Privacy policy

Data controller

The controller of the processing described here is G&N Group srl, Graaf Joseph de Meeusstraat 6, 3090 Overijse, Belgium, enterprise number 0834.137.246. For any question about your data or to exercise your rights, write to info@zelnest.com.

Scope and payments

This notice covers the information website, the account-free trial, the application and subscriptions. When payment for a Pack is offered, the flow uses Stripe: Stripe handles payment method and transaction data and fraud prevention information; Zelnest processes billing identity, Pack, period, amount, VAT, transaction identifier and status to perform the contract, issue invoices and manage access. Zelnest does not receive the full card number. Stripe explains its own processing in its privacy policy. The features below apply according to your Pack.

When you visit the website

Your browser exchanges with the server the technical data necessary to display the pages requested, including your IP address. No visit log, contact form, audience measurement or advertising was found in the website code reviewed. The website and application are hosted on an Infomaniak VPS. Any system and host logs, their purpose and retention period still need checking.

When you start a trial without an account

When the account-free trial is offered, after your consent (a tick box), the document you choose (PDF, JPG or PNG, within the limits stated in the Terms of use) is sent to the application and read automatically.

• Purpose: to produce the trial result and enable you to retrieve it, or to create an account, without uploading the document again.
• Legal basis: your consent, recorded with the version of the text accepted and the time.
• Data kept, encrypted: the document, its name, the result and the chosen language.
• Duration: 24 hours at most for any trial, then automatic deletion (a periodic clean-up handles this, without a guarantee to the minute). If you create an account and carry over your trial, the document and the result move into your case and are removed from the trial space.
• Your browser keeps only an analysis identifier (see the Cookies page).
• An irreversible fingerprint of your IP address, and not the address itself, limits the number of trials per day: it is kept with the trial for 24 hours and in a daily counter deleted after about two days. Legal basis: Zelnest's legitimate interest in preventing abuse of the free trial.
• For the full analysis, the text read from the document is sent to the AI provider described below, with bank account numbers masked, after a separate consent.

Account creation and access

If account creation is offered, you provide an email address, a password and your language; a confirmation link, valid for 24 hours, is sent to this address and the account exists only after you click it. First and last names are requested later to save the personal profile. Country can be used to find relevant support, but is not required to open the account. The administration may also create an account at your request.

• Purpose: to give you access to the service you request. Legal basis: that service, within the framework of the terms of use that you accept.
• The password is never kept in plain text: only a salted hash is kept. Login relies on a session cookie (see Cookies).
• During creation, a request contains your email address, your name, the language, the password hash, the fingerprint of your IP address (to limit abusive requests) and the date; its link expires after 24 hours. Requests whose links expired more than 7 days earlier are purged on a later accepted registration; no fixed deletion date is guaranteed.
• Every account receives the free Pack when it is created.

Personal profile

The other information in your profile is optional: telephone, address, date of birth, family and professional situation, housing, declared income, companies (name, VAT number, registered office, establishments, directors), communication signatures. It is used to prepare your letters and procedures and to adapt the assistance proposed. It is encrypted in the database. The application invites you to review your profile every year. Legal basis: your request; you can modify or withdraw each item of information at any time. Zelnest's administration may view an account's profile (each consultation is logged) in order to assist the user. Zelnest does not request or retain the national register number in this profile or its journeys. If an authority requires it, enter it directly on that authority’s portal or form, outside Zelnest.

Cases, documents, notes and deadlines

You can add documents (PDFs, images, Word and Excel files), notes, letters and deadlines. The files, their extracted text, their translations and their analyses are encrypted; optical reading and translation of documents take place on Zelnest's server, without sending anything to an external service. Certain filing information (case titles, file names, case notes, titles, amounts and dates of deadlines) is stored in the database without application-level encryption; payment details and financial contacts are encrypted. Purpose: to provide the features you request. Legal basis: that service. Duration: until you delete the item or your account is deleted.

Analyses, estimates and chances

The analysis of a case reads the documents you have added, checks points against their official sources, then estimates chances and a confidence level. The result is kept encrypted with the case. It is an aid: no decision producing legal effects concerning you is taken solely by automated processing.

