In short
- Your data, files and findings are yours. We do not sell them and never use them to train models.
- Zatoona Labs runs in the EU, and inside your institution if it runs Zatoona Labs itself.
- During early access, our team may review your sessions to improve Zatoona Labs. You can turn this off at any time.
- You can ask us to see, correct or delete your personal data whenever you like.
Who we are and what this policy covers
Zatoona B.V. (“we”, “us”) runs zatoona.ai and Zatoona Labs on Zatoona Cloud. This policy covers both: the website, including its forms, and your account and use of Zatoona Labs. It does not cover Zatoona Labs when your institution runs it inside its own environment. Then your institution decides how your data is handled, and we have no access to it.
Our role
For the website, for your account and for running Zatoona Labs for you, we are the controller of your personal data: we decide why and how it is used.
When your institution has signed an agreement with us for Zatoona Labs on Zatoona Cloud, we process the data its researchers bring on the institution’s behalf, as its processor, under a data processing agreement. The institution is then the controller, and its own privacy notice applies. Please send requests about that data to your institution.
What we collect
What you give us on the website. When you request early access, talk to us about your institution or use the contact form, we collect what you enter: your name, email address, organization and its type, your role, how you heard about us, whether you would like to be a design partner, the topic of your message, and what you write.
Your account. Your name, email address, organization and role, the version of our terms you accepted and when, your settings, and your password, which we store only as a secure hash.
What you bring to Zatoona Labs. The files and data you upload, and your sessions: your prompts and conversations, the AI’s steps, and the results, code and findings it produces. This is your content, and we handle it as described below.
Usage information. Which features you use, how long runs take, and any errors, so we can keep Zatoona Labs working well.
The audit log. Zatoona Labs records logins, file activity and runs, and its gateway records every model call. The log protects you and us, and shows how your data was used.
Technical data. Our hosting providers keep standard server logs, which can include your IP address, browser type and the pages you request, for security and reliability. The website uses cookieless analytics that count visits without identifying you.
How we use it, and on what basis
- To answer you and run early access: replying to your message, deciding whom to invite, and setting up a conversation or a pilot. Basis: steps you asked us to take, and our legitimate interest in running early access.
- To provide Zatoona Labs: running your analyses, keeping your projects, sending you the emails your account needs. Basis: our agreement with you, the terms you accepted.
- To keep it secure: the audit log, server logs, and preventing misuse. Basis: our legitimate interest in a secure service, and our legal obligations.
- To improve Zatoona Labs: usage information, and during early access a review of your sessions by our team, unless you have turned it off. Basis: our legitimate interest in improving the product with its first users. You can object at any time by turning it off in your account settings.
- To meet legal obligations: for example, our accounting and tax records.
We do not sell your personal data, we do not use it for advertising, and we never use your data or your sessions to train AI models.
Session review during early access
While Zatoona Labs is in early access, a small number of people on our team may review your sessions (prompts, conversations, the AI’s steps and results) to find what works and what does not. It is on by default, shown to you when you first sign in, and you can turn it off then or later in your account settings. We do not review your uploaded files this way, but results can include parts of your data, such as tables or plots. Please do not bring identifiable patient data to Zatoona Labs during early access.
AI models
To answer a step, Zatoona Labs sends what that step needs to an AI model, through OpenRouter, which passes it to a model provider. On Zatoona Cloud we use EU-hosted model providers that keep nothing once they answer and do not train on what they receive. Inside an institution, the gateway can point to the institution’s own hosted models instead.
Who we share it with
We share personal data only with service providers that help us run zatoona.ai and Zatoona Labs, and only as far as they need it. They act on our instructions under data processing agreements:
- Amazon Web Services (Frankfurt, Germany): the sealed sandboxes where analyses run.
- Railway (EU region): the Zatoona Labs application and its database, and this website with its cookieless analytics.
- EU-hosted AI model providers: answering the steps of an analysis, as described above.
- OpenRouter (United States): routing the AI model calls of Zatoona Labs to the model providers, with zero data retention.
- Parallel (United States): the web searches Zatoona Labs makes during an analysis.
- Resend: sending the emails from our forms and your account.
Each one, with the data it handles and where, is listed on Sub-processors.
Searches that Zatoona Labs makes on the web and in public scientific databases, such as PubMed, ChEMBL and Open Targets, send a search query, never your files. A query can name what you are studying, such as a gene or a compound. We may also disclose personal data when the law requires it, to protect our rights or the safety of others, or to a buyer if our business changes hands, who would then be bound by this policy.
Where your data is
Zatoona Labs on Zatoona Cloud runs in the EU: the application, its database and every analysis. Some of our providers are companies based in the United States, among them those behind the website, our email, web search and the routing of model calls. Where data reaches a provider outside the EU, we rely on safeguards the GDPR recognises, such as the EU Standard Contractual Clauses or the EU-US Data Privacy Framework.
How long we keep it
- Messages and requests from the website: as long as needed to follow up, then for a reasonable period for our records.
- Your account: while it is open. When you close it, we delete it.
- Your files, projects and sessions: until you delete them or close your account.
- The audit log and server logs: as long as needed for security and to meet our legal obligations.
- Accounting records: as long as Dutch law requires.
Your rights
Under the GDPR you have the right to:
- see the personal data we hold about you, and get a copy;
- have it corrected or completed;
- have it deleted;
- restrict how we use it;
- receive it in a portable format;
- object to how we use it, including session review during early access; and
- withdraw any consent you gave, without affecting what happened before.
To use any of these, email contact@zatoona.ai. We answer within one month. You also have the right to complain to the Dutch Data Protection Authority (Autoriteit Persoonsgegevens).
Cookies and storage
The website uses no advertising or tracking cookies, and its analytics are cookieless. Zatoona Labs keeps a small amount of data in your browser to keep you signed in. Both are needed for the service to work, so they do not need your consent. If this changes, we will update this policy and ask for consent where the law requires it.
Children
zatoona.ai and Zatoona Labs are for professionals and are not meant for anyone under 16. We do not knowingly collect personal data from children.
Security
Every analysis runs in a sealed sandbox, its model calls pass one gateway, and access is recorded in the audit log. The details are on Privacy and security. No system is perfectly secure, and if a breach affects your personal data, we will tell you and the authorities as the law requires.
Other websites and services
Links to other websites, and the public databases Zatoona Labs searches, have their own privacy practices, which this policy does not cover.
Changes to this policy
When we change this policy, we update the date at the top. If a change matters for how we use your data, we tell you by email or in Zatoona Labs before it applies.
Contact us
Questions about this policy or your data? Email contact@zatoona.ai.
Zatoona B.V. is a private limited company (besloten vennootschap) registered in the Netherlands, with its registered office in Nijmegen. Chamber of Commerce (KvK) number: 42139121. VAT ID: NL869894468B01. Visiting address: Geert Grooteplein Zuid 41, 6525 GA Nijmegen, the Netherlands.