Privacy Policy

Zym Labs, LLC ("Zym Labs," "we," "us," or "our") provides software that businesses use to communicate with, and understand the behavior of, their own customers and users. Today that means a marketing automation platform for email, SMS, push, and in-app messages. Over time it may also include data synchronization services and data products. This Privacy Policy explains how we collect, use, share, and protect personal information, and the choices and rights you have.

We handle personal information in two distinct roles:

• As a controller (or "business") for information about visitors to our websites, prospective customers, and the people who hold accounts on our platform. Most of this Policy is about that information.
• As a processor (or "service provider") for information that our customers load into the platform about their own customers and users, which we call Customer Data. We process Customer Data only on our customers' instructions. If you are a customer of one of our customers, their privacy policy governs how your information is used, and you should direct requests to them. Section 3 explains this in more detail.

We do not sell personal information for money. We do use advertising cookies on our own website, which some laws treat as "sharing" or "targeted advertising," and you can opt out as described in Section 10. We never use Customer Data for advertising.

This Policy applies to personal information we collect through:

• our websites, including zymlabs.com and its subdomains (the "Sites");
• the Zym Labs platform, applications, APIs, software development kits ("SDKs"), and related services (the "Services");
• our sales, marketing, and support activities; and
• events, webinars, and other interactions with us.

It does not apply to third-party websites or services that link to or integrate with the Services. Those have their own privacy policies.

Capitalized terms not defined here have the meanings given in our Terms of Service. "Customer" means a business that has an account for the Services. "Account User" means an individual who accesses the Services under a Customer's account. "End User" means an individual whose information a Customer processes through the Services.

2.1 Information you provide

• Account and profile information. Name, email address, job title, company name, password, and profile settings when an Account User registers or is invited to an account.
• Billing information. Billing contact, billing address, and payment details. Card numbers are collected and stored by our payment processor, not by us.
• Communications. Content of emails, support tickets, chat messages, survey responses, and feedback you send us.
• Marketing and sales interactions. Information you give us when you request a demo, download content, register for a webinar or event, or speak with our sales team.
• Mobile number and text messaging consent. Your mobile number and your opt-in to receive text messages from us, including the date, time, and method of consent, when you verify your account by phone or agree to receive texts under our SMS Terms at https://zymlabs.com/legal/sms.

2.2 Information collected automatically

When you use the Sites or the Services as an Account User, we and our service providers collect:

• Device and connection data. IP address, browser type and version, operating system, device identifiers, language, and time zone.
• Usage data. Pages viewed, features used, links clicked, referring and exit pages, dates and times of access, and interactions with in-product messages.
• Cookies and similar technologies. Cookies, pixels, local storage, and SDK identifiers as described in Section 4.
• Log data. Server logs, error reports, and API request metadata.

2.3 Information from other sources

• Business partners and resellers who refer Customers to us.
• Data enrichment and lead providers that supply business contact details and firmographic information such as company size and industry.
• Public sources such as company websites and professional networking sites.
• Integration providers when you connect a third-party service to your account, limited to the information needed to operate the integration.
• Mobile carriers and verification providers. When you verify your account by phone, our verification provider may obtain information from your mobile carrier, such as whether your number is active on the device you are using, to confirm your identity and prevent fraud. We use carrier information only for verification and fraud prevention, never for marketing.

Customers use the Services to send email, SMS, push, and in-app messages to their End Users, to track End User activity, to build segments and automated workflows based on that activity, and to synchronize data between the Services and their own systems. In doing so, Customers may submit or collect through the Services information about End Users, including:

• identifiers such as name, email address, phone number, user ID, and device or advertising identifiers;
• attributes the Customer chooses to record, such as plan type, location, preferences, or purchase history;
• activity events the Customer chooses to track, such as pages or screens viewed, actions taken in the Customer's product, and transactions;
• message engagement data such as deliveries, opens, clicks, bounces, and unsubscribes, which is collected through tracking pixels and tracked links in messages the Customer sends through the Services; and
• device and connection data such as IP address, browser, operating system, and approximate location, when a Customer installs our JavaScript snippet or mobile SDK on its website or application;
• data the Customer synchronizes from or to its own systems, such as a CRM, data warehouse, or e-commerce platform, which may include any of the categories above.

Our role. We process Customer Data as a processor or service provider on the Customer's documented instructions, under our Data Processing Addendum available at https://zymlabs.com/legal/dpa, and under the Customer's contract with us. The Customer is the controller or business and decides what Customer Data to collect, how to use it, and how long to keep it. We do not use Customer Data for our own purposes except to create aggregated and de-identified data as described below, do not sell it, and do not use it for advertising. We may generate aggregated and de-identified data, such as overall delivery rates, that cannot reasonably be used to identify any Customer or End User, and we use that data to operate and improve the Services, including the features and models that serve Customers generally. If a Customer uses an optional AI feature, the Customer Data that feature needs is processed by the AI model providers listed among our subprocessors, under the terms described there.