Lucie and artificial intelligence

Several features send text to an artificial intelligence provider: questions to Lucie, the full analysis of a case, the preparation of a letter, the reading of a letter in your language, the reading of a document authorised by you, and, with your consent, the full analysis of the trial.

• Structured profile fields included depending on the feature: first name, calculated age, country, region, municipality, postcode, situation, household, professional situation, housing, declared income, information about your companies. Structured fields never included: last name, email address, telephone number, national register number, street and bank details.
• Free-form content: your question, the latest messages, the text of the documents chosen or of those in the case, the extracted facts, the exchanges and notes of the case, the letter concerned and extracts from official public sources are sent as they are. This content may therefore contain the information excluded above, health data, data relating to offences or convictions and data of third parties: Zelnest does not mask them (only recognised bank account numbers are masked in the trial analysis) and cannot guarantee that they do not appear in it. Include only what is necessary.
• Before sharing elements with Lucie, the application displays the selected data and asks for confirmation; you can withdraw a saved choice. The analysis of a case requires your consent in the request.
• In the verified technical configuration, these features use the OpenAI API (api.openai.com) with model gpt-6-luna. Calls to the Responses API use store:false; this setting does not remove abuse-monitoring logs. These may contain requests and responses and are kept by OpenAI for up to 30 days by default, subject to longer retention described in its data controls documentation. The provider or model may change; this notice must then be reviewed before the new configuration is used.
• For each call, Zelnest keeps only the provider, the model, the number of tokens, the status and the date, without the content of the exchanges. Conversations with Lucie are kept encrypted in the case, with no expiry date, until they are deleted.

Special categories of data and third-party data in your documents

Zelnest does not support medical documents or content relating to offences or convictions; the Terms of use prohibit uploading them. A file sent by mistake may nevertheless be read technically before its nature is known. Zelnest does not automatically detect this information and cannot guarantee that it will be masked before any AI transmission you confirm. Delete a file uploaded by mistake or contact us. Files and analyses are encrypted, access is limited to your account, and you may request deletion. Send third-party data only if you are entitled to use it.

Data required and consequences of a refusal

Opening an account requires an email address, password, language and acceptance of the terms. First and last names are required to save the personal profile; country may be needed for support specific to a country. All other fields are optional; without them, certain features (pre-filled letters, tailored assistance) are less precise. For the trial, your consent is required to read the document; without consent, the trial does not take place. Without your consent to sharing with AI, the AI features are not used, and sorting, deadlines and the local reading of documents continue to work. No legal or contractual obligation requires you to provide this data.

Linked mailbox and sending of letters

A test email was sent from the VPS administration and received, but sending client letters has not been tested. If the feature is activated, you can link your mailbox (Gmail, Microsoft or an SMTP server, for example Infomaniak or OVH). Access tokens or passwords are encrypted and deleted on disconnection. Depending on the channel chosen, a letter may be sent through your linked mailbox or Zelnest's configured mail server, only after your confirmation, with the PDF and selected attachments. In Zelnest simulation mode, the message is recorded without being sent. The sending (recipient, subject, message) is kept encrypted. If you authorise the receipt of replies, Zelnest reads your inbox in read-only mode, about every 3 minutes, from the date of connection: only the messages that match a case (reference of a letter, reply to a letter sent or known correspondent) are kept, encrypted, with their authorised attachments; the others are ignored. You can also launch a search in your mailbox history for a correspondent and a period, or import .eml files. Legal basis: your request.

Document inbox and replies by email

When this flow is available, a personal address lets you send documents by email to your "Document inbox" case: only the sender whose address is that of your account is accepted, authorised attachments are imported and the body of the message is not kept. Replies sent to a case's address are kept encrypted; unknown senders are placed in quarantine for 30 days.

Notifications and reminders

The application's notifications (bell) are kept encrypted. A notification email may alert you to a reply received (case title, sender, subject, date) and, if you enable it, to a deadline reminder (without amount or creditor). No browser "push" notification is used. The VPS outgoing SMTP connection has been verified without testing an actual service email send. When these emails are offered, they use the channel configured by the administration.

