Privacy Policy

The open-source connector runs on your own machine or server. Your Zotero credentials and library data are processed on that machine. Retrieved passages, metadata and notes are returned to the AI client you choose and may be sent to its cloud service. Local embeddings keep embedding computation on the connector host; they do not make a cloud AI conversation local. Optional API embeddings send text and queries to that provider. Zotero, identifier resolvers and scholarly services receive requests when used. Opt-in update checks contact GitHub.

This website, and only this website, uses Umami, a cookieless analytics tool, hosted in Umami Cloud’s EU region (Germany). It sets no cookies and writes nothing to your device, stores no IP address(your IP is hashed in memory to derive a country, and the hash is discarded daily), gives you no persistent identifier, and cannot follow you to any other site.

What we see is aggregate: which pages were viewed, which site referred you, country, browser and device type, and whether the Subscribe and book a call buttons were clicked. We use it to find out which pages and which referrers are worth the effort, nothing more. There is no advertising, no profiling, and no data sold or shared onward.

Because nothing is stored on or read from your device, no consent banner is required under Article 5(3) of the ePrivacy Directive (Article 129 of the Belgian Electronic Communications Act). We rely on our legitimate interest in understanding how the site is used (Article 6(1)(f) GDPR). If your browser sends a “Do Not Track” signal we record nothing at all, you can opt out entirely by setting the umami.disabled key in your browser’s local storage to 1, and you can object at any time by writing to us.

Website analytics and connector logs are separate. The open-source connector supports optional operator-controlled usage logging, disabled by default. When enabled, it records tool names, outcomes, duration and, in multi-user mode, user identity, without argument values, search text or library content. Those logs stay on the connector host. Hosted operational logging is described below.

If you subscribe to the hosted connector, we store only what’s required to operate it:

• Your Zotero API key / login, used solely to access your library on your behalf. It is encrypted at rest (AES-256-GCM) and transmitted over TLS.
• Your account email and subscription status, to provision and maintain access (managed via Polar; see Payments).
• Search indexes and caches, which can contain metadata, notes, extracted passages and embeddings derived from the library you ask to index. These are stored on the connector host and scoped per authenticated user. Retrieved content is returned to your chosen AI service.
• Operational logs with secrets redacted, kept for reliability and abuse prevention and deleted within 30 days.

We act as a data processor for your library data; you remain in control of it. We access and process the library content needed to answer your requests and build the requested indexes. We do not sell your library or use it to train models. Access stays scoped to libraries your Zotero permissions allow. Your chosen AI service has its own data-handling terms.

We process your account email, subscription status, and encrypted Zotero key because they are necessary to provide the subscription you signed up for (Article 6(1)(b) GDPR, performance of our contract with you). We keep short-term operational logs on the basis of our legitimate interest in keeping the service reliable and preventing abuse (Article 6(1)(f) GDPR).

Checkout and billing are handled by Polar as the merchant of record. We never see your card details. Polar processes your payment data under its own privacy policy.

• Polar: checkout, subscriptions, and licensing.
• Google Cloud (Google LLC): hosts the hosted connector instance; see International transfers below.
• Umami Software, Inc.: cookieless website analytics for zoteus.com, with analytics data stored in the EU (Germany) region.
• Your own Zotero account: the source of the library data you ask us to access.

The hosted connector currently runs on Google Cloud infrastructure located in the United States (region us-central1). This means that if you use the hosted tier, your encrypted Zotero API key and account email are transferred to and stored in the US. We rely on Google Cloud’s Standard Contractual Clauses (and, where applicable, the EU–US Data Privacy Framework) as the safeguard for this transfer under Articles 44–46 GDPR. No EU hosting option is promised here. If you self-host, assess where your server, Zotero account, chosen AI service and any external embedding provider process data; self-hosting does not by itself eliminate international transfers.

Website analytics data is stored in Umami Cloud’s EU (Germany) region and is not transferred outside the EEA. The tracker script itself is delivered over a global CDN, which means your browser requests one small JavaScript file from a server near you.

We keep your encrypted key only while your subscription is active. Revoke the key in Zotero at any time to cut off access immediately, cancel to stop renewal, or email us to delete your stored data outright. On cancellation we delete stored credentials within 30 days.

Where the GDPR applies, you can request access, correction, deletion, portability, or restriction of your data, and object to processing based on our legitimate interest. Contact privacy@zoteus.com and we’ll respond promptly. You also have the right to lodge a complaint with your data protection authority; in Belgium, the Gegevensbeschermingsautoriteit / Autorité de protection des données.

Credentials are encrypted at rest, traffic is served over HTTPS, and access is scoped to your own library. No system is perfectly secure, but we keep the stored surface area deliberately small.

The data controller for the hosted tier is Oscar Devos, operating Zoteus from Belgium. You can reach the controller at privacy@zoteus.com for any privacy question or data request. Not affiliated with or endorsed by the Corporation for Digital Scholarship / Zotero.