If you are an End User. Our Customer's privacy policy, not this one, explains how your information is used. To access, correct, delete, or stop the processing of your information, or to unsubscribe from a Customer's messages, please contact that Customer directly or use the unsubscribe link in their messages. If you contact us, we will refer your request to the relevant Customer and support them in responding, as our contract with them requires.

Tracking on Customer websites and applications. Our JavaScript snippet and SDKs collect information only when a Customer has installed them on its own website or application and only as the Customer configures them. The Customer is responsible for providing any notice and obtaining any consent that applies to that collection. We do not combine data collected across different Customers' properties to build profiles of End Users.

On our Sites and in the Services, we use cookies and similar technologies for the following purposes:

Advertising cookies are used only on our Sites and marketing pages. They are not used within the authenticated Services, and they are never placed on Customers' websites or applications by our snippet or SDKs.

Your choices. Where required by law, we ask for your consent before setting analytics or advertising cookies, and you can change your choices at any time at https://zymlabs.com/legal/cookies. Our Cookie Policy, at the same address, lists each provider. You can also block or delete cookies through your browser settings, although this may affect how the Sites work. We honor the Global Privacy Control browser signal as an opt-out of advertising cookies and of the sale or sharing of personal information. We do not respond to "Do Not Track" signals, which have no agreed standard.

We use information collected as a controller for the purposes below. Where the GDPR or UK GDPR applies, the table also lists the legal basis we rely on.

We may also use information with your consent for any purpose described at the time of collection, and we may de-identify or aggregate information and use it for any lawful purpose.

Automated decision-making. We do not make decisions about you based solely on automated processing that produces legal or similarly significant effects.

We share information collected as a controller with:

• Service providers and subprocessors that host our infrastructure, deliver email and SMS, provide data warehousing, provide AI model inference for optional features, process payments, provide analytics and customer support tools, and otherwise help us operate. They may use personal information only to provide services to us. Our current subprocessors for Customer Data are listed at https://zymlabs.com/legal/subprocessors.
• Advertising and analytics partners that set cookies on our Sites as described in Section 4. Under some US state laws this is "sharing" or "targeted advertising," and you can opt out as described in Section 10.
• Integration providers you choose to connect to your account, as directed by you.
• Professional advisors such as lawyers, auditors, and insurers.
• Parties to a business transaction, such as a buyer or successor in a merger, acquisition, financing, or sale of assets, subject to confidentiality obligations.
• Law enforcement, regulators, and others where we believe disclosure is required by law, necessary to protect the rights, property, or safety of Zym Labs, our users, or the public, or necessary to enforce our agreements.
• Others with your consent or at your direction.

Text messaging opt-in data and consent are not shared with third parties or affiliates for marketing or promotional purposes. The categories above exclude text messaging originator opt-in data and consent. We share your mobile number with our SMS delivery provider only to send the messages you have opted in to receive, and with our verification provider only to verify your account. Information obtained from your mobile carrier is used only for verification and fraud prevention.

We share Customer Data only with subprocessors needed to provide the Services, as permitted by our Data Processing Addendum, and as required by law.

We are based in the United States and host the Services there unless a Customer selects another hosting region we offer. If you are located outside the United States, your information will be transferred to and processed in the United States, where privacy laws may differ from those in your country.

• European Economic Area, United Kingdom, and Switzerland. We transfer personal information under the European Commission's Standard Contractual Clauses, the UK International Data Transfer Addendum, and the Swiss Federal Data Protection and Information Commissioner's recognized clauses, together with supplementary measures where appropriate. Customers can obtain our Standard Contractual Clauses through our Data Processing Addendum.
• Canada. Personal information transferred from Canada is subject to this Policy and to our contractual protections, and may be accessed by courts, law enforcement, and national security authorities in the United States.

We keep personal information only for as long as needed for the purposes described in this Policy, unless a longer period is required or permitted by law. The criteria we use to decide how long to keep information are:

• whether we have an ongoing relationship with you, such as an active Customer account or an open support request;
• whether we need the information to meet a legal, tax, accounting, or regulatory obligation, or to establish or defend legal claims;
• whether you have asked us to delete it or have withdrawn consent, where that is the basis for processing;
• how long the information remains useful for the purpose it was collected, after which it is deleted or aggregated; and
• for Customer Data, the retention settings and instructions of the Customer, and the deletion and return terms in our Data Processing Addendum.

When we no longer need personal information, we delete it, anonymize it, or securely isolate it until deletion is possible. Copies in backups are overwritten on a rolling basis in the ordinary course.

