Online Privacy Policy
1. Overview and Purpose
This Online Privacy Policy (this “Policy”) for ZestFinance, Inc. d/b/a ZEST AI and its wholly owned subsidiaries (collectively referred to as “Zest AI” or the “Company”) incorporates the Online Privacy Statement (the “Statement”), which explains how the Company collects, uses, and shares information from its website. The Statement applies when visiting Zest AI’s websites or affiliated websites displaying this Statement.
The Company maintains a separate Employee and Applicant Privacy Policy for purposes of the California Consumer Privacy Act/California Privacy Rights Act.
2. Roles and Responsibilities
It is the responsibility of the General Counsel/CCO for ensuring satisfaction of the applicable laws with respect to Zest AI’s Online Privacy Policy and Statement as set forth in the Compliance Management System Policy.
3. The Online Privacy Statement
The following Statement will be posted on all Zest AI websites and affiliated websites as of Action Date listed in the Policy History Section below:
3.1 Privacy Policy
Last updated: 10-07-2026
The goal of this Policy is to explain what information we collect when you use ZestFinance Inc. d/b/a ZEST AI’s (“Zest AI’s”) sites and content (“Services”). It also has information about how we store, use, transfer, and delete that information. By using or accessing our Services you acknowledge that you accept the practices and policies described in this Policy. This Policy does not apply to third party sites, including those linked to or from our Services.
Information we collect
In order to make our Services work and give you the best possible experience, we collect information from your interactions with our Services. This can include information you share with us, in any medium, like your name, company/business affiliation, or email address, which we may use to track your account or communicate with you. It can also include information we collect and store based on what Zest AI pages you access, like your Internet Protocol address and referral information.
We use this information to:
- Provide, develop, and personalize our Services;
- Facilitate business communications and operations;
- Fight spam and other abuse;
- Debug; and
- Generate aggregate, non-identifying information about how people use our Services, which we may share with third-parties such as vendors and researchers.
Email from Zest AI
We may send you administrative emails about account or service changes, or new policies. You can’t opt out of this type of email. But, you can opt out of non-administrative emails such as product announcements by selecting the appropriate options in our “Privacy Preference Center” pop up menu when visiting our webpage or emailing hello@zest.ai.
We’ll never email you to ask for your password or other account information. If you receive such an email, please forward it to us so we can investigate.
Disclosure of your information
We may share your personal information with third-parties in some circumstances, including: (1) with your consent; (2) as needed to a vendor or partner who meets our data protection standards; (3) when we have a good faith belief it is required by law, such as pursuant to a subpoena or other legal process; or (4) when we have a good faith belief that doing so will help prevent imminent harm to a person.
If we are going to share your information in response to a legal process, we’ll give you notice so you can challenge it (for example by seeking court intervention), unless we’re prohibited from doing so by law or believe doing so may endanger others. We will object to requests for information about users of our Services that we believe are improper or overbroad.
If we merge with another company such that your information will become subject to a substantively different privacy policy, we’ll notify you before the transfer, so you can opt out of any such new policy during the notice period.
Business Contact Information Sharing
We may share business contact information (such as your name, email addresses, job titles, and company affiliations) with third-party service providers, vendors, and business partners to facilitate our business operations, provide services to you, or enhance our service offerings. These third parties and vendors may incorporate artificial intelligence (AI) technologies in the services they provide to Zest AI. When we share business contact information with such parties, we require them to maintain appropriate data protection standards and use the shared information only for the specific purposes for which it was provided.
Cookies
Unless you have opted out, we may use cookies and similar technologies such as pixels and local storage to recognize you when you return to our website. We may use them in various ways, for example to remember your preferences (such as default language), evaluate email effectiveness, and personalize content and other information.
Our sites do not interpret or respond to Do Not Track browser signals because there are not yet uniform industry standards for how browsers communicate that signal. Even so, as described more fully throughout this Policy, we limit our use and collection of your personal information.
Some third-party services that we use, such as Google Analytics, may place their own cookies in your browser. This Policy covers use of cookies by Zest AI only and not the use of cookies by third parties.
As noted above, you have the ability to elect out of optional cookies via our webpage – be sure to review and select the appropriate options in the pop up “Privacy Preference Center” when visiting our webpage to select your cookie and privacy preferences.
Social Media
You may also find additional information on our products and services through our social media sites such as, without limitation, LinkedIn and Instagram. Please keep in mind that any information you share is visible to all participants on these social media sites and you should never post any sensitive personal information (such as account number or social security number).
Please carefully review the terms of use and privacy policy on the applicable social media site as they may be different from Zest AI’s policies.
Advertising
We may partner with third parties to deliver and monitor advertisements on our websites, and we may monitor advertisement engagement in order to improve visitor experience. Zest AI's advertising partners may use cookies, Web beacons, or other monitoring technologies to compile statistics about website traffic. These third parties are subject to their own privacy policies.
Data Storage
Zest AI uses third-party service providers, such as Amazon Web Services, for hardware, software, networking, storage, and related technology we need to run our Services.
