Privacy Policy

Last updated: October 2026 · Zalytics LLC

This policy explains what information Zalytics LLC (“Zalytics,” “we,” “us”) collects through this website and the Zalytics service, how we use it, and the choices you have. Zalytics is a practice-management tool for independent mental-health therapists.

The most important thing: Zalytics is built so that your clients’ identities never reach our servers. In the marketing feature, client contact details are converted into coded identifiers on your own device before anything is sent to us — we never receive client names, emails, or phone numbers. The key that creates these codes is stored only in encrypted form, locked with your password — we don’t store your password, and we never unlock or use the key. Even with the key, codes can’t be turned back into names or contact details.

Information we collect

Information you give us. When you request early access or create an account, we collect your name, email address, and details you provide such as your license type and state.
Practice information you enter. Information you add to the product — for example your license and renewal dates, insurance-panel details, and marketing figures — so the service can track deadlines and show your dashboard.
Basic technical information. Standard log and device information needed to operate and secure the service.

What we do not collect

We do not receive your clients’ names, email addresses, phone numbers, or message content. The marketing measurement feature converts client identifiers into coded form on your device, and only those codes are stored on our servers. So that all your devices produce matching codes, the conversion key is kept with your account — encrypted on your device with your password before it is stored. We don’t store your password, and we never unlock or use the key.

How we use information

To provide, maintain, and improve the Zalytics service.
To respond to early-access requests and support questions.
To send you important notices about your account or the service.
To keep the service secure and prevent abuse.

That is the complete list. We never use your information, or anything about your clients, for advertising.

How we share information

We do not sell your personal information, and we do not share it with advertisers or advertising platforms. We share it only with trusted service providers that help us operate the service (for example, hosting, database, and error-monitoring providers), and only as needed to run Zalytics. We may disclose information if required by law.

Data security

We use industry-standard measures to protect information, including encryption in transit and at rest and access controls that limit who can see your data. No system is perfectly secure, but we work to protect your information and to keep client identities off our servers entirely.

Data retention and your choices

We keep your information for as long as your account is active or as needed to provide the service. You can request access to, correction of, or deletion of your information at any time by emailing us at the address below. To delete your account and the data stored with it, follow the steps on our account deletion page.

Connecting your Google Ads account

Zalytics lets you connect your own Google Ads account so the service can show your advertising spend and campaign performance inside your dashboard. When you connect it, you authorize Zalytics to read this data through the Google Ads API on a read-only basis — we never create, change, pause, or delete your campaigns, budgets, or any other resource.

We use this data solely to display your ad spend and performance to you within Zalytics. We do not use it to serve advertising, and we do not sell it, share it, or transfer it to anyone else except the trusted providers that help us operate the service, or as required by law. The access needed to read your account is stored securely on our servers using access controls and is never exposed in your browser. You can disconnect your Google Ads account at any time from within Zalytics, which revokes our access.

Limited Use: Zalytics’ use and transfer of information received from Google APIs will adhere to the Google API Services User Data Policy, including the Limited Use requirements.

Connecting your Meta Ads account

Zalytics lets you connect your own Meta (Facebook and Instagram) ad account so the service can show your advertising spend and campaign performance inside your dashboard. When you connect it, you authorize Zalytics to read this data through Meta’s Marketing API on a read-only basis — we never create, change, pause, or delete your ads, campaigns, budgets, or any other resource.

We use this data solely to display your ad spend and performance to you within Zalytics. We do not use it to serve advertising, and we do not sell it, share it, or transfer it to anyone else except the trusted providers that help us operate the service, or as required by law. The access needed to read your account is stored securely on our servers using access controls and is never exposed in your browser. You can disconnect your Meta ad account at any time from within Zalytics, which deletes our stored access; you can also remove Zalytics from your Facebook settings under Business Integrations.

The Zalytics desktop reader

The reader is a program you install on your own computer. With your permission it connects to your email account, checks your inbox for messages from recognised therapist directories such as Psychology Today, and processes matching messages. It also looks at who sent your other emails — never what they say — so it can tell when a past client contacts you again, as described below.

