365 IT Guard

365 IT Guard Privacy Policy

Version 2026-11 · Last updated: November 5, 2026

The short version

365 IT Guard watches your PC's health and security so you can fix problems early. To do that it collects your account details and a summary of how each enrolled device is running. It does not collect what you do on the device.

We collect: your email and name, your device's name and hardware, performance numbers, the names of running programs, and your security settings.

We never collect: file contents, keystrokes, screenshots, clipboard, browsing history, passwords, or the websites and IP addresses your PC connects to. Those last two are checked on your device and never uploaded.

We never: sell your data, use it for advertising, or let our AI provider train models on it.

You can: see, export, or delete your data at any time. Email privacy@365itguard.com.

If your employer or a parent manages your device, they can see that device's health summary. See Who can see your data.

Who we are and what this covers

365 IT Guard is made by Zenlo Innovations & Technology LLC ("Zenlo", "we", "us"), based in Utah, USA. This policy covers:

Zenlo's own website, zenloit.com, and the internal software Zenlo uses to publish to our social media pages are covered by Zenlo's privacy policy.

Our role. For Family accounts and for your own account details, we decide how data is used (we are the "controller"). For devices on a Business account, your employer decides what to monitor and we process that data on their instructions (we are a "processor" or "service provider"). Our Data Processing Agreement applies to every Business account.

Questions go to privacy@365itguard.com. We reply within 30 days.

Personal information we collect

In short: this is the complete list of personal information (PII) we store about you. If it isn't in this table, we don't keep it.

"Personal information" means anything that identifies you or could reasonably be linked to you. Some items below, like a device name, don't look personal but often are (a PC called "SARAH-LAPTOP").

Your account

What Example Where it comes from Why we need it How long we keep it
Email address sarah@example.com You, at sign-up (or from Google if you sign in with Google) Sign-in, account and billing emails Until you delete your account, plus 30 days
Name Sarah Lee You, or your Google profile Shown to you and your account admin Until you delete your account, plus 30 days
Phone number +1 555 0100 You, when you set up two-step sign-in, which every account needs To send two-step sign-in codes, and nothing else. Your number is stored by our sign-in provider, Google Firebase, not in our own database. Our staff don't view it except to help you with a sign-in problem Until you delete your account
Password — You Sign-in. Stored only as a one-way hash by Google Firebase. We never see it Until you delete your account
Sign-in ID a random account ID Google Firebase Links your sign-in to your account Until you delete your account, plus 30 days
Account activity created, last sign-in times Our servers Security and support Until you delete your account, plus 30 days
Organization and role "Lee Family", admin You or your admin Decides who can see which devices Until the organization is deleted
Analytics ID the random ID in the Google Analytics cookie of the browser you signed in with Your browser, when you sign in to the desktop app or create an organization Counting sign-ups and purchases that started on our website (see Cookies) Until you delete your account or the organization is deleted
People you invite their email address You, when you invite someone to your organization Sending the invitation. We don't keep the address afterwards Not kept
Terms acceptance record version, time, IP address, browser type, and whether you agreed to be contacted about feedback Our servers, when you accept our terms Proof that you agreed 6 years after your account is deleted, as a legal record
Feedback you send your message, and whether we may reply. If you aren't signed in, the email you give for the reply You Improving the product, replying if you ask us to 2 years

Billing

What Where it comes from Why we need it How long we keep it
Card and billing address You, entered directly with Stripe Payment. We never see or store your card number Held by Stripe under its privacy policy
Stripe customer and subscription IDs, plan, renewal date Stripe Knowing what you paid for Until the organization is deleted, then as tax law requires

Each enrolled device

What Example Why we need it How long we keep it
Device name SARAH-LAPTOP So you can tell your devices apart Until the device or organization is deleted
Device fingerprint a one-way hash of Windows' machine ID Recognize the same PC after a reinstall Until the device or organization is deleted
Owner which account the device belongs to Show the device to the right people Until the device is reassigned or deleted
Health and security summary see the next section The service itself Detailed history up to 30 days; latest snapshot while the device is enrolled

What we do not collect

Our website

If you contact us through a form on 365itguard.com ("Talk to us" or a feature request):

What Example Why we need it How long we keep it
Name and email Sarah Lee, sarah@example.com To reply to you 2 years
Your message the subject or feature, and what you wrote about your setup To answer it 2 years
How you found us the site that referred you, the page you landed on, campaign tags such as utm_source, the ad click ID if you came from a Google, Meta or Microsoft ad, and the pages you viewed before sending To learn which posts and ads bring people to us 2 years

Submissions are stored in our website's database and emailed to our team. To have yours deleted, email privacy@365itguard.com. The site has no mailing list, and we don't send marketing email.

