Roles and instructions
For information you supply on behalf of your business or clients, Zyobit acts as a processor to deliver the service on your instructions. You are responsible for having authority to provide that information and authorize processing; an agency's role also depends on its agreement with its client. Zyobit acts as controller for its own account, billing and website information, as explained in the Privacy Policy. We do not sell customer personal information.
Read the Privacy Policy for account data, retention periods and privacy contacts.
Scope of processing
- Subject matter and duration
- Processing supports the service while your account is active. Account deletion is handled through a request for review. Retention periods, including limited backup retention and legally required billing records, are described in the Privacy Policy.
- Nature and purpose
- Running audits, scoring the five growth dimensions, generating action items, and — where an integration is connected — reading what's needed to do that. Nothing here is processed for advertising, resale, or training a model on a customer's private data.
- Categories of data
- Business identifiers, public listings and review metadata, website content, search results, AI-assistant answers, and data from services you authorize us to connect. Account details, messages, email subscriptions and security records are described separately in the Privacy Policy.
- Categories of data subjects
- People whose information appears in the relevant data, such as business owners, employees, public reviewers, account users and audit requesters. Public availability does not remove the need to handle personal information responsibly.
Security measures
These controls are shared with our Security overview.
Tenant isolation
Every organization's data — audits, businesses, settings — sits behind Postgres row-level security, not application-layer filtering alone. A query scoped to the wrong organization returns nothing at the database, not just at the screen.
Sessions are re-verified, not just trusted
Every page that touches data validates the session against the auth server directly on that request. A stale or forged cookie doesn't get treated as a login the way a cookie-only check would.
Audit logs use hashed IP identifiers
Public audit logging uses a salted one-way hash of the requester's IP address to help prevent abuse. The audit log does not store the plain IP address. This describes Zyobit's audit logging, rather than a claim about every hosting or network provider's logs.
Card numbers never reach our servers
Checkout and billing run through Dodo Payments. Zyobit's servers and database see the payment-provider customer and subscription identifiers needed to manage access — never a card number — and every billing webhook is signature-verified before anything is written.
Service providers
The product uses the providers below for the stated purposes. Use depends on the features and providers configured for the service.
- Supabase
- Database, authentication, row-level security
- Dodo Payments
- Billing and payment processing
- Gemini AI-visibility checks and authorized Google account integrations, where enabled
- SerpApi
- Public business listing and search data, when configured as the market-data provider
- DataForSEO
- Alternative public market-data provider, when configured
- Inngest
- Background audit jobs and scheduled refreshes, where enabled
- Upstash
- Shared rate limiting and abuse prevention, when configured
- Resend
- Customer notification emails, when enabled
- Kit
- Newsletter subscriptions and email delivery, when configured
For the provider terms and safeguards applicable to your organization, contact partners@zyobit.com when requesting a signed agreement.
Deletion and data subject requests
Workspace owners can request deletion from Settings → Data. The request is reviewed before workspace data is removed; submitting it does not immediately erase an account or cancel a subscription. Cancel an active subscription separately to stop renewal charges. For access, correction or deletion of personal data, contact privacy@zyobit.com. We normally complete valid requests within 30 days after verifying authority where necessary.
See retention periods and how to request removal of a public report.
Breach notification
If Zyobit becomes aware of a personal data breach affecting information processed on a customer's behalf, we will notify that customer without undue delay. Our notification commitment is no later than 72 hours after awareness; this is not a waiting period. We will share available information and updates to help the customer assess the impact and meet its own obligations.
Certification status
Zyobit has not completed a SOC 2 audit. The controls described on these pages are implemented in the product, but have not been independently audited. A provider's certification does not certify Zyobit. Any future certification will be described here after completion.
Request a signed agreement
This page is a data-processing overview, not an executed agreement. To request a signed DPA, email partners@zyobit.com with your organization name and any procurement requirements. Signing is handled directly with our team; there is no self-serve signature flow. The signed agreement sets the contractual terms for your organization.
Request a signed DPA →Related documents: Privacy Policy, Terms of Service and Security.