California privacy request; an authorized agent can also make a request for you. We may ask you to confirm that the account is yours before we act on it, and we answer within the time the law sets (45 days, extendable once when necessary).