Privacy Policy

1. Introduction

Zentriq Software (“we”, “us”, “our”) is committed to protecting your personal data. This Privacy Policy explains how we collect, use, and safeguard your information when you use Zentriq Agent for Microsoft Dynamics 365 Business Central, Zentriq Connect (which links your own AI assistant, such as Claude or ChatGPT, to Business Central), the Zentriq web dashboard, and the Zentriq PunchOut Chrome extension (collectively, the “Services”).

We comply with the Swiss Federal Act on Data Protection (nFADP), the EU General Data Protection Regulation (GDPR), and other applicable data protection laws.

2. Data Controller

The data controller is:

3. Data We Collect

3.1 Account Information

When you sign in via Microsoft Entra ID, we receive:

• Your name and email address
• Microsoft account identifier
• Organization/tenant information

3.2 Cart Data (PunchOut Extension)

When you capture a cart, the Chrome extension sends the page content to our AI parsing service. This data is:

• Processed in real-time by Claude (Anthropic) to extract structured cart items
• Not permanently stored, data is discarded after processing
• Never used to train AI models

3.3 Business Central Data (Zentriq Agent)

When you interact with the Zentriq Agent chat embedded in Business Central, the following data flows occur:

Sent to our backend (zentriqsoftware.com):

• The text of your messages and conversation history
• Your Business Central tenant ID, environment name, and company name (used to authenticate API calls back to your BC instance)
• The current record context if you opened the chat from an “Ask Zentriq” button (e.g. vendor number, customer number), used so the assistant understands what you are looking at
• Your authenticated email address

Sent to Anthropic (Claude):

• Your message text and conversation history
• BC data fetched on your behalf to answer your question (e.g. a list of open purchase orders, an item card), only what is needed to answer the specific question

What is NOT sent:

• We do not export your full BC database
• We do not send credentials, passwords, or API keys
• We do not use your data to train AI models, Anthropic’s zero data retention policy applies to our API usage

Storage and retention: Conversation history is stored in our PostgreSQL database (EU region) so you can resume past conversations. Conversations are retained until you delete them or close your account. You may request deletion at any time via privacy@zentriqsoftware.com.

3.4 Business Central Data (Zentriq Connect)

Zentriq Connect lets you link your own AI assistant — such as Claude (Anthropic) or ChatGPT (OpenAI) — to your Business Central through the Model Context Protocol (MCP), using Zentriq’s safe tools. This data flow differs from the Zentriq Agent (§3.3) in one important way, which we state plainly:

Where the reasoning happens. With the Zentriq Agent, AI inference runs on our own EU infrastructure (§5). With Zentriq Connect, the reasoning is performed by your AI assistant. Any Business Central data your assistant reads through Connect is therefore transmitted to your AI provider (Anthropic for Claude, OpenAI for ChatGPT) and processed under the agreement you have with that provider — not under Zentriq’s subprocessor agreements. We host and operate Connect in the EU, but we are not the data controller for, and do not control, the processing your AI provider performs on your instructions.

What Zentriq does on this path:

• Authenticates the connection. You connect either via OAuth sign-in (recommended) or a private link. We store only a cryptographic hash of the resulting token, in the EU; the plaintext is shown to you once and never stored.
• Executes the tools you invoke against your Business Central: read-only queries, entity lookups, listing your draft proposals, an optional server-side ledger control scan, and staging drafts you approve inside BC. Connect can never post, pay, or delete — writes only ever create drafts for your approval in the ERP.
• Records activity metadata (which tool ran, when, success or failure, and a short non-sensitive label) so you can see connector activity on your dashboard.

What we do NOT do on this path:

• We do not store the Business Central records your assistant reads through Connect — they pass through the tool call and are returned to your assistant.
• We do not use any Connect data to train AI models.

Your controls. The connection is scoped to the Business Central environment and company you choose when you authorize it, inherits exactly the permissions of the account that authorized it, and is revocable at any time from your dashboard (Connect page → Disconnect), which stops all connected assistants immediately.

3.5 Usage Data

We collect anonymous usage metrics (page views, feature usage, error rates) to improve our services. No personal data is included in analytics.

4. How We Use Your Data

• Service delivery: To authenticate you, process cart captures, and provide the Zentriq Agent
• Billing: To manage subscriptions via Stripe (we do not store card details)
• Communication: To send service-related notifications (no marketing without consent)
• Improvement: To analyze anonymized usage patterns and improve our services

5. Subprocessors

We rely on the following subprocessors to deliver the Services. Each is bound by a data processing agreement and processes personal data only on our instructions.

Zentriq Connect — your AI provider is not our subprocessor. When you use Zentriq Connect (§3.4), the AI provider that reasons over your data is the one you choose — Anthropic (Claude) or OpenAI (ChatGPT) — acting under your own agreement with that provider. In that role they are a recipient determined by you, not a Zentriq subprocessor, and their data-residency and retention terms are those of your own account with them. The subprocessors listed above (Microsoft, Vercel, Neon) support Connect only for sign-in, tool execution against your Business Central, hashed-token storage, and activity metadata — all in the EU.

For a Data Processing Agreement (DPA) and the current subprocessor list, see our Data Processing Agreement.

6. Data Retention

We retain account data for the duration of your account. Cart data is processed in real-time and not retained. Usage logs are retained for 90 days. Zentriq Connect authorizations (hashed tokens) are retained until you revoke them or disconnect; expired tokens are purged automatically. You can request account deletion at any time, which also deletes your connector authorizations.

7. Your Rights

Under GDPR and nFADP, you have the right to:

• Access, request a copy of your personal data
• Rectification, correct inaccurate data
• Erasure, request deletion of your data
• Portability, receive your data in a structured format
• Object, object to data processing
• Withdraw consent, at any time, without affecting prior processing

To exercise your rights, email privacy@zentriqsoftware.com.

8. Cookies

We use essential cookies required for authentication and session management. With your consent, our public marketing website also sets non-essential cookies: an affiliate-referral cookie (FirstPromoter's _fprom_tid, used to attribute sign-ups to partners) and anonymous usage analytics (Vercel Analytics). These non-essential cookies are only set after you accept them in our cookie banner, and you can withdraw consent at any time using the “Cookie settings” link in the footer. We do not use advertising cookies and do not sell your data.

9. Security

We implement industry-standard security measures including TLS encryption in transit, encrypted storage at rest, regular security audits, and access controls.

10. Changes to This Policy

We may update this policy periodically. Significant changes will be communicated via email or in-app notification. Continued use of our Services constitutes acceptance of the updated policy.

11. Contact

For privacy-related inquiries, contact us at privacy@zentriqsoftware.com.