Assistance, housing, debts and businesses

To look up a business, only the Belgian VAT number entered is sent to the European Commission's VIES service (ten searches per hour at most). The official public pages read for assistance are requested without any personal data. The housing PDF forms are produced on Zelnest's server and are not submitted to any body in your place.

Help requests

If you write to support in the application, your subject and messages are kept encrypted and read by the administration, with your name and email. If you tick the box, a limited summary (title, country, number of documents, stakes, gaps and chances) is attached; no document text is transmitted.

Administration and audit log

The administration can list accounts, view and modify an account's profile, reset a password, delete an account and configure the service. Through the application, it cannot read your cases, documents, letters, emails, conversations or deadlines. An audit log records actions (successful logins, creation or viewing of documents, sending of letters, administration actions) with a technical identifier, without content and without IP address; it is kept after an account is deleted. As the encryption keys are held by the server operator, the operator can technically access the encrypted data; no additional separation is described here.

Recipients and processors

Data is communicated only to: OpenAI (for AI features in the verified technical configuration); the provider of the mailbox you link (Gmail, Microsoft or the SMTP server you specify); the European Commission (VIES service, VAT number only); the provider of the mail server used by the administration for service emails; and the host. The Infomaniak VPS and Swiss Backup S3 are used for hosting and backups of the service. A test email sent from the VPS administration was received; the operational contact mailbox info@zelnest.com uses Infomaniak, while exact roles and processing locations are not yet established in this notice. Zelnest does not sell personal data and uses neither advertising nor audience measurement.

Transfers outside the European Economic Area

Using the OpenAI API at api.openai.com does not guarantee data residency in the EEA; processing outside the EEA is possible. OpenAI's Data Processing Addendum provides for standard contractual clauses or an adequacy decision for transfers of EEA data to affiliates or third parties outside the EEA. Whether that addendum applies to Zelnest's account, and the actual recipients and processing locations, must be checked for the configuration in use. VIES is operated by a European Union institution. A mailbox you link may also involve processing by its provider under its own terms.

Retention periods

• Trial without an account: 24 hours at most. IP address fingerprint of the trial: 24 hours with the trial, daily counter about two days.
• Account creation request: link valid for 24 hours; requests expired for more than 7 days are purged on a later accepted registration, with no fixed deletion date.
• Account, profile, cases, documents, notes, letters, deadlines, conversations and analyses: until you delete them or until the account is deleted; no automatic expiry exists.
• Sessions: 7 days at most, erased on logout.
• Notifications and received messages: until the case or account is deleted (2,000 messages at most per account for automatic receipt).
• Audit log: no retention period set to date.
• Backups: an encrypted backup is created daily and sent to Swiss Backup S3. Local and remote copies older than 30 days are deleted after a new backup has been created and verified in both places. Deleted data can therefore remain in a backup for around 30 days. If new backups fail, deletion is suspended to preserve the last copy until the incident is resolved.
• Deletion: the user can delete their cases, documents, letters, deadlines and conversations; the complete deletion of an account and its files is carried out by the administration on request to info@zelnest.com.

Security

• AES-256-GCM encryption of files, extracted texts, analyses, conversations, profiles, mailbox tokens, notifications and handwritten signatures; passwords are kept as a salted hash (scrypt).
• Sessions by random token of which only the hash is stored; cookie reserved to the server (HttpOnly), not transmitted by third-party sites (SameSite Strict).
• Checking of the origin of requests, separation of data by account and of files by user, size limits and validation of files in an isolated process.
• No external resource is loaded by the application (no font, measurement or advertising service).
• Known limits: the database is not encrypted as a whole (see above for the filing information), and backups are described above.

Your rights

Depending on the processing and under the conditions of the GDPR, you can request access to your data, its rectification, its erasure or the restriction of processing, object to certain processing, and receive your data in a structured format (no automatic export exists to date: request it). Where processing is based on your consent, you can withdraw it at any time without affecting what took place before. Write to info@zelnest.com; we reply within the one-month period provided by the GDPR. You can also lodge a complaint with the Data Protection Authority.

Changes and effective date

This notice applies from 27 October 2026. A change of provider, channel, duration or feature requires a new verification of the text before it is updated.