Legal
Privacy Policy
Last updated: 17 October 2026
Who we are
The data controller is a UK sole trader trading as Z3nith (website: https://z3nith.ai). We do not publish a personal name or a postal address. For privacy purposes the controller is identified by the trading name Z3nith and these emails: [email protected] (general and privacy requests) and [email protected] (B2B outreach and opt-outs).
What we collect
- Company website URL you submit for assessment.
- Companies House number when you link it during the free scan (used to pull public filing data).
- Email address if you choose to share it (for report delivery and product updates only).
- Questionnaire answers when you complete a Standard or Premium assessment.
- Anonymised analytics (page views, click events, viewport size) to improve the product, plus first-party source measurement: the referring site, campaign parameters, and landing path of your first visit. These records do not include your IP address.
- Public company details for B2B outreach — a UK limited company or LLP's name, public Companies House records, and a corporate mailbox published on that company's own website. See “B2B outreach” below.
If you download a file from one of our free tools we keep your email to record the download, and we only send updates if you tick the box.
What we don't collect
We do not collect financial card data on z3nith.ai — payments run through Stripe's hosted checkout, and Z3nith never receives card numbers. We do not collect special-category data (race, religion, health, etc.).
How we use it
- To produce your AI Readiness assessment and report.
- To send you the report and, if you opted in, occasional product updates. You can unsubscribe at any time from any email.
- To email relevant UK companies about Z3nith's AI readiness scan, as described under B2B outreach below.
- To improve our scoring methodology — only ever in aggregate.
- To detect and prevent abuse of the service (rate-limiting, spam detection).
B2B outreach (direct marketing)
We may email UK limited companies and LLPs at corporate mailboxes published on their website (for example info@ or enquiries@) about Z3nith's AI readiness scan.
We do not email sole traders, personal Gmail or Hotmail addresses, or anyone who has opted out.
Sources are the company's own public website and public Companies House records. We do not buy mailing lists.
The lawful basis is UK GDPR legitimate interests: marketing a relevant B2B tool to a corporate subscriber. PECR's electronic-mail consent rule does not apply to corporate subscribers. We still identify ourselves as Z3nith and include an opt-out in every message.
To opt out, reply “unsubscribe” to [email protected] or use https://z3nith.ai/unsubscribe. Opt-outs are honoured and suppressed, not deleted, so we do not email that address again.
We do not use tracking pixels or open-tracking in outreach emails. We measure whether the unique results link is opened and whether a paid report is purchased.
Recipients can object to this processing at any time. If you object, we stop.
Who we share it with
We use a small set of UK / EU / US sub-processors: Cloudflare (hosting + DDoS protection), Google (Gemini API for report generation), Companies House API (public filings), Resend (transactional email), Stripe (payments). We never sell your data to anyone.
Your rights (UK GDPR)
You have the right to access, correct, or delete the personal data we hold about you, and to object to processing based on legitimate interests (including direct marketing). Sign in to your dashboard to download all of your data or erase it instantly under “Your data”. You can also email [email protected] and we will action your request within 30 days. For outreach opt-outs, email [email protected] or use the unsubscribe page; we will stop contacting you.
Data retention
Assessment results are kept so you can return to your dashboard, until you delete them or erase your account. Email addresses on the marketing list are kept until you unsubscribe. Outreach opt-outs are kept as a suppression record so we do not email that address again. Records of payments are retained for six years after the relevant financial year, as required by UK tax law — when you erase your account, these are anonymised (your email is removed) rather than deleted. Anonymous analytics is retained for 26 months.
Cookies
We use essential cookies for beta access and session persistence, and a first-party analytics cookie that stores the referring site, campaign parameters, and landing path of your first visit so we can measure where visitors come from. It does not store your name, email, or IP address. The same values are kept in local storage when the cookie is missing.
Z3nith Track
This section was added on 18 October 2026.
If you take out Z3nith Track, we also store your email address, the company name and website address on the subscription, and the assessment it is anchored to. We store each score snapshot and the comparison we email to you. We store the Stripe customer id and the Stripe subscription id. We store the subscription status, whether cancellation is set for the end of the period, and the period end date.
We use these records to provide Track, to take payment, to send service emails about a quarterly result, a failed payment, or cancellation, and to show the Track dashboard. The lawful basis is contract.
Billing and payment records for Track, including the Stripe customer id, the Stripe subscription id, payment and revenue rows, and invoices, are kept for 6 years. Track score snapshots and the company name, website address, and email stored on the subscription are kept while the subscription is active, and deleted 90 days after it ends. They are not removed by the dashboard erase control. To ask for deletion, email [email protected].
Adviser workspaces
This section was added on 18 October 2026.
For an adviser firm we store the firm name, the owner's email, invited colleagues' emails, and each person's role. We store the pack, the client limit, the price, the Stripe customer id, the Stripe subscription id, and the period dates. We store client company names, website addresses, Companies House numbers where the firm supplied them, client email addresses where the firm supplied them, and the assessment results from those scans. We store branding the firm uploads (display name, logo, and colour). If the firm invites a client to a questionnaire, we store that client's email address and their answers, and we email them the invitation.
The firm is the controller of the client records it uploads. Z3nith is the processor. We use those records to run the assessments, reports, questionnaires, and quarterly re-runs the firm requests. The firm needs a lawful basis for that client data. The lawful basis for the firm's own account and billing records is contract.
Billing and payment records for an adviser pack, including Stripe ids, payment and revenue rows, and invoices, are kept for 6 years. Adviser client records, including clients, client scans, questionnaire invites and answers, and branding, are kept while the pack is active, and deleted 90 days after it ends. If the firm deletes a client, that client row is removed. To ask for deletion, email [email protected].
A Track re-assessment and an adviser client scan use the processors already named on this page. Those are Cloudflare, Google (Gemini), Companies House, Resend, and Stripe. These features do not add a processor.