Privacy Policy

Zenhub provides a suite of tools and services for engineering teams (and their leaders).

Zenhub is committed to protecting and respecting your privacy. This Privacy Policy (this “Policy”) sets out how we collect and process personal information about you when you visit our website at www.zenhub.com, when you use our products and services (our “Services”), or when you otherwise do business or make contact with us.

Please read this policy carefully to understand how we handle and treat your personal information.

What information do we collect?

By using the Website or our Services you consent to the use of your Personal Information as described in this Privacy Policy. Except as set forth in this Privacy Policy, your Personal Information will not be used for any other purpose without your consent. We will not actively collect Personal Information for the purpose of sale or marketing in a way that specifically identifies the individual. In other words, we don’t sell customer lists. You may withdraw your consent to our processing of your Personal Information at any time. However, withdrawing consent may result in your inability to continue using the Website and/or the Services.

What do we use your information for?

We use the data we collect to operate our business, to provide the necessary GitHub integrations, and to provide the Services to you. This includes using the data to improve our Services, and to personalize your experiences. We may also use the data to communicate with you to, among other things, inform you about your account, provide security updates, and give you information about the Services. We may also use the data to manage your email subscriptions, improve the relevance and security of our website, respond to user inquiries, send you periodic marketing communications about our Services, and improve the relevance of our advertising.

AI at Zenhub

Zenhub started providing AI-powered features in 2023. With the advent of this new technology, your security and privacy remain a top priority.

• What models does Zenhub AI leverage?
  • Zenhub AI uses several different models (including, but not limited to OpenAI’s GPT4o-mini and Mistral 7b). We are actively experimenting with other technologies.
• Does my data get sent to third-party AI providers?
  • No. All AI models we use we are hosted on our private cloud instances and we never send your data with anyone outside our network policies.
• How will my data be used?
  • We use your data as inputs for categorization, analysis and summarization models. Your data is your data, and we do not mix it with other customers.
• Does Zenhub use my interactions with Zenhub AI features for retraining?
  • Zenhub does not employ any feedback loops toward retraining or optimization for other customers, so your usage of Zenhub AI features will always be siloed and unique to you.

How do we protect your information?

We are SOC2 Type II accredited, and we implement several policies and mechanisms at every level of our application for your protection.

We implement a variety of security measures to maintain the safety of your personal information when you enter, submit, or access your personal information. We offer the use of a secure server. All supplied sensitive/credit information is transmitted via Secure Socket Layer (SSL) technology and then encrypted into our Payment gateway providers database only to be accessible by those authorized with special access rights to such systems, and are required to keep the information confidential. After a transaction, your private information (e.g., credit cards, social security numbers, financials) will never be stored on our servers.

How do we ensure that our processing systems remain confidential, resilient, and available?

We implement a variety of measures to ensure that our processing systems remain confidential, resilient, and available. Specifically, we have implemented processes to help ensure high availability, business continuity, and prompt disaster recovery. We commit to maintaining strong physical and logical access controls and conduct regular penetration testing to identify and address potential vulnerabilities.

Do we use cookies?

Yes. Cookies are small files that a site or its service provider transfers to your computer’s hard drive through your Web browser (if you allow) that enable the sites or service providers’ systems to recognize your browser and capture and remember certain information. You can choose to disable cookies, but if you do, your ability to use or access certain parts of our website may be affected.

Do we disclose any information to outside parties?

We share your personal data with your consent or as necessary to provide the Services to you. We also share your data with vendors working on our behalf; when required by law or to respond to legal processes; to protect our customers; to protect lives; to maintain the security of our Services; and to protect our rights or our property.

We share your personal data with your consent or as necessary to provide the Services to you. We also share personal data with vendors or agents working on our behalf for the purposes described in this Policy. For example, companies we have hired to provide cloud hosting services, database hosting services and customer support may need access to personal data to provide those functions. In such cases, these companies are required to abide by our data privacy and security requirements and are not allowed to use personal data they receive from us for any other purpose. The current list of vendors that we use to provide the Services can be found here https://zenhub.com/vendor-services. We will update this list from time to time as the list of vendors changes. If you have questions or concerns about any of our vendors, feel free to contact us at dpo@zenhub.com.

We may disclose your personal data as part of a corporate transaction such as a corporate sale, merger, reorganization, dissolution, or similar event.

Finally, we will access, transfer, disclose, and/or preserve personal data when we have a good-faith belief that doing so is necessary to:

1. comply with applicable law or respond to valid legal process, judicial orders, or subpoenas;
2. respond to requests from public or governmental authorities, including for national security or law enforcement purposes;
3. protect the vital interests of our users, customers, or other third parties (including, for example, to prevent spam or attempts to defraud users of our products, or to help prevent the loss of life or serious injury of anyone);
4. operate and maintain the security of our Services, including to prevent or stop an attack on our computer systems or networks;
5. protect the rights, interests, or property of Zenhub or third parties;
6. prevent or investigate possible wrongdoing in connection with the Services; or
7. enforce our Terms of Service.

