ZLO

Privacy policy

Last updated 3 October 2026

ZLO is an app for recording the people you meet at events, adding professional details about them and reminding you to follow up. It is published by Innova8 ("we"). This policy explains what we collect, why, who receives it, how long we keep it and what you can do about it.

Contact

Innova8, dev@innova8.com. Write to us about anything in this policy, including requests to see, correct or delete data.

Data about you, the account holder

Your document library

Files you add to the library (brochures, decks, documents, images, videos) and links are stored privately in your account. Only you can open them; each opening uses a private link that expires after 10 minutes. We do not read or analyse them.

Share links

When you send documents as a link, the person who opens it sees your name and company. On Premium and Ultra we record that the link was opened: the time, the type of device, how long each page was viewed, and, on Ultra links that ask for it, the email address they enter. We do not store their IP address, only a one-way hash of it, and we use no cookies. Link previews made by chat apps are not counted. You can revoke a link at any time; views are deleted with the link or your account.

Welcome emails

When you send a welcome email from ZLO, it goes to the contact's email address with your message, and at the bottom your name, company and business address and an unsubscribe link. It is sent only to contacts you recorded as agreeing to be contacted, and at most one welcome email per contact.

If you connect Gmail or Outlook, the email is sent from your own mailbox. We ask only for permission to send email and to know your address; we cannot read your inbox. The access key is stored encrypted on our server and never on your phone, and you can disconnect at any time in Settings. Until you connect a mailbox, emails are sent "via ZLO" from send@mail.zlo.co through our email delivery provider, and replies go to you.

If someone unsubscribes, we keep their email address on a do-not-email list for your account so they are not emailed again. We keep a copy of each welcome email (recipient, subject, text, status and time) with the contact.

Follow-up sequences, replies and reports

On Ultra you can set up follow-up sequences: up to three emails sent to the contacts from an event who agreed to be contacted. A sequence stops for a contact when they reply, unsubscribe or you stop it.

If reply detection is on, replies to these emails go first to an ZLO address. We forward each reply to you straight away, and ZLO AI sorts it (for example interested, not now or out of office) and writes a one-line summary. We keep only that classification and summary with the contact, never the reply itself.

Event reports summarise an event from your contacts. If you share a report link, anyone with the link can see the contacts' names, job titles and companies in it, never their email addresses or phone numbers. You can turn the link off at any time.

"Ask your leads" sends your question and up to 50 of your own contacts (name, title, company, industry, tags, notes, event) to ZLO AI to answer it.

CRM (HubSpot)

If you connect HubSpot, the contacts you choose to send are created or updated in your HubSpot account with the fields you map. The access key is stored encrypted on our server and you can disconnect at any time. Data in HubSpot is then covered by HubSpot's own terms.

Data about the people you capture

When you add someone to ZLO you may store their name, job title, company, email addresses, phone numbers, address, website and social profile links, a photo of their business card, notes, tags, a follow-up reminder and whether they agreed to be contacted.

You decide who you add and what you record. You are responsible for having a lawful reason to keep and use these details, for example their agreement when they gave you their card. ZLO lets you record that consent with each contact.

Reading business cards

In the Android and iPhone apps, the text on a card is read on your phone. The photo is not sent anywhere for this.

In the web version, the card photo is sent to our server, which asks Google Cloud Vision to read the text and returns it to you. Google processes the photo only to answer that request and does not keep it. We count how many cards you read each day, to apply a fair-use limit.

Enrichment

When you tap Enrich, or when automatic enrichment is on, our server sends a contact's identifiers (such as email address, name, company domain or LinkedIn address) to data providers that return professional details like job title and company:

We stop as soon as the details are found, so most lookups reach only one or two providers. Results are saved with the contact. To avoid repeat lookups we keep a server-side copy of provider answers for up to 30 days. Answers from Apollo and RocketReach are kept for your account only. Answers from People Data Labs and Hunter describe the person looked up, not you, and may be reused if another ZLO user looks up the same person. You can turn automatic enrichment, and phone number lookups, off in Settings.

Your own profile

When you first sign in, we look up your own professional details (name, job title, company and LinkedIn) the same way, using the email address you signed in with, so your profile is filled in for you. This happens once; you can edit or clear the details in Settings, or ask for a fresh look-up there.

ZLO AI

ZLO AI is the assistant built into ZLO. When you use an ZLO AI feature (checking card fields, cleaning up a voice note, scoring a lead, suggesting a follow-up time, suggesting documents, company briefs, personalising a welcome email or drafting a follow-up), our server sends the text needed for that task to Anthropic, which runs the AI model, and returns a suggestion. Nothing is changed or sent until you accept it.

ZLO AI receives a contact's name, job title, company, country, notes and tags, the raw text of a scanned card, and the text of your voice note. It never receives their email address or phone number, except where they appear on the card text you ask it to check. Voice notes are turned into text on your phone; no audio is sent. On Premium and Ultra, PDFs and images you add to your library are read by ZLO AI to write a short summary and tags.

Under its commercial terms, Anthropic processes this data only to answer the request, does not use it to train its models, and keeps it only for a limited time. We keep a record of each ZLO AI request (feature, size and time, not its content) to apply fair-use limits, and the suggestions you see on a lead until you delete the lead or your account.

Where data is stored

Your data is stored with our backend provider, Supabase, in its Sydney, Australia data centre. Each account's data is isolated so that no other user can read it. A copy is kept on your phone so ZLO works without a connection; it syncs when you are back online.

Who receives data

We use these service providers only to run ZLO:

We do not sell personal data, use it for advertising, or track you across other apps and websites.

How long we keep it

Your rights

You can access, correct, export (CSV) and delete your data in the app, or ask us by email. Depending on where you live, data protection laws such as the GDPR, Qatar's Personal Data Privacy Protection Law and Saudi Arabia's Personal Data Protection Law may give you further rights, including objecting to processing and complaining to a regulator.

If your details are stored in ZLO by someone you met, you can ask them to remove you, or email us and we will help.

Security

Data is encrypted in transit. Your sign-in session is kept in your phone's secure storage (Keychain or Keystore). Provider API keys stay on our servers and are never part of the app.

Children

ZLO is a business tool and is not meant for anyone under 16.

Changes

If we change this policy we will update the date above, and tell you in the app if the change is significant.