Zenith
Privacy Policy

Privacy Policy — Zenith Books

AI-Powered Expense Management Automation

Effective Date: January 20, 2026Terms of Service

1. Introduction

Zenith Books ("Company", "we", "us", "our") is committed to protecting your privacy and ensuring the security of your personal data. This Privacy Policy explains how we collect, use, disclose, and safeguard your information when you use our AI-powered expense management automation service ("Service") available at www.zenith-books.com.

This Privacy Policy applies to all users of our Service, including Subscribers, Users, and End Users, as well as visitors to our website. By using our Service, you consent to the data practices described in this policy.

Please read this Privacy Policy carefully. If you do not agree with the terms of this Privacy Policy, please do not access or use the Service.

The data controller responsible for your personal data is Current d.o.o., Likozarjeva 3, 1000 Ljubljana.

2. Data Controller and Data Processor Roles

2.1 When We Act as Data Controller

We act as the data controller for personal data we collect directly from you, including:

  • Account registration information
  • Billing and payment information
  • Communication and support inquiries
  • Website usage data and analytics
  • Marketing preferences

2.2 When We Act as Data Processor

We act as a data processor when processing personal data contained within documents you upload to the Service ("Customer Data"). In this capacity:

  • You (the Subscriber) are the data controller
  • We process data only according to your instructions
  • We implement appropriate security measures
  • We assist you in meeting your data protection obligations

3. Information We Collect

3.1 Information You Provide Directly

Account Information:

  • Name (first and last)
  • Email address
  • Phone number
  • Company name and address
  • Job title/role
  • Password (stored in encrypted form)

Billing Information:

  • Company legal name
  • Billing address
  • Tax identification number (VAT/Tax ID)
  • Payment method details (credit card information is processed by Stripe and not stored by us)
  • Bank account details (for bank transfer payments)

Communication Data:

  • Support ticket content
  • Email correspondence
  • Feedback and survey responses
  • Chat communications

3.2 Information Collected Automatically

Usage Data:

  • Features used and actions taken
  • Document processing statistics
  • Login times and session duration
  • Error logs and performance data
  • API call logs

Device and Technical Data:

  • IP address
  • Browser type and version
  • Operating system
  • Device type and identifiers
  • Time zone and language settings
  • Referring website/source

3.3 Customer Data (Documents)

When you upload documents to the Service, we process the content to provide our expense management features. Documents may contain:

  • Invoice and receipt data
  • Vendor/supplier information
  • Financial transaction details
  • Bank statement information
  • Personal data of third parties (your vendors, customers, employees)

Important: You are responsible for ensuring you have the legal right to upload and process any documents containing third-party personal data.

4. How We Use Your Information

4.1 Service Provision

  • Creating and managing your account
  • Processing documents and extracting data
  • Providing expense management features
  • Integrating with third-party accounting software
  • Generating reports and analytics
  • Processing payments and billing

4.2 Service Improvement

  • Improving AI/ML models for document recognition
  • Analyzing usage patterns to enhance features
  • Troubleshooting and fixing bugs
  • Conducting research and development
  • Performance monitoring and optimization

4.3 Communication

  • Responding to support requests
  • Sending service notifications and updates
  • Providing billing and payment information
  • Sending marketing communications (with consent)
  • Conducting surveys and collecting feedback

4.4 Legal and Security

  • Complying with legal obligations
  • Preventing fraud and abuse
  • Protecting our rights and property
  • Enforcing our Terms of Service
  • Responding to legal requests

For users in the European Economic Area (EEA), United Kingdom, and other jurisdictions requiring a legal basis for processing, we rely on the following:

Contract Performance (Article 6(1)(b) GDPR): Processing necessary to provide our Service, manage your account, and fulfill our contractual obligations.

Legitimate Interests (Article 6(1)(f) GDPR): Processing for our legitimate business interests, including service improvement, security, fraud prevention, and analytics, balanced against your rights.

Consent (Article 6(1)(a) GDPR): Processing based on your explicit consent, such as marketing communications. You may withdraw consent at any time.

Legal Obligation (Article 6(1)(c) GDPR): Processing necessary to comply with legal requirements, such as tax and accounting regulations.

6. Data Sharing and Disclosure

6.1 Service Providers (Sub-processors)

We share data with third-party service providers who assist in operating our Service:

  • Cloud Infrastructure: Amazon Web Services (AWS), Google Cloud Platform, Microsoft Azure — for hosting, storage, and computing
  • AI/ML Processing: Anthropic, OpenAI — for document analysis and natural language processing
  • Payment Processing: Stripe — for secure payment handling
  • Analytics: Google Analytics — for website usage analysis
  • Communication: Email service providers — for transactional and marketing emails
  • Customer Support: Help desk software — for managing support inquiries

All sub-processors are bound by data processing agreements and required to maintain appropriate security measures.

