Privacy policy
We collect only what we need to run the zmate.io website and the Zmate service. Zmate doesn't store your Zscaler data, we don't sell personal information, and we don't use it for advertising. This page explains exactly what we handle, why, who helps us, and how to reach us.
Who we are
Zmate is made by HuCortex Inc., Thrive Business Centre, 105, 11500 29 Street SE, Calgary, Alberta, Canada T2Z 3W9. For customers in the United Kingdom, the contracting company is HUCORTEX LTD, 71-75 Shelton Street, Covent Garden, London, WC2H 9JQ, United Kingdom. In this policy, "HuCortex", "we" and "us" mean whichever of these companies you deal with.
For privacy questions or requests, email hello@zmate.io.
Two different roles
- The website and our own business. When you visit zmate.io, request a demo or email us, we decide how that information is used. We're responsible for it (under UK and EU law, the "controller").
- The Zmate service. When your organization uses Zmate, it handles information from your Zscaler and your Slack workspace on your organization's behalf and under its instructions. Your organization is responsible for that information, and we act as its service provider (the "processor"). Your organization's agreement with us governs that processing. If you're an employee of one of our customers, contact your organization first about data in its Zscaler or Slack environment.
The website
Demo requests and email
The demo request form asks for your name, work email, company, job title and whether you already use Zscaler. We use this to reply, arrange a demo and follow up about Zmate. The form is delivered to us through a form-handling service. If you email us, we receive your message and email address.
Analytics and cookies
We use Google Analytics 4 on the home page to see how the site is used so we can improve it. Google processes this data on our behalf.
- Cookies only if you accept. The banner on the home page asks first. Until you click Accept, no analytics cookies are set, and Google receives only basic signals without cookies (Google's Consent Mode). If you accept, Google Analytics sets cookies named
_gaand_ga_*. - Change your mind any time with "Cookie settings" at the bottom of the home page, or block the cookies in your browser.
- Your choice is saved in your browser's local storage, not in a cookie.
Our hosting provider also counts page loads and load times on every page, without cookies and without identifying you.
We don't use advertising cookies or cross-site tracking, and we don't sell or share data for advertising.
Hosting
The site is served through a hosting and security provider, which processes technical request data, such as your IP address and browser type, to deliver pages and protect the site from abuse.
The Zmate service
Zscaler and Slack data
Zmate connects to your organization's Zscaler with access your organization grants and can withdraw at any time, and works inside your organization's Slack workspace. To answer a command it reads the Zscaler information needed (for example rules, users, devices or alerts) and posts the result to your Slack channel. It also sees the Slack user IDs and channel IDs involved and the text of /zmate commands.
Zmate doesn't use AI. Nothing it handles, including your Zscaler data, user details and commands, is sent to an AI model.
Zmate doesn't keep a copy of your Zscaler data. It holds only short-lived working state: a pending action for up to five minutes while it waits for confirmation, and a record of an active lockdown or isolation (such as the user's email and what was changed) until it's reversed or the service restarts. The record of what happened stays in your Slack channel, under your organization's control.
When an admin uses /zmate otp to get a Zscaler Client Connector one-time password for a user's device, the code is shown only to that admin. Zmate doesn't store or log it; the channel gets a note of who fetched which code for whom, without the code itself.
Operational logs
Like any service, Zmate writes technical logs to help us run and troubleshoot it. Logs can include identifiers related to a command, such as a rule name or the email address of a user being contained. We use logs only to operate and support the service.
License checks
Zmate checks your license key with our licensing service at startup and periodically after. We store, for each key, your organization's identifier, license tier and expiry date. No Zscaler or Slack data is sent in these checks.
Where Zmate runs
- Cloud SaaS: we host Zmate for you on cloud infrastructure in Canada.
- Enterprise Runner: Zmate runs inside your own environment. We access it only to deploy, maintain and update it, as agreed with your organization.
URL investigation and page scanning
When someone runs /zmate investigate-url, Zmate looks up the hostname being investigated (not who asked) with public domain registration, DNS, certificate and website popularity sources. If your organization connects threat intelligence services with its own keys, the hostname is also checked with those services, under your organization's own accounts. Internal-looking names are refused before any lookup.
When someone clicks Scan page, Zmate's isolated scanner visits that site once and sends a screenshot to the person who asked, by Slack direct message. The scanner keeps nothing after the scan.
Who we share information with
We use these service providers, and only for the purposes described above:
| Provider | What for |
|---|---|
| Cloud hosting and security providers | Serving and protecting the website; license checks; hosting the Zmate Cloud SaaS service and its page scanner in Canada |
| A form-handling service | Delivering demo request forms |
| Google Analytics on the website, with cookies only if you accept | |
| Public lookup sources (domain registration, DNS, certificate and website popularity data) | URL investigation, receiving hostnames only |
| Threat intelligence services your organization connects with its own keys | URL investigation under your organization's own accounts, receiving hostnames only |
Customers can ask us at hello@zmate.io for the current list of named providers.
Slack and Zscaler are your organization's own providers; Zmate connects to them on your organization's behalf. We don't sell personal information. We may disclose information if the law requires it, or to a successor if our business is sold, in which case this policy continues to apply.
Where information is processed
We're based in Canada. Some of our providers process information in other countries, including the United States, the United Kingdom and the European Union. When information leaves Canada, the UK or the EU, we rely on our providers' contractual safeguards, such as the EU Standard Contractual Clauses and the UK International Data Transfer Addendum, where those laws require them.
How long we keep it
- Demo requests and emails: as long as we're in touch about Zmate, and deleted within 24 months of our last contact unless you become a customer.
- Website analytics: Google Analytics data is kept for up to 14 months.
- Zmate working state: only while it's needed, as described above.
- Operational logs: kept for a short period for troubleshooting, normally no longer than 30 days.
- License records: for the life of the license and as long as afterwards as tax and accounting rules require.
Security
We protect information with measures suited to a security product: encrypted connections, least-privilege access, secrets kept out of code, confirmation and multi-factor checks before Zmate makes high-impact changes, and an isolated scanner with no access to customer networks or credentials. No system is perfectly secure, and we'll notify affected customers and regulators as the law requires if a breach occurs.
Your rights
Depending on where you live, you can ask to access the personal information we hold about you, correct it, or withdraw consent you've given. Under UK and EU law you can also ask us to delete it, restrict or object to how we use it, or receive a copy in a portable format. Email hello@zmate.io and we'll respond within 30 days.
If you're not satisfied with our response, you can complain to the Office of the Privacy Commissioner of Canada, the Office of the Information and Privacy Commissioner of Alberta, the UK Information Commissioner's Office, or the data protection authority where you live.
Where UK or EU law requires a legal basis: we handle demo requests and emails to respond to you and to take steps you ask for, we run the website, analytics and security in our legitimate interest in operating and improving it, and we keep records where the law requires.
Children
Zmate is a business product. The site and service aren't directed at children, and we don't knowingly collect children's information.
Changes to this policy
We'll update this page when our practices change and revise the date at the top. If a change materially affects how we handle customer data in the Zmate service, we'll tell customers before it takes effect.
Contact
HuCortex Inc., Thrive Business Centre, 105, 11500 29 Street SE, Calgary, AB, Canada T2Z 3W9 · hello@zmate.io · +1 825 438 6907