Privacy and personal data policy
Version 2 · Last updated: October 3, 2026 (Google Drive)
This policy explains how Zenda Innovation Group (3102938414 SRL, San José, Costa Rica; “Zenda”) collects and processes your personal data when you use this site and Sherlock AI by Zenda. It applies in Costa Rica, Panama, Mexico, Colombia, Venezuela and any other country; the country annex (in Spanish above, summarized below) covers local rules. The Spanish version prevails.
1. Controller
3102938414 SRL (trade name Zenda Innovation Group), San José, Costa Rica. Privacy contact: info@zendainnovation.com, subject “Privacy”.
2. Data we process
- Account and profile: email, password (stored only as a salted hash), language, theme, industry or role, custom instructions and, if you add them, name, photo, company, job title, country, city, company size and answer preferences. If you sign in with Google, we receive your name, email and photo from Google.
- Content: your messages, attached files, photos, videos and voice notes, Sherlock's answers, boards, automated tasks, reminders and, for Zenda's founders, the internal finance log and the videos they create.
- Usage and plan: credits used, approximate cost of answers, plan, renewal date, reports and ratings, and the preferences Sherlock learns from your ratings.
- Payments: card payments are processed by BAC Credomatic (Compra Click) on its secure page and, for automatic subscriptions, by Lemon Squeezy as merchant of record. Zenda never receives your card details; it keeps your plan, email, receipt authorization number and, if you ask for one, your invoice details.
- Technical data: a session cookie (30 days), your browser time zone (used to infer your country) and server logs.
- Permissions: which optional permissions you gave or withdrew, with date and policy version.
We do not ask for sensitive data. Please do not include it in your messages; if you do, we only use it to answer you.
3. Purposes
Necessary purposes (accepted when you create your account or sign in): providing the service, your account, plan, credits and payments; security; support and legal obligations; improving Sherlock from your ratings and reports.
Optional purposes (only with your separate consent, which you can give or withdraw at any time in My profile → Privacy; refusing does not affect your access): Zenda news by email, and partner offers — sharing your name, email, company, job title, country, sector and company size with Zenda's business partners so they can contact you with relevant offers. Zenda may be compensated by those partners. We never share your conversations, files or documents, and every partner signs an agreement to use your data only for that purpose.
Anonymous statistics: we count, anonymously, how Sherlock is used (for example, number of requests by country, sector and company size). These figures exclude names, emails and message content, cannot identify you, and may be used in market studies and reports, including paid ones.
Improvement report: when you rate an answer 👎 or report it, once a week we put together an anonymous report of those cases to review and fix Sherlock. It has no name, email or account or chat identifiers; we remove emails, phone numbers, ID numbers, card and account numbers, and we shorten questions and answers. It is stored in a private GitHub repository that only Zenda's team can access.
We never sell your conversations or files, and we do not share your personal data for commercial purposes unless you opt in to partner offers. No third-party advertising or cross-site tracking.
4. Third-party artificial intelligence
To answer you, Sherlock sends your request and attachments to AI models from Google (Gemini) and, for some features, Anthropic (Claude), both through Google Cloud Vertex AI, and uses Google Search when current information is needed. You accept this when you sign in, and the mobile apps ask for explicit consent before the first request. Under Google Cloud's business terms, this content is not used to train their models.
Distributor and business form
If you fill in the form at zendainnovation.com/distribuidores, we keep your name, company, country, email, phone and message only to reply to you and follow up on your request. We do not use them for advertising or share them with anyone else. You can ask us to delete them by writing to info@zendainnovation.com.
Google Drive (optional)
If you connect your Google Drive, Sherlock only requests the drive.file permission: it can see only the files you choose in Google's window and the files Sherlock saves in your “Sherlock AI by Zenda” folder. It cannot see the rest of your Drive. Those files are used only to answer you and to save your documents there; they are not used for advertising or to train AI models, and they are not shared with anyone else, except what the AI needs to answer you (section 4). We store Google's permission encrypted. You can disconnect it in Sherlock (sidebar → Google Drive) or in your Google account, and it is deleted when you delete your account. Sherlock's use and transfer of information received from Google APIs adheres to the Google API Services User Data Policy, including the Limited Use requirements.
5. Sharing and international transfers
Processors acting on Zenda's behalf: Google Cloud and Firebase (hosting, database, AI, voice, video and Google sign-in), Anthropic through Google Cloud (AI), BAC Credomatic and Lemon Squeezy (payments), Zoho (email) and GitHub (private repository for Sherlock's code and the anonymous improvement report). Partners only if you opt in. Authorities when required by law. Data is stored on Google servers in the United States; by accepting this policy you authorize that transfer.
6. Retention
As long as your account exists. When you delete your account we immediately delete your profile, chats, files, boards, tasks, reminders, ratings and sessions, keeping only a minimal record (email, deletion date and permissions given) for the period required by law to prove compliance, and an encrypted summary (hash) of your email address that only shows that you already received the free trial, to prevent abuse. Payment records are kept by Zenda, BAC Credomatic and Lemon Squeezy as required by law.
7. Your rights
Access, rectification, erasure, objection, withdrawal of consent, portability and information about sharing. In Sherlock: My profile (edit, permissions, download your data) and Settings → Delete my account. By email: info@zendainnovation.com, subject “Privacy”. We reply within 5 business days, free of charge. You may also contact your country's authority.
8. Security, cookies, children and changes
Encrypted connections, PBKDF2 password hashing, one-time codes, lockout after failed attempts and server-only database access; we will notify you of any incident affecting your data. One first-party session cookie; no advertising or tracking cookies. Sherlock is not intended for anyone under 18. We will notify you of material changes and ask for consent again where required.
Country annex (summary)
- Costa Rica: Law No. 8968 and its Regulations; authority: PRODHAB. Databases used for distribution or commercialization of personal data must be registered with PRODHAB before doing so.
- Panama: Law 81 of 2019 and Executive Decree 285 of 2021; authority: ANTAI.
- Mexico: Federal Law on the Protection of Personal Data Held by Private Parties (published March 20, 2025); this document is the comprehensive privacy notice; authority: Secretaría Anticorrupción y Buen Gobierno.
- Colombia: Statutory Law 1581 of 2012 and Decree 1377 of 2013 (Decree 1074 of 2015); this document is the information processing policy; queries within 10 business days and claims within 15; authority: SIC.
- Venezuela: no general data protection law; Constitution arts. 28 and 60, Special Law against Computer Crimes and Constitutional Chamber ruling No. 1318 of 2011; habeas data before the courts.