6.2 Third-Party Integrations

When you connect third-party services (e.g., Vasco, Eračuni, GoCardless), we share data necessary for the integration to function. These integrations are subject to the third party's privacy policy.

6.3 Legal Requirements

We may disclose your information when required by law or in response to:

  • Court orders and legal process
  • Government and regulatory requests
  • Law enforcement inquiries
  • Protection of rights, safety, or property

6.4 Business Transfers

In the event of a merger, acquisition, or sale of assets, your information may be transferred to the acquiring entity. We will notify you of any such change.

6.5 With Your Consent

We may share your information with third parties when you have given explicit consent.

7. International Data Transfers

Your data may be transferred to and processed in countries outside your residence in the EU area and other countries where our service providers operate.

For transfers from the EEA/UK, we ensure adequate protection through:

  • European Commission adequacy decisions
  • Standard Contractual Clauses (SCCs)
  • Supplementary technical and organizational measures

8. Data Retention

We retain your data only as long as necessary for the purposes described in this policy:

  • Account Data: Retained while your account is active and for 3 years after account closure
  • Customer Data (Documents): Retained while your account is active; deleted within 90 days of account termination unless otherwise agreed
  • Billing Records: Retained for 7 years as required by tax and accounting regulations
  • Usage Logs: Retained for 12 months
  • Support Communications: Retained for 3 years
  • Marketing Preferences: Retained until you opt out

We may retain anonymized or aggregated data indefinitely for analytics and research purposes.

9. Data Security

We implement comprehensive security measures to protect your data:

Technical Measures:

  • Encryption in transit (TLS 1.2+) and at rest (AES-256)
  • Regular security assessments and penetration testing
  • Multi-factor authentication options
  • Network firewalls and intrusion detection
  • Regular backups and disaster recovery procedures

Organizational Measures:

  • Employee security training
  • Access controls and least privilege principles
  • Confidentiality agreements
  • Incident response procedures
  • Regular policy reviews and updates

While we implement robust security measures, no system is completely secure. We encourage you to use strong passwords and protect your login credentials.

10. Your Privacy Rights

Depending on your location, you may have the following rights regarding your personal data:

10.1 Rights Under GDPR (EEA/UK Residents)

  • Right of Access: Request a copy of your personal data
  • Right to Rectification: Correct inaccurate or incomplete data
  • Right to Erasure: Request deletion of your data ("right to be forgotten")
  • Right to Restrict Processing: Limit how we use your data
  • Right to Data Portability: Receive your data in a structured, machine-readable format
  • Right to Object: Object to processing based on legitimate interests or for direct marketing
  • Right to Withdraw Consent: Withdraw previously given consent at any time
  • Right to Lodge Complaint: File a complaint with your local data protection authority

10.2 Exercising Your Rights

To exercise any of these rights, please contact us at:

Email: info@zenith-books.com

Address: Current d.o.o., Likozarjeva 3, 1000 Ljubljana, SI

We will respond to your request within 30 days (or as required by applicable law). We may need to verify your identity before processing your request.

11. Cookies and Tracking Technologies

11.1 Types of Cookies We Use

  • Essential Cookies: Required for Service functionality (authentication, security)
  • Functional Cookies: Remember your preferences and settings
  • Analytics Cookies: Help us understand how users interact with the Service
  • Marketing Cookies: Used to deliver relevant advertisements (with consent)

11.2 Managing Cookies

You can manage cookie preferences through:

  • Our cookie consent banner
  • Your browser settings
  • Opt-out tools provided by analytics providers

Note: Disabling essential cookies may affect Service functionality.

12. Children's Privacy

Our Service is not intended for children under 18 years of age. We do not knowingly collect personal information from children. If you believe we have collected information from a child, please contact us immediately at info@zenith-books.com.

Our Service may contain links to third-party websites or integrate with third-party services. We are not responsible for the privacy practices of these third parties. We encourage you to review their privacy policies before providing any personal information.

14. Do Not Track Signals

Some browsers offer a "Do Not Track" (DNT) feature. Our Service currently does not respond to DNT signals. However, you can manage tracking through our cookie settings and by adjusting your browser preferences.

15. Changes to This Privacy Policy

We may update this Privacy Policy from time to time. Changes will be effective when posted on this page with an updated "Effective Date."

For material changes, we will:

  • Notify you via email
  • Display a prominent notice in the Service
  • Provide at least 30 days' notice before changes take effect

Your continued use of the Service after changes become effective constitutes acceptance of the updated policy.

16. Contact Us

If you have questions, concerns, or requests regarding this Privacy Policy or our data practices, please contact us:

Current d.o.o.

Data Protection Officer: gasper@zenith-books.com

General Inquiries: info@zenith-books.com

Address: Likozarjeva 3, 1000 Ljubljana

Website: www.zenith-books.com