Data Security
We use encryption (HTTPS/TLS) to protect data transmitted to and from our site. However, no data transmission over the Internet is 100% secure, so we can’t guarantee security. You use our Services at your own risk, and you’re responsible for taking reasonable measures to secure your information.
Children
Zest AI doesn’t knowingly market products or services to children online under the age of thirteen, and children under the age of thirteen may not use our sites or services.
Your California Privacy Rights
This section applies to California residents (“consumers”) whose personal information we collect through our Services, and it supplements the other information in this Policy. We provide it under the California Consumer Privacy Act, as amended by the California Privacy Rights Act (together, the “CCPA”). Terms defined in the CCPA have the same meaning when used in this section. This section does not apply to personal information we process on behalf of our business customers as a service provider, or to the personal information of our own personnel, which is addressed in our separate Employee and Applicant Privacy Policy.
Categories of personal information we collect.
In the preceding 12 months, we have collected the following categories of personal information from consumers through our Services:
- Identifiers, such as name, email address, company or business affiliation, and Internet Protocol (IP) address;
- Commercial information, such as records of the services you have requested or received;
- Internet or other electronic network activity information, such as browsing activity, referral information, and your interactions with our website and emails;
- Geolocation data, meaning the approximate location derived from your IP address; and
- Inferences drawn from the above to create a profile reflecting your preferences and interests.
We do not collect Social Security numbers, driver’s license numbers, financial account or payment card numbers, precise geolocation, or the contents of your communications through our Services, and we do not collect or process other categories of “sensitive personal information” through our Services for purposes that would give rise to a right to limit under the CCPA.
Categories of sources.
We collect personal information directly from you, automatically from your device and browser as you interact with our Services, and from third-party service providers such as our analytics and advertising partners.
Business and commercial purposes for collection.
We use the personal information we collect for the purposes described in the “Information we collect” section above, including to provide, develop, and personalize our Services; to facilitate business communications and operations; to fight spam and other abuse; to debug and to maintain the security and integrity of our Services; and to generate aggregate, non-identifying information.
Categories of third parties.
We may disclose personal information to our service providers and vendors, our analytics and advertising partners, our professional advisors, and government or law enforcement authorities, in each case as described in the “Disclosure of your information” section above.
Sale or sharing of personal information.
We do not sell personal information. We have not knowingly sold or shared the personal information of consumers under 16 years of age. To the extent our use of third-party advertising or analytics technologies is treated as “sharing” personal information for cross-context behavioral advertising under the CCPA, you may opt out as described below under “Your rights” and “Opt-out preference signals.”
Retention.
We retain each category of personal information for as long as necessary to fulfill the purposes described in this Policy, unless a longer retention period is required or permitted by law. To determine the appropriate period, we consider the amount, nature, and sensitivity of the information, the potential risk of harm from unauthorized use or disclosure, the purposes for which we process it, and applicable legal requirements.
Your rights.
Subject to certain exceptions, California residents have the right to:
- Know and access the specific pieces and categories of personal information we have collected about them, the categories of sources, the business or commercial purposes for collecting it, and the categories of third parties to whom we disclose it, and receive a copy of that information in a portable format upon request;
- Delete personal information we have collected from them;
- Correct inaccurate personal information we maintain about them;
- Opt out of the sale or sharing of their personal information, to the extent we engage in those activities;
- Not receive discriminatory treatment for exercising any of these rights; and
- Limit the use of sensitive personal information, though this right does not apply to our processing since we do not use sensitive personal information for purposes that would trigger it.
How to exercise your rights.
You may submit a request to know, delete, or correct by emailing us at legal@zest.ai. Because we interact with consumers primarily online, this email address is our designated method for submitting requests. We will acknowledge your request and respond within the timeframes required by the CCPA.
Verification.
To protect your information, we will take steps to verify your identity before responding to a request to know, delete, or correct, generally by matching information you provide with information we already maintain. We may decline to act on a request that we cannot reasonably verify.
Authorized agents.
You may use an authorized agent to submit a request on your behalf. We may require the agent to provide proof of your written permission and may require you to verify your own identity directly with us.
California “Shine the Light.”
California Civil Code Section 1798.83 permits California residents to request certain information about our disclosure of personal information to third parties for those parties’ own direct marketing purposes. We do not disclose personal information to third parties for their own direct marketing purposes.
Contact.
For questions about your California privacy rights, contact us at legal@zest.ai.
Changes to this Policy
Zest AI may periodically update this policy. We’ll notify you about any substantive changes to it.
Questions
We welcome questions, concerns, and feedback about this policy at legal@zest.ai.
4. Policy Requirements
4.1 Monitoring and Testing
Zest AI will ensure that compliance with the Policy and Statement is independently monitored and tested on a regular, as needed basis.
Additionally, Zest AI will review the Policy and Statement at least once per calendar year.
5. References
- Gramm-Leach-Bliley Act (GLBA) and Regulation P
- California Consumer Privacy Act
- Privacy and GLBA Policy
- Employee and Applicant Privacy Policy