Privacy Policy

1. Who we are

Zagent Labs AB (“Zagent Labs”, “we”, “us”) is a B2B lead generation agency incorporated in Sweden. We operate the website zagentlabs.com and the client portal at zagentlabs.com/dashboard.

Questions about this policy can be directed to: hello@zagentlabs.com

2. Data we collect

We collect and process the following categories of personal data:

• Account data: Email address and authentication credentials when you create a client account.
• Billing data: Payment information processed by Stripe. We do not store card details — Stripe handles all payment data under their own privacy policy.
• Campaign data: Prospect lists, email content, and outreach event data (opens, replies, bounces) processed on your behalf as part of our service.
• Usage data: Portal activity logs, session data, and analytics used to improve the service.
• Communications: Messages sent via the client portal or email to our team.
• Email sign-ups: Email addresses submitted via our homepage email capture form.

3. How we use your data

We use collected data to:

• Deliver and operate the lead generation service
• Process payments and manage subscriptions
• Send service notifications, campaign reports, and account updates
• Respond to support requests and account communications
• Comply with legal obligations under Swedish and EU law
• Improve and develop the platform

We do not sell personal data to third parties. We do not use your data for advertising purposes outside of our own service communications.

4. Prospect data and cold outreach

As part of our B2B lead generation service, we process data about business professionals (“prospects”) on behalf of our clients. This includes names, business email addresses, job titles, and company information sourced from publicly available databases and business directories.

All outreach complies with GDPR Article 6(1)(f) (legitimate interests) for B2B communications. Every email includes an unsubscribe mechanism. Opt-out requests are processed within 48 hours and honoured permanently in our global suppression list.

We do not process sensitive personal data (Article 9 GDPR) as part of our outreach operations.

5. Legal basis for processing

• Contract: Processing necessary to deliver the service you have subscribed to.
• Legitimate interests: B2B prospect outreach, fraud prevention, platform security, and service improvement.
• Consent: Email newsletter sign-ups and optional marketing communications.
• Legal obligation: Tax records, accounting requirements, and compliance with Swedish law.

6. Data retention

We retain personal data for as long as necessary to provide the service and meet legal obligations:

• Account data: for the duration of your subscription, plus 2 years
• Billing records: 7 years (Swedish accounting law requirement)
• Campaign and prospect data: 12 months after campaign completion
• Suppression list entries: indefinitely (to honour opt-outs)

You may request deletion of your account and associated data at any time via the Account settings page or by contacting us directly.

7. Third-party processors

We use the following sub-processors to deliver our service:

• Supabase — database and authentication (EU-hosted)
• Stripe — payment processing
• Vercel — web hosting and deployment
• Instantly.ai — email sending infrastructure
• Upstash — rate limiting and caching
• Anthropic — AI-generated campaign reports (Claude API)

All sub-processors are contractually bound to process data only as instructed and in accordance with GDPR requirements.

8. International transfers

Some of our sub-processors operate outside the EU/EEA. Where personal data is transferred outside the EU, we ensure appropriate safeguards are in place, including Standard Contractual Clauses (SCCs) approved by the European Commission.

9. Your rights

Under GDPR, you have the following rights regarding your personal data:

• Access: Request a copy of the data we hold about you.
• Rectification: Correct inaccurate or incomplete data.
• Erasure: Request deletion of your data (“right to be forgotten”).
• Restriction: Request that we limit how we process your data.
• Portability: Receive your data in a structured, machine-readable format.
• Objection: Object to processing based on legitimate interests.
• Withdraw consent: Withdraw consent at any time where processing is based on consent.

To exercise any of these rights, contact us at hello@zagentlabs.com. We will respond within 30 days.

You also have the right to lodge a complaint with the Swedish Authority for Privacy Protection (IMY) at imy.se.

10. Cookies

We use essential session cookies required for authentication and security. We do not use tracking or advertising cookies. No third-party analytics scripts are loaded on this site.

11. Security

We implement appropriate technical and organisational measures to protect your data, including encrypted data transmission (TLS), row-level security on all database tables, and regular security reviews.

12. Changes to this policy

We may update this policy from time to time. Material changes will be communicated via email or a notice in the client portal. The date at the top of this page reflects the most recent revision.

13. Contact

Zagent Labs AB
Stockholm, Sweden
hello@zagentlabs.com