Zocks

GDPR overview

The site never mentions the GDPR. Across the seventeen pages reviewed — privacy policy, terms, security and compliance included — the regulation is named neither to claim compliance nor to deny it. There is no published data processing agreement, no subprocessor list and no EU representative under Article 27. The privacy policy frames rights by jurisdiction, "including certain U.S. states and Canada": to know, access, correct and delete, withdraw consent, opt out of targeted advertising, non-discrimination and appeal. Familiar legal bases are listed — consent, contract, legal obligation, vital and legitimate interests — and requests go to info@zocks.io, with identity checks and authorised agents accepted. International transfers are described generically, with no named mechanism. The regulatory frame is American: SEC Regulation S-P, FINRA, Reg BI, DOL, KYC and HIPAA.

Who owns the data?

The terms separate Subscriber Data — everything a firm and its clients bring into the platform — from the Zocks Technology itself, and state that Subscriber Data is the Confidential Information of the Subscriber. The security pages put it plainly: you own and control your data. On expiry or termination, Zocks says it removes all Subscriber Data from the platform and access ends. One reservation matters: the same clause exempts aggregated and anonymised Subscriber Data that Zocks is permitted to use under Section 6.2(b), so de-identified derivatives can outlive the account. Account owners can also flag meetings or whole meeting types as private, visible only to invited participants.

Reuse rights

Nothing in the terms stops a subscriber from reusing what Zocks produces: the notes, summaries, completed forms and CRM records belong to the firm and the product is built to push them straight into the systems it already owns, without asking permission. On the publisher's side, the commitments are explicit: data captured by Zocks is never used for training or improving Large Language Models, and Google Workspace data reached through the integration is excluded from developing, improving or training AI models. Third-party AI, machine learning and LLM providers do process data on Zocks' behalf under contractual obligations. Zocks says it does not sell personal data for monetary consideration, while conceding that some analytics and advertising tools may amount to sharing under US state laws; phone numbers and SMS consent are never passed to third parties for marketing. PII redaction can be enabled before summaries and forms are generated, and drafted emails are never sent to clients automatically.

Data retention & training

Hosting summary

Zocks states that data it captures is processed and stored in the United States, and repeats "Data stored in the U.S." on every pricing tier. The terms of service name Amazon Web Services as the provider holding all Subscriber Data, while reserving the right to use other hosts of similar repute such as GCP or Microsoft Azure. Encryption is claimed in transit and at rest, with access restricted to Zocks. Storing data in a custom security context or geography is possible, but only as an Enterprise Platform option priced on request. The privacy policy adds that processing may take place in the company's offices and wherever the parties involved are located, and that data may be transferred outside the user's own jurisdiction. No European hosting region, no data processing agreement and no transfer mechanism such as standard contractual clauses are documented anywhere on the site.