Privacy Policy
Last updated: 2025-06-10
1. Data Controller
Zalera GmbH ("the Company," "we," "us," or "our") (Prenzlauer Allee 36, 10405 Berlin, Germany) is the data controller for personal data processed through zeiara.com.
The Company operates an AI lifecycle-marketing platform for growth and lifecycle-marketing teams at direct-to-consumer brands and SaaS companies. For CRM data that the Company processes from a client's Braze or Klaviyo workspace, the client generally determines the purposes and means of processing. The Company processes that data as the client's data processor under Article 28 GDPR.
2. Personal Data We Process
The Company processes different categories of personal data depending on how you interact with zeiara.com and the platform.
Website visitors and people who contact us
- name, work email address, and the content of messages submitted through our contact form;
- IP address, browser and operating-system information, and pages visited, as recorded in server logs; and
- session and analytics cookie information, where the relevant consent has been provided.
Platform users
For members of a customer's growth or lifecycle-marketing team, the Company processes account credentials, including name and work email address, usage logs, and integration configuration data. Integration configuration data includes information about which Braze or Klaviyo workspace is connected to the platform.
CRM data processed for customers
When a customer connects a Braze or Klaviyo workspace, the Company processes behavioral signals from that CRM account on the customer's behalf. These signals can include open rates, click paths, custom events, engagement recency, purchase lifecycle data, and channel preference data relating to the customer's end-customers.
The Company's AI scoring model uses those client-provided signals to generate per-person message-variant selection scores. The Company routes the resulting selections back to the customer's CRM as custom attributes, such as zlr_variant_decision in Braze or zlr_variant in Klaviyo. The Company does not use this CRM data for its own marketing or model training outside the contracted service.
3. Purposes and Legal Bases (Article 6 GDPR)
The Company uses personal data for the purposes below. Where the Company processes CRM data as a processor, the customer is responsible for determining the applicable legal basis for its processing and for providing any required notices to its end-customers.
| Purpose | Data involved | Legal basis |
|---|---|---|
| Responding to contact requests and evaluating prospective business relationships | Name, work email address, and message content | Article 6(1)(b) GDPR where the request relates to taking steps at your request before entering into a contract, or Article 6(1)(f) GDPR for managing and responding to business inquiries |
| Operating, securing, and troubleshooting zeiara.com | IP address, browser and operating-system information, pages visited, and server-log information | Article 6(1)(f) GDPR, based on our legitimate interest in operating a secure and reliable website |
| Providing platform accounts and operating the Braze and Klaviyo integrations | Name, work email address, account credentials, usage logs, and integration configuration data | Article 6(1)(b) GDPR for performance of the platform agreement, and Article 6(1)(f) GDPR where necessary to administer and secure the service |
| Using client CRM behavioral signals to generate and return message-variant selections | Open rates, click paths, custom events, engagement recency, purchase lifecycle data, channel preference data, and resulting CRM attributes such as zlr_variant_decision and zlr_variant |
Processing by the Company as a data processor under Article 28 GDPR, on the customer's documented instructions and legal basis |
| Using analytics and session cookies | Cookie and related usage information | Article 6(1)(a) GDPR, where consent has been provided |
4. Recipients and Transfers
The Company may make personal data available to the customer that operates the relevant platform account. For CRM processing, the Company connects to the customer's Braze or Klaviyo workspace, reads the behavioral signals the customer has made available, and writes the resulting message-variant selections back to that same CRM workspace.
Access to personal data is limited to what is needed to provide, administer, secure, and support the website and platform. The Company does not use client CRM data for its own marketing or for model training outside the contracted service.
The Company is based in Germany. Information about specific international transfers, including any applicable transfer mechanism or safeguards, can be obtained by contacting us at [email protected].
5. Retention
The Company retains website contact information and related correspondence for as long as reasonably necessary to respond to the inquiry, manage the resulting business relationship, and meet applicable legal obligations.
Platform account data, usage logs, and integration configuration data are retained while the account and customer relationship require them, and afterwards only for applicable legal, security, dispute-resolution, or record-keeping purposes.
Client CRM behavioral signals and AI-generated message-variant selections are retained only for as long as the customer relationship and the contracted service require. The Company does not retain or reuse this CRM data for its own marketing or model training outside that service. When the applicable service or customer relationship ends, the Company handles deletion or return of the data in accordance with the customer's instructions and the applicable agreement, subject to legal retention requirements.
6. Your GDPR Rights
Depending on the circumstances and the role in which the Company processes your data, you may exercise the following rights in relation to personal data for which the Company is the controller:
- Right of access (Art. 15): confirm whether we process your data and obtain a copy;
- Right to rectification (Art. 16);
- Right to erasure / "right to be forgotten" (Art. 17), subject to limited exceptions;
- Right to restriction of processing (Art. 18);
- Right to data portability (Art. 20);
- Right to object (Art. 21), including to direct marketing without further conditions;
- Right not to be subject to automated decision-making (Art. 22). We do not engage in automated decision-making with legal effects.
To exercise any right, email [email protected]. We respond within one month, extendable by two further months for complex requests.
If your request concerns CRM data that the Company processes for one of its customers, we may direct you to that customer, which is responsible for responding to requests concerning its end-customer data. The Company will assist the customer as required under the applicable data-processing agreement.
7. Right to Lodge a Complaint
You have the right to lodge a complaint with your national supervisory authority. A list of EU/EEA authorities is available at edpb.europa.eu.
8. Cookies
The website uses session and analytics cookies only after the consent required under applicable ePrivacy rules has been provided. Session cookies support the relevant website session, while analytics cookies help the Company understand pages visited and usage of the website.
You can withdraw or change your cookie consent using the cookie controls made available on the website. You can also configure your browser to block or delete cookies, although this may affect website functionality.
9. Security
The Company uses appropriate technical and organisational measures designed to protect personal data against unauthorised access, loss, misuse, alteration, or disclosure. Access to platform accounts, integration configuration data, client CRM signals, and AI-generated CRM attributes is limited according to the needs of the service and customer relationship.
10. Changes
The Company may update this Privacy Policy when its website, platform, integrations, data processing, or legal obligations change. The updated version will be published on zeiara.com with a revised "Last updated" date. For material changes, the Company will provide additional notice where required.
11. Contact
For privacy questions, requests, or concerns, contact:
Zalera GmbHPrenzlauer Allee 36
10405 Berlin
Germany
Email: [email protected]
Phone: +49 30 2017 9450
Contact: Björn Heckel, CEO & Co-Founder