Privacy
Policy.

Scope and operator

ZERO1 IO, also shown as Zero 1 IO on Google consent screens, is responsible for this policy. It covers zero1io.com, its AI assistant, direct inquiries, and optional Google-connected features in our private tools, including Brief and Spool. Visiting the public website does not connect your Google account. Customer deployments may have additional written data-handling terms; those terms do not override the Google-data restrictions below.

Website and inquiry information

If you email us or book a call, we receive the contact, company, scheduling, and message information you provide. Our hosting and delivery services, including Lovable and Cloudflare, may process IP addresses, browser and device information, referring pages, request times, operational telemetry, and security cookies. Fonts and other externally loaded resources can also disclose routine request information to their providers.

Booking links open Cal.com, which handles information under its own privacy policy. We use website and inquiry information to respond, assess engagements, deliver agreed services, and operate and protect the site. This does not permit advertising uses of connected Google data.

The website AI assistant

If you use "Ask Orbit" on the website, we collect the messages you send and the replies generated, the page you were on, and any details you choose to share, such as your name, work email, company, role, team size, tools, business challenges and timeline. To prevent abuse, we also create a visitor identifier by one-way hashing your IP address and browser information with the current date; it cannot be reversed to reveal your IP address.

Your messages are sent to our AI provider, currently Anthropic, to generate replies, and are handled under that provider's commercial terms. Conversations and lead details are stored in our database, hosted by Supabase. When you share contact details, a summary may be sent to ZERO1 IO's founders by email, Slack, Telegram, or our own internal AI assistant, each under its provider's terms. We use this information to answer you, follow up about a possible engagement, and operate and secure the assistant. We do not sell it or use it for advertising.

We keep lead records as business records until you ask us to delete them or they are no longer needed, and delete rate-limit identifiers after 30 days. Please don't share confidential, privileged or sensitive personal information with the assistant. To access or delete your conversation, email hello@zero1io.com.

Google data we access

Connecting an account uses Google OAuth. You approve permissions at Google; we do not request your Google password. Available features and the permissions you approve determine the data accessed:

• Account identity: your account email and identifiers needed to associate the connection with the correct user.
• Gmail: message and thread identifiers, sender and recipient headers, subjects, dates, labels, unread state, and snippets when available. Metadata-only connections do not retrieve message bodies. A feature separately authorized with Gmail read-only access may retrieve relevant message or thread content to answer your request or prepare a requested summary.
• Google Calendar: calendar identifiers and names, event titles, descriptions, locations, attendees, and start and end times returned for the authorized calendars and requested period.
• Google Contacts: when separately enabled, names, email addresses, phone numbers, organizations, profile photos, and other selected contact fields such as addresses, birthdays, and notes. Contacts access is optional and is not part of every connection.
• Connection credentials: OAuth access and refresh tokens, permission scopes, and expiry information used to maintain authorized access.

These connectors request read-only access. They do not send, modify, archive, or delete Gmail messages, or create, change, or delete Google Calendar events. Revoking access can disable the related features.

How connected information is used

We use Google information to provide the features you enable: private email and schedule views, requested summaries and answers, contact organization, and user-authorized notifications. Relevant contact or calendar records may be associated with records in your private workspace. We do not publish connected account content on the public website.

Google data is not sold, used for targeted advertising, transferred to data brokers or information resellers, or used for credit or lending decisions. We do not use Google Workspace API data to develop, improve, or train non-personalized or general-purpose AI or machine-learning models. Processing information to produce your requested answer is distinct from training a model.

AI processing and sharing

When an AI-assisted feature is enabled, selected email or calendar context may be processed by the configured AI provider, such as OpenAI or Anthropic, to produce your requested summary or answer. This is not exclusively local processing. The provider used depends on the deployment and feature configuration; provider retention and account settings also matter. Google data must not be supplied to a provider for generalized model training or another prohibited purpose. Provider terms and settings must be appropriate for that restriction before a Google-data AI feature is enabled.

If you enable private notifications, selected information or a derived summary may be delivered through your configured channel, such as Telegram. That service receives the message and handles it under its own terms. Do not enable a shared destination unless you intend its members to receive that information.

Hosting, storage, AI, and notification providers receive information needed for the enabled service. Access by people is limited to your affirmative permission for support or a specific request, necessary security investigation, or applicable legal obligations. Google data is not transferred for unrelated business purposes. A permitted business transfer remains subject to Google’s requirements and any required user consent.

ZERO1 IO’s use and transfer to any other app of information received from Google APIs will adhere to the Google API Services User Data Policy, including the Limited Use requirements.

Storage and protection

Connected records, tokens, cached contact photos, and generated summaries may be stored in databases and files on the configured private runtime, including user-controlled local systems. Features may keep dated display snapshots and operational records. Tokens are used for the connection, not as content for AI prompts.

We use HTTPS for Google API communication and the public website, access restrictions, private runtime access controls, and permission minimization. Device, storage, and backup protections depend on the deployment configuration. This policy does not claim that every stored copy is encrypted or that every feature avoids external processing. No system can guarantee complete security.

Retention and deletion

We retain information while it is needed for enabled features, support, or applicable legal and contractual obligations. There is no single automatic deletion period for all records. Some display snapshots are periodically cleaned up; imported contacts, messages, calendar records, tokens, prior answers, and notification history can have different lifecycles.

You can request deletion of Google-derived or other personal information under our control by emailing hello@zero1io.com. Identify the connected account and service, but never send a password, authorization code, or token. We may verify your identity before acting. We remove applicable active copies unless retention is required by law or necessary for a permitted security purpose, and explain any exception.

Copies on devices you control, downloaded exports, linked messaging accounts, or backups may require separate cleanup. Backup copies follow the applicable backup lifecycle and may not disappear immediately. Deletion from active storage is not a guarantee of forensic erasure from every prior copy.

Disconnecting and your choices

You can deny permissions or revoke the connection through Google Account connections. Once revocation takes effect, the connector cannot continue using that grant to retrieve new Google data. Revocation does not automatically delete records already imported, prior answers, or messages already delivered. Request deletion separately as described above.

You may ask to access or correct information we hold about you. Additional rights may apply where you live. These services are not directed to children under 13.

Contact and policy changes

Contact ZERO1 IO at hello@zero1io.com with privacy questions or requests. We update the date above when this policy changes. If a change materially affects how an enabled feature uses Google data, we notify affected users and obtain additional consent where required before applying the new use.