We maintain administrative, technical, and physical safeguards designed to protect personal information. For Customer Data, those measures are described in our Data Processing Addendum. No system is completely secure, and we cannot guarantee the security of information you transmit to us. If we become aware of a breach affecting your personal information, we will notify you and the relevant authorities as required by law.

10.1 Rights available to everyone

• Marketing emails. Unsubscribe using the link in any marketing email or by contacting us. You will still receive service and transactional messages related to your account.
• Text messages. Reply STOP to any text message from us to stop receiving messages from that program, or HELP for assistance. Our SMS Terms at https://zymlabs.com/legal/sms have the details.
• Cookies. Change your cookie choices at https://zymlabs.com/legal/cookies or through your browser.
• Account information. Account Users can review and update their profile within the Services. Customers can manage their account data and Account Users through account settings.

10.2 European Economic Area, United Kingdom, and Switzerland

If the GDPR, UK GDPR, or Swiss law applies, you have the right to request access to your personal information, to correct inaccurate information, to have it deleted, to restrict or object to our processing, to receive a copy in a portable format, and to withdraw consent at any time without affecting processing that occurred before withdrawal. Where we rely on legitimate interests, you may object, and we will stop unless we have compelling grounds to continue. You also have the right to lodge a complaint with your local supervisory authority, although we would appreciate the chance to address your concerns first.

10.3 United States

Residents of US states with comprehensive privacy laws, including California, may have the right to:

• confirm whether we process your personal information and access it;
• correct inaccurate personal information;
• delete personal information we collected from you;
• obtain a portable copy of your personal information;
• opt out of the sale of personal information, the sharing of personal information for cross-context behavioral advertising, targeted advertising, and profiling in furtherance of decisions that produce legal or similarly significant effects; and
• not be discriminated against for exercising these rights.

Opting out of sale or sharing. We do not sell personal information for money. Our use of advertising cookies on the Sites may be considered a sale or sharing under some state laws. To opt out, visit https://zymlabs.com/legal/do-not-sell, enable the Global Privacy Control in your browser, or adjust your cookie settings. We do not sell or share the personal information of anyone we know to be under 16.

Authorized agents. California residents may designate an authorized agent to make requests on their behalf. We will ask the agent for proof of authorization and may ask you to verify your identity directly.

Appeals. If we deny your request, you may appeal by replying to our decision. If we deny the appeal, you may contact your state attorney general.

Additional California disclosures appear in Section 11.

10.4 Canada

If you are in Canada, you have the right to access and correct your personal information and to withdraw consent, subject to legal and contractual restrictions. You may also file a complaint with the Office of the Privacy Commissioner of Canada or your provincial privacy commissioner.

10.5 How to exercise your rights

Submit requests by emailing [email protected] or writing to the address in Section 15. We will verify your identity, which may require you to confirm information we already hold or to respond from the email address associated with your account. We respond within the time required by applicable law, generally within 30 to 45 days, and will tell you if we need more time. We do not charge for requests unless they are manifestly unfounded or excessive.

If you are an End User, please direct requests to the Customer whose services you use. We will refer requests we receive about Customer Data to the relevant Customer.

This section supplements Section 10 for California residents under the California Consumer Privacy Act as amended by the California Privacy Rights Act ("CCPA").

Categories of personal information. In the preceding 12 months we have collected the following categories of personal information as a business, from the sources and for the purposes described in Sections 2 and 5:

We disclose each of these categories to service providers for business purposes as described in Section 6. We use sensitive personal information only to provide the Services and for security, which does not give rise to a right to limit under the CCPA.

Retention. The criteria we use to determine retention for each category are described in Section 8.

Customer Data. We act as a service provider for Customer Data and do not sell or share it. We process it only under our written contract with the Customer.

Shine the Light. California Civil Code Section 1798.83 permits California residents to request information about disclosures of personal information to third parties for their direct marketing purposes. We do not disclose personal information to third parties for their own direct marketing.

Financial incentives. We do not offer financial incentives in exchange for personal information.

The Sites and Services are intended for business use and are not directed to children. We do not knowingly collect personal information from children under 13, or under 16 for the purposes of sale or sharing. If you believe a child has provided us with personal information, contact us and we will delete it. Customers are responsible for ensuring their use of the Services complies with laws that protect children's data.

The Sites and Services may link to or integrate with third-party websites, products, and services. We are not responsible for their privacy practices. We encourage you to read the privacy policy of any third-party service you use.

We may update this Policy from time to time. We will post the updated Policy at https://zymlabs.com/legal/privacy with a new effective date. If changes are material, we will notify Customers by email or through the Services at least 30 days before they take effect. Your continued use of the Sites or Services after the effective date means you accept the updated Policy.

Questions, requests, and complaints about this Policy or our privacy practices can be sent to:

Zym Labs, LLC
Attn: Privacy
3723 Greenville Ave STE 62882, Dallas, TX 75206
[email protected]

We will respond to requests in accordance with applicable law.