Like any website, ours also handles your IP address and browser details when you visit, to serve pages and block attacks (see Service providers).

Our social media pages

365 IT Guard has pages on Facebook, Instagram and YouTube. If you follow one, comment on a post, or send us a message there, the platform shows us your public profile name and picture and what you wrote. We use that only to reply to you and to learn what people ask about. We don't copy it into our own systems or link it to a 365 IT Guard account unless you ask us to, for example by emailing support.

The platforms also give us totals, such as views, followers and clicks, which don't identify anyone. Links in our posts carry campaign tags so we can tell which posts bring people to our website (see Our website).

Each platform handles your information under its own policy: Meta for Facebook and Instagram, and Google for YouTube. To remove a comment or message you sent us, delete it on the platform, or email privacy@365itguard.com and we'll remove our copy of any reply thread we've saved.

Sensitive information

We don't ask for sensitive personal information (health, religion, ethnicity, sexual orientation, precise location, or government IDs). Your password is the only credential we handle, and Google Firebase stores it as a hash. If you type sensitive details into the AI Assistant, they go to our AI provider to answer you and are not stored by us (see AI Assistant).

What the app reads on your device

In short: the app reads a lot locally so it can diagnose problems, but it uploads only a health summary, about once a minute while your PC is on.

Uploaded to our servers

Category What's included What's left out
System Windows version, CPU model, memory, disk sizes and free space, uptime, app version —
Performance CPU and memory use, number of running programs, temporary file size, startup item count —
Running programs Program names (like chrome.exe) and process IDs, with their CPU and memory use, and a short history of the busiest ones File paths, command lines, window titles, and which Windows user ran them
Network activity For each program, how many connections it has and to how many distinct hosts The actual IP addresses, websites, and countries
Security Antivirus and firewall product names and whether they're on and up to date, including each Windows Firewall profile; the name, severity, status and detection time of threats Microsoft Defender found File paths of detected threats
Unusual activity When a reading moves well away from your PC's normal pattern, such as a disk filling fast or a program's memory growing: what was measured, the program name if one is involved, the expected and actual values, and when it started and ended File paths

Program names can reveal which apps you use. We store them only to spot slowdowns and risky software, and only you and your account admins can see them.

Checked on your PC and never uploaded

Stored on your PC

The app keeps these in your Windows profile:

Uninstalling removes these, and asks whether to remove the device credential too.

Reports. Each week the app saves a PDF report of the past 7 days to Documents\365 IT Guard\Reports and keeps the newest 12. A report you make yourself goes where you save it. Reports include program names, security status, and the folder and file names from your last storage scan. They never leave your PC unless you share them, and uninstalling doesn't remove them.

Other connections the app makes

Turning it off

Monitoring runs while the app is enrolled. To stop it, remove the device from your account or uninstall the app. You can also stop the app from starting with Windows in Settings.

AI Assistant

In short: The AI Assistant is software, not a person. When you ask it something, your question and a relevant slice of your device's health data go to OpenAI to write the answer. We don't keep your conversation.

What is sent to OpenAI with each question:

Kept back. Before a question leaves your PC, the app replaces your Windows username, your device name, and the user name in any file path with placeholders. Email addresses, phone numbers, public IP addresses, card numbers, MAC addresses, product keys and similar items you type are replaced too, and the chat shows you what was removed. Your account name and email, command lines, and the IP addresses and websites your PC connects to are never sent. The app doesn't catch people's names or website addresses you type yourself, so leave out anything you don't want sent.

Storage. The conversation lives only in the app and is cleared when you close it or start a new chat. On our servers we keep, for 12 months, a usage record (time, which AI model, how much text it processed, whether it worked, and how many items of each kind were kept back, never the items themselves), your thumbs-up or thumbs-down rating with the reason you picked for a thumbs-down, and a log of any fix the AI Assistant ran and its result. These records are tied to your account, or to the device and organization when no one is signed in. Account admins can't see them or your conversation.

PCs with no one signed in. On a PC enrolled to an organization without a user, whoever is at the PC can use the AI Assistant. Requests go out on the device's own credential. It's on by default for new organizations, and an organization admin can turn it off in the admin portal.

OpenAI. OpenAI processes the request under its API business terms, does not use API data to train its models, and keeps it for up to 30 days for abuse monitoring before deleting it. We don't let OpenAI store our requests in its logs. Data is processed in the United States.

Fixes need your approval. The AI Assistant can suggest actions like ending a frozen program or running a Defender scan. Nothing runs until you confirm it.

Answers can be wrong. Check important advice before acting on it. The AI Assistant doesn't make decisions about you with legal or similar effects.

Children's devices. The AI Assistant is designed for adults. On a Family plan, the parent decides who uses each PC. Please don't let a child under 13 use the AI Assistant. If you believe a child has, email privacy@365itguard.com and we'll help.