We may use and share aggregated non-personal information with third parties for marketing, advertising, and analytics purposes.

We never sell or trade your personal information to anyone.

How to Access and Control Your Personal Data

You can view, access, edit, delete, or request a copy of your personal data for many aspects of the Services. You can also make choices about Zenhub’s collection and use of your data. How you can access and control your personal data will depend on which Services you use. You can always choose whether you want to receive marketing communications from us. You can also opt-out from receiving marketing communications from us by using the opt-out link on the communication or by visiting your account’s privacy dashboard.

1. Data Access. You can access your personal data on your account’s privacy dashboard. Note that since we collect some of your personal data directly from GitHub, you will not be able to change or update that information via the Services; instead, you will need to visit your GitHub profile page.
2. Data Portability. You can request a copy of your personal data by submitting an email to us at support@zenhub.com and including “Please send me a copy of my personal data” in the “Subject” line. Zenhub will verify your ability to access that email and then send you a digital export of the data we hold that is associated with your email address. We will use reasonable efforts to respond to your request within 14 days, but in all events within 30 days of our receipt of the request. Note that since we collect some of your personal data directly from GitHub, we will not be able to access or send you a copy of that information; if you want a copy of that information, you will need to reach out to GitHub to request it.
3. Data Erasure. You can delete your personal data on your account’s privacy dashboard. Please be aware that we require certain information about you in order to provide the Services; this means that if you want to delete those critical pieces of personal data, you may be required to delete your entire profile and no longer be able to access or use the Services. Alternatively, you may request that Zenhub delete your personal data by submitting an email to us at support@zenhub.com and including “Please delete my personal data” in the “Subject” line. Zenhub will verify your ability to access that email and then delete the personal data associated with your email address. All customer data stored on our servers is eradicated upon a customer’s termination of service and deletion of account after a 24-hour waiting period to prevent accidental cancellation. We will use reasonable efforts to respond to your request within 14 days, but in all events within 30 days of our receipt of the request. Please note that we retain billing and usage metadata about a company or individual as required for compliance with law and regulation. Note that since we collect some of your personal data directly from GitHub, we will not be able to delete that information; if you want to ensure its deletion, you will need to reach out to GitHub to request it.
4. Data Correction. You can modify your personal data on your account’s privacy dashboard. Note that since we collect some of your personal data directly from GitHub, you will not be able to change or update that information via the Services; instead, you will need to visit your GitHub profile page. The Services will sync with GitHub each time you log in to ensure that your GitHub data is up-to-date.****
5. Your Communications Preferences. You can choose whether you wish to receive marketing communications from us. If you receive marketing communications from us and would like to opt-out, you can do so by following the directions in that communication. You can also make choices about your receipt of marketing communications by signing into your account and viewing and managing your communication permissions in your account’s privacy dashboard, where you can update contact information, manage your contact preferences, opt out of email subscriptions, and choose whether to share your contact information with Zenhub. Alternatively, you can request that we withdraw consent to use your personal data by submitting an email to us at support@zenhub.com, and including “Please withdraw my consent for marketing communications” in the “Subject” line. Zenhub will verify your ability to access that email and then update our systems to remove your email address from the system we use to send marketing communications. We will use reasonable efforts to respond to your request within 14 days, but in all events within 30 days of our receipt of the request. Please note that these choices do not apply to mandatory communications that are part of the Services or to surveys or other informational communications that have their own unsubscribe method.

Third Party Links

Occasionally, at our discretion, we may include or offer third-party products or services on our website or through our Services. If you access other websites using the links provided, the operators of these websites may collect information from you that will be used by them in accordance with their privacy policies. These third-party sites have separate and independent privacy policies. We, therefore, have no responsibility or liability for the content and activities of these linked sites. Nonetheless, we seek to protect the integrity of our site and welcome any feedback about these sites.

Where we Store and Process Personal Data; International Transfers

Personal data collected by Zenhub may be stored and processed in the United States, Canada, or in any other country where Zenhub or its affiliates, subsidiaries, or service providers maintain facilities. The storage location(s) are chosen in order to operate efficiently, to improve performance, and to create redundancies in order to protect the data in the event of an outage or other problem. We take steps to ensure that the data we collect is processed according to the provisions of this Policy and the requirements of applicable law wherever the data is located.

We transfer personal data from the European Economic Area and Switzerland to the United States and Canada. When we engage in such transfers, we use a variety of legal mechanisms, including contracts, to help ensure your rights and protections travel with your data. To learn more about the European Commission’s decisions on the adequacy of the protection of personal data in the countries where Zenhub processes personal data, please visit: ec.europa.eu/justice/data-protection/international-transfers/adequacy/index_en.htm

Data Retention

We may retain your personal information as long as you continue to use the Services, have an account with us, or for as long as is necessary to fulfill the purposes outlined in this Policy. You can ask to close your account by contacting us as described above, and we will delete your personal information on request. We may, however, retain personal information for an additional period as is permitted or required under applicable laws, for legal, tax, or regulatory reasons, or for legitimate and lawful business purposes.

We will retain your personal data for as long as necessary to provide the Services to you or for other essential purposes such as complying with our legal obligations, resolving disputes, and enforcing our agreements. Because these needs can vary for different types of data in the context of the different Services we provide, actual retention periods can vary significantly. The criteria we use to determine the retention periods include:

1. How long is the personal data needed to provide the Services and/or operate our business? This includes such things as maintaining and improving the performance of the Services, keeping our systems secure, and maintaining appropriate business and financial records. This is the general rule that establishes the baseline for most data retention periods.
2. Is there an automated control, such as in your privacy dashboard, that enables you to access and delete personal data at any time? If there is not, a shortened data retention time will generally be adopted.
3. Is the personal data of a sensitive type? If so, a shortened retention time would generally be appropriate.
4. Has the user provided consent for a longer retention period? If so, we will retain the data in accordance with your consent.**
5. Is Zenhub subject to a legal, contractual, or similar obligation to retain the data? Examples can include mandatory data retention laws in the applicable jurisdiction, government orders to preserve data relevant to an investigation, or data that must be retained for the purposes of litigation.

Zenhub Browser Extension for GitHub

This section applies specifically to the Zenhub browser extension for GitHub available on the Chrome Web Store.

Authentication & Credentials
The Zenhub extension uses GitHub OAuth for authentication. We never request, transmit, or store your GitHub password. Upon successful authentication, an encrypted access token is stored locally on your device to maintain your session. This token is used solely to interact with the Zenhub and GitHub APIs on your behalf.

Permissions
The Zenhub extension requests only the permissions necessary to provide its core functionality:

• storage — Used to securely store your encrypted authentication token locally in your browser, so you remain logged in between sessions.
• GitHub (github.com, api.github.com) — The extension operates within GitHub’s web interface, reading and modifying page content to embed Zenhub’s project management features (boards, estimates, pipelines) directly into GitHub. It also communicates with the GitHub API to read and update issue and repository data on your behalf.
• Zenhub API (api.zenhub.com) — Used to sync your GitHub issue data with Zenhub’s project management layer, including boards, sprints, and epics.

No permissions are used for advertising, tracking, or any purpose beyond delivering the Zenhub product experience.

Data Collection
The extension does not collect any data beyond what is described in the “What information do we collect?” section of this privacy policy.

Data Storage
Your authentication token is encrypted and stored using your browser’s built-in chrome.storage API. No passwords or unencrypted credentials are ever stored or transmitted.

Third Parties
The extension’s interactions with third-party services are governed by the third-party section of this privacy policy.

Changes to our Privacy Policy

We will update this privacy statement when necessary to reflect customer feedback and changes in our Services. When we post changes to this statement, we will revise the “last updated” date at the top of the statement. If there are material changes to the statement or in how Zenhub will use your personal data, we will notify you either by prominently posting a notice of such changes before they take effect or by sending you a notification directly. We encourage you to periodically review this privacy statement to learn how Zenhub is protecting your information.

How to Contact Us

If you have a technical or support question, please send us an email at support@zenhub.com.

Unless otherwise stated, Zenhub is a data controller for personal data we collect through the Services subject to this statement. Our address is

Axiom Labs Inc. dba Zenhub,

600-565 Great Northern Way,

Vancouver, BC,

Canada V5T 0H8.

Privacy & Compliance Questions:

If you have a privacy concern, complaint, or a question for the Data Protection Officer of Zenhub, please contact us by using the following information:

Global:

Email: dpo@zenhub.com. We will respond to questions or concerns within 30 days.

European Economic Area (GDPR)

EEA (excluding UK)

Our EEA representative under GDPR Article 27 is:

Rickert Rechtsanwaltsgesellschaft mbH

Email:art-27-rep-axiom@rickert.law

Address: Rickert Rechtsanwaltsgesellschaft mbH - Axiom Labs, Inc, Colmantstraße 15 53115 Bonn Germany 

UK

Our UK representative under GDPR Article 27 is:

Rickert Services Ltd UK

Email: art-27-rep-axiom@rickert-services.uk

Address: Rickert Services Ltd UK - Axiom Labs, Inc - PO Box 1487 Peterborough PE1 9XX United Kingdom