When the reader identifies a directory inquiry, it converts the sender’s email address into a coded identifier on your computer. Only that identifier, the directory it came from, the event type, and the timestamp are sent to Zalytics. The client’s name, email address, phone number, and message content are not sent to us.

Past clients who get in touch again. To tell when a past client contacts you directly rather than through a directory, the reader also converts the sender address of your other emails into a coded identifier on your computer and compares it, there, with the identifiers of your existing clients. When someone who has been your client, and has had no inquiry or appointment for 90 days, emails you directly, the reader sends Zalytics only their coded identifier, the fact that they got in touch directly, and the timestamp. It never reads the content of these emails, and nothing about a sender who is not already your client leaves your computer.

To connect, the reader opens Google in a visible browser window where you sign in yourself. After you sign in, it asks Google to generate an app password — a credential Google issues specifically to let applications read mail — which is stored encrypted on your computer using Windows DPAPI. So that your phone can use the same connection without setting it up again, an encrypted copy is also kept with your Zalytics account; it is encrypted on your device before it is sent, using a key that we store only in encrypted form. You can revoke that credential at any time from your Google Account’s app passwords page.

The reader only checks mail while it is running, including from the system tray, and it does so every few minutes. Disconnecting it from within Zalytics removes the stored credential from your computer and the encrypted copy from your account, and uninstalling the program stops all reading.

The Zalytics Android app reads directory inquiries the same way: on your phone, sending only the coded identifier, the directory, the event type, and the timestamp. Its copy of the credential is stored encrypted in your phone’s secure storage.

The Zalytics Android app

The Android app shows your Zalytics dashboard. If you choose to connect your email, it also does the same job as the desktop reader, on your phone: it checks your inbox for messages from recognised therapist directories and processes matching messages, and it recognises past clients who email you directly in the same way as the desktop reader, on your phone.

When the app identifies a directory inquiry, it converts the sender’s email address into a coded identifier on your phone. Only that identifier, the directory it came from, the event type, and the timestamp are sent to Zalytics. The client’s name, email address, phone number, and message content are not sent to us.

To connect your email, you create an app password yourself on Google’s website and copy it back into the app. While you are on that setup screen, the app reads your clipboard to pick up the app password and then clears it; it does not read your clipboard at any other time. The app password and your Zalytics sign-in are stored encrypted on your phone using the Android Keystore. You can revoke the app password at any time from your Google Account’s app passwords page.

The app checks for new inquiries when you open it and periodically in the background, as Android allows. Disconnecting your email in Zalytics stops reading and removes the stored app password from your phone the next time the app checks, and uninstalling the app removes everything it stored on your phone.

Calendars

If you connect Google Calendar or Calendly, Zalytics reads your appointments on your own device — the desktop reader or the Android app — and converts each attendee’s email address into a coded identifier there. Only the coded identifier, the source, the type of event (booked, rescheduled or canceled) and the appointment time are sent to Zalytics; names, email addresses and event details are not. On Android, Google Calendar is read from your phone’s own calendar with your permission. Access is read-only: Zalytics never creates, changes or deletes events.

So that each of your devices can read a calendar you connected once, your calendar sign-in is kept with your Zalytics account, encrypted on your device with a key we store only in encrypted form, which we never unlock or use. Disconnecting a calendar in Zalytics removes it from all of your devices and deletes that encrypted copy.

We never use your information for advertising

We never use your account, your practice information, or anything about your clients for advertising, and we never share any of it with advertising platforms. There is no advertising tracking in the Zalytics website or apps.

This is separate from our own marketing: we may run ads for Zalytics on platforms such as Google and Meta to reach therapists who don’t use it yet. Those platforms show the ads and handle information about the people who see and click them under their own privacy policies. From them we receive only totals, such as how many people saw or clicked an ad.

Changes to this policy

We may update this policy from time to time. When we do, we will revise the “Last updated” date above.

Contact us

Questions about this policy or your information? Email zalyticsco@gmail.com.