Privacy & Cookie Policy

Zura Labs (“Zura Labs”, “we”, “us” or “our”) respects your privacy. This policy explains how we handle personal data when you visit zuralabs.com, contact us, request a demo or trial, apply for a job, or use our services and products, including ZuraTM, ZuraVerify and Zura FinServ.

1. Who we are

For personal data collected through this website, the data controller (and “data fiduciary” under India’s DPDP Act) is Zura Labs, 1431 Greenway Drive, Suite 750, Irving, TX 75038, USA, together with its affiliated offices in Bangalore, Hyderabad and Vizag, India. You can reach our privacy team, including our Grievance Officer for India, at info@zuralabs.com with “Privacy request” in the subject line.

2. Information we collect

• Information you give us: your name, work email, phone number, company, job title and the contents of your message when you fill in a form, book a demo, start a trial, subscribe to updates or email us.
• Job applications: your resume, cover letter and any details you choose to share when applying for a role.
• Usage and device information: IP address, browser type, operating system, pages viewed and referring pages, collected through essential technologies and, only with your consent, analytics cookies.
• Information from others: business contact details from partners, events or public professional sources, where permitted by law.

We do not intentionally collect sensitive personal data (such as health, biometric or financial account data) through this website.

3. How we use it and why

Under the GDPR we must have a lawful basis for each use. Under the DPDP Act we process personal data for the purposes described in this notice with your consent or for legitimate uses permitted by law.

We do not use your personal data for automated decision-making that produces legal or similarly significant effects about you.

4. Consent and how to withdraw it

Where we rely on consent, we ask for it clearly and separately, for example through the checkbox on our forms and the cookie banner on your first visit. Consent is free, specific, informed and unambiguous, and you can withdraw it as easily as you gave it:

• Use Cookie settings in the footer of any page, or the button at the top of this policy, to change your cookie choice.
• Click “unsubscribe” in any marketing email.
• Email info@zuralabs.com to withdraw consent for any other processing.

Withdrawing consent does not affect processing carried out before you withdrew it.

5. Cookies and similar technologies

On your first visit we show a banner asking you to choose Accept all or Essential only. Non-essential cookies stay off until you accept them. If your browser sends a Global Privacy Control signal, we treat it as a choice of essential cookies only.

We do not use advertising or cross-site tracking cookies. You can also block or delete cookies in your browser settings.

6. How we share information

We do not sell your personal data, and we do not share it for cross-context behavioural advertising. We share it only as follows:

• Service providers such as cloud hosting, email, scheduling and IT support vendors, who act on our instructions under written contracts with confidentiality and security obligations.
• Strategic partners: as part of our partnership with Primus Global Solutions, we may share limited information needed to deliver services to you, in line with applicable data protection laws.
• Affiliates within the Zura Labs group in the USA and India, to provide and support our services.
• Legal and safety reasons: to comply with law, court orders or lawful requests from authorities, or to protect rights, property and safety.
• Business transfers: as part of a merger, acquisition or sale of assets, subject to this policy.

7. Customer data in our products

When our customers use ZuraTM, ZuraVerify or Zura FinServ, they decide what data is processed (for example timesheets, payroll records or candidate resumes). For that data we act as a processor (or “data processor” under the DPDP Act) on the customer’s instructions and under our agreement with them. If your data is in one of our customer’s accounts, please contact that customer first. We will help them respond to your request.

8. International data transfers

We operate in the USA and India and serve clients in the Americas, Europe and Asia, so your data may be processed outside your country. When we transfer personal data from the European Economic Area, the UK or Switzerland, we use appropriate safeguards such as the European Commission’s Standard Contractual Clauses and the UK International Data Transfer Addendum. Transfers from India follow the DPDP Act and any restrictions notified by the Government of India.

9. How long we keep data

We keep personal data only as long as needed for the purposes above. Enquiries and demo requests are generally kept for up to 24 months after our last contact. Job applications are kept for up to 12 months unless you are hired or ask us to delete them sooner. Contract and billing records are kept as long as tax and accounting law requires. When data is no longer needed, we delete or anonymise it.

10. Security

We protect personal data with encryption in transit, role-based access controls, confidentiality agreements and training for staff, firewalls and intrusion detection, regular audits and assessments, data minimisation, and a documented incident response plan. If a personal data breach is likely to put your rights at risk, we will notify you and the relevant authorities as the law requires, including the Data Protection Board of India and EU or UK supervisory authorities. No method of transmission or storage is completely secure, so please also protect your passwords and devices.

11. Your privacy rights

EU and UK residents (GDPR)

• Access a copy of your personal data and information about how we use it.
• Correct inaccurate or incomplete data.
• Erase your data (“right to be forgotten”).
• Restrict or object to processing, including direct marketing at any time.
• Receive your data in a portable format.
• Withdraw consent at any time.
• Complain to your local data protection supervisory authority.

India (Digital Personal Data Protection Act, 2023)

• Obtain a summary of the personal data we process and the processing activities.
• Correct, complete, update or erase your personal data.
• Withdraw consent, with processing stopping within a reasonable time.
• Use our grievance redressal process through our Grievance Officer, and if unresolved, approach the Data Protection Board of India.
• Nominate another person to exercise your rights in the event of death or incapacity.

US residents (including California under the CCPA/CPRA)

• Know what personal information we collect, use and disclose.
• Delete or correct your personal information.
• Opt out of the sale or sharing of personal information. We do not sell or share it.
• Limit use of sensitive personal information. We do not collect it through this site.
• Not be discriminated against for exercising your rights.

12. How to make a request

Email info@zuralabs.com with “Privacy request” in the subject line and tell us which right you want to exercise. We may ask you to confirm your identity before acting. We respond within one month under the GDPR, within 45 days under US state laws, and within the timelines prescribed under the DPDP Act and its rules. You may use an authorised agent, who will need your signed permission.

13. Children’s privacy

Our website and services are intended for businesses and are not directed to children. We do not knowingly collect personal data from anyone under 18. If you believe a child has given us personal data, contact us and we will delete it.

14. Changes to this policy

We may update this policy to reflect changes in law, technology or our services. We will post the updated version here with a new “last updated” date and, for significant changes, notify you by email or a notice on the site. Where required, we will ask for your consent again.

15. Contact us

Questions, requests or complaints about privacy can be sent to: