Privacy policy

Effective 16 September 2026. This policy explains how we process personal data when you use the zebr.ai website (the "website").

1. Who processes your data

For visitors in the European Economic Area, the controller is:

ZEBRA SYSTEMS s.r.o., Opavská 6230/29A, 708 00 Ostrava-Poruba, Czech Republic, company ID 47675462, registered in the Commercial Register kept by the Regional Court in Ostrava, section C, file 11310.

For visitors in the United States (and the English version of the website), the business under US state privacy laws is:

ZEBRA SYSTEMS LLC, 4111 E Rose Lake Drive, Suite 6590, Charlotte, NC 28217, USA, info@zebra-systems.com, +1 (704) 745-4214.

Both companies act as independent controllers.

Contact for privacy questions and requests: info@zebr.ai. We have not appointed a data protection officer.

2. What data, why, and on what legal basis

Contact form

• Data: name, e-mail, phone (optional), your message; technically also the page you sent it from and the website language.
• Purpose: to answer your enquiry and, where relevant, prepare an offer.
• Legal basis: steps prior to entering into a contract at your request (Art. 6(1)(b) GDPR), otherwise our legitimate interest in answering enquiries (Art. 6(1)(f) GDPR).
• How: the website does not store your message; it forwards it by e-mail to our inbox through Brevo.
• Retention: while your enquiry is handled and then 3 years unless it leads to a contract.

Newsletter

• Data: e-mail address, time of sign-up and confirmation.
• Purpose: sending cybersecurity news about once a month.
• Legal basis: your consent (Art. 6(1)(a) GDPR), confirmed by clicking the link in our e-mail (double opt-in).
• Retention: until you unsubscribe; every e-mail has an unsubscribe link. We keep a record of consent and its withdrawal for 3 years as evidence.

Bot protection for forms

• Data: technical information about your browser and device and your IP address, evaluated by Cloudflare Turnstile.
• Purpose: preventing spam and abuse of the forms.
• Legal basis: legitimate interest in the security of the website (Art. 6(1)(f) GDPR).

Website statistics (Google Analytics)

• Data: a pseudonymous identifier in a cookie, pages visited, approximate location derived from the IP address, device and browser type.
• Purpose: understanding how the website is used and improving it. We do not use the data for advertising or to profile individuals.
• Legal basis: in the EEA only your consent (Art. 6(1)(a) GDPR and the ePrivacy rules); without it Google Analytics is not loaded at all. In the US, statistics run until you opt out (see section 7). You can change your choice at any time under Cookie settings in the footer.
• Retention: 14 months.

Advertising measurement and remarketing (Google Ads)

• Data: identifiers in cookies, pages visited, ad clicks and submission of the enquiry form (not its content), device and browser data.
• Purpose: to measure whether an ad campaign led to an enquiry, and to show our ads to people who have visited the website (remarketing).
• Legal basis: only your marketing consent (Art. 6(1)(a) GDPR and the ePrivacy rules), in the EEA and the US alike; without it Google Ads is not loaded at all. You can withdraw it at any time under Cookie settings in the footer.
• Retention: cookies up to 90 days; data in the Google Ads account according to Google's settings.

Support form for US visitors (HubSpot)

• Data: what you enter in the form (typically name, e-mail, company, description of the issue), a visitor identifier in HubSpot cookies, and device data evaluated by Google reCAPTCHA.
• Purpose: receiving and handling your support request.
• Legal basis: the form and its cookies load only with your consent; handling the request itself is performance of a contract or our legitimate interest in providing support (Art. 6(1)(b) and (f) GDPR).
• Retention: while the request is handled and for the duration of the contract.

Operating and securing the website

• Data: IP address, time and URL of the request, browser information in operational logs.
• Purpose: delivering the website, protection against attacks, troubleshooting.
• Legal basis: legitimate interest (Art. 6(1)(f) GDPR).
• Retention: for as long as necessary, no longer than 30 days.

3. Who we share data with

The following processors handle data for us under a data processing agreement:

• Cloudflare, Inc. — hosting and delivery of the website (Cloudflare Workers), bot protection (Turnstile).
• Sendinblue SAS (Brevo), France — sending contact form messages and managing the newsletter list.
• Google Ireland Limited / Google LLC — Google Analytics, only with your consent (in the US until you opt out).
• Google Ireland Limited / Google LLC — Google Ads (conversion measurement and remarketing), only with your marketing consent.
• HubSpot, Inc. (EU1 data centre) — the support ticket form for US visitors; loaded only with your marketing consent.
• Google Ireland Limited / Google LLC — reCAPTCHA — bot protection for the HubSpot form; only together with it.

The website's content (text, images) is managed in our own content management system on our own infrastructure; images are loaded from it while you browse, so it sees your IP address.

We do not sell personal data.

4. Transfers outside the EEA

Some processors (Cloudflare, Google, possibly HubSpot) may process data in the United States. Transfers rely on the European Commission's adequacy decision for the EU-US Data Privacy Framework for certified companies, or on standard contractual clauses.

5. Cookies and similar technologies

The full list is in our Cookie policy. In short: necessary technology (remembering your choice, form protection) is always used; Google Analytics statistics cookies only with consent (EEA) or until you opt out (US); the HubSpot support form (US only) only with marketing consent. Google Ads advertising measurement loads only with marketing consent.

6. Your rights (EEA)

Under the GDPR you have the right to:

• access your data and receive a copy,
• have inaccurate data corrected,
• erasure ("to be forgotten"),
• restriction of processing,
• data portability,
• object to processing based on legitimate interest,
• withdraw consent at any time, without affecting the lawfulness of processing before withdrawal,
• lodge a complaint with a supervisory authority — in the Czech Republic the Office for Personal Data Protection (www.uoou.cz), Pplk. Sochora 27, 170 00 Prague 7.

Send requests to info@zebr.ai. We will answer without undue delay and within one month at the latest.

7. Visitors in the United States

Residents of US states with their own privacy laws (e.g. California — CCPA/CPRA, Virginia, Colorado, Connecticut) can also use our Opt-out preferences: you can switch statistics cookies off, and we honour the Global Privacy Control signal from your browser automatically.

8. Changes

We may update this policy, for example when we add a new service to the website. The current version is always on this page.