How we use your information

In short: to run the service you signed up for, keep it secure, and bill you. Nothing else.

Purpose Data used Legal basis
Run monitoring, alerts, and the dashboards in the app and admin portal Account, device, and health data Contract: it's the service you asked for
Answer your AI Assistant questions Your message, recent conversation, relevant device data, and fix results Contract
Sign-in, two-step verification, account emails Email, phone, sign-in ID Contract
Billing Billing records, Stripe IDs Contract, and legal obligation for tax records
Security, abuse prevention, troubleshooting Server logs, IP address, usage records Legitimate interest in keeping the service and our users safe
Product improvement Feedback, AI ratings, aggregate usage Legitimate interest. You can object at any time
Website analytics (Google Analytics) Analytics cookie ID, pages visited, sign-up and purchase events Legitimate interest in understanding how our site is used
Records of your terms acceptance Version, time, IP, browser type Legal obligation and legitimate interest in proving agreement
Replying to your feedback Contact email Consent (you tick the box)

We don't use your data for advertising, sell it, or build profiles about you. If we ever want to use your data in a new way, such as training AI models, we will ask first and not apply it to data we already hold.

Who can see your data

In short: you, your account admins, a few of our staff when needed, and the service providers listed below. We don't sell it to anyone.

People in your organization

Who What they can see
You Your own device's full details in the app
Admins of your Family or Business account For every device in the account: device name, owner's email, drives, health and security summary including firewall and antivirus details, 7 days of performance charts, running program names, connection counts, threat names, and detected issues
Admins cannot see Your AI Assistant conversations and its records of your requests and fixes, file names, the websites or IP addresses your PC connects to, or anything on the "never uploaded" list

If you're a Business admin or a Family admin monitoring someone else's device, you're responsible for telling that person and having the right to monitor it.

Our staff

A small number of authorized Zenlo staff can access account and device data to give support, investigate security issues, or meet legal obligations. Administrative changes are logged.

Service providers

These companies process data for us under contracts that limit them to providing their service:

Provider What they do Data they receive Location
Amazon Web Services Hosts our servers, database, update downloads, and sends account emails All data in this policy USA (N. California)
Google Firebase Sign-in, two-step verification, hosts the sign-in page and admin portal Email, name, password hash, phone, IP address, and your Google profile (name, email, photo link) if you sign in with Google USA
OpenAI Powers the AI Assistant Your questions and relevant device data (see AI Assistant) USA
Stripe Payments Email, billing details, card data USA
Google Analytics Analytics on our website and sign-in page. No analytics scripts run in the admin portal or desktop app, but our servers report a sign-up (with the plan) and a purchase (with the amount and a subscription number) against the analytics ID of the browser you signed in with Cookie ID, pages visited, links clicked, sign-up and purchase events USA
Cloudflare Carries and protects all traffic between the app, the admin portal and our servers, and to our website; serves this page; answers the app's network speed check Everything sent to our servers, while in transit, and your IP address Global
Cloudways Hosts our marketing website and its form submissions Form submissions, IP address, server logs USA (Seattle)
MalCare Firewall that blocks attacks on our website IP address and request details USA and EU
Elastic Email Delivers the emails our website sends, such as form notifications Name, email, and message from website forms; whether the email was opened or a link clicked Canada, USA and EU
Google Fonts Fonts on our marketing website Your IP address USA
Userback A feedback tool on our marketing website. It can record how you use a page (clicks, scrolling, pages visited) and take a screenshot when you send feedback IP address, browser and device details, how you used the page, and any feedback or screenshot you send USA

We'll update this list before adding a new provider. Business customers get notice under the DPA.

Other disclosures

We share data if the law requires it, to protect people from harm, or as part of a merger or sale of the company (the buyer would be bound by this policy). We'll tell you when the law allows.

How long we keep it

In short: detailed device history for 30 days, account data until you delete your account, and a few legal records longer.

Data Kept for
Device health history (minute-by-minute) Up to 30 days
Unusual activity reported by a device 90 days after the activity ends
Latest device snapshot While the device is enrolled
AI Assistant usage records, ratings, and fix log 12 months
Server logs (including IP addresses) 90 days
Automated database backups 7 days, rolling
Account details Until you delete your account
Devices and organization records Until the device or organization is deleted
Feedback 2 years
Terms acceptance records 6 years after account deletion
Billing and tax records As long as tax law requires (usually 7 years)

Deleting your account. Go to Settings in the admin portal and choose Delete account. You have 30 days to change your mind, then we erase your account and sign-in details. If you are the only admin of an organization, you'll need to hand admin over or delete the organization first. Devices you owned are removed from your account. Their records, which include the device name, stay with the organization and are deleted when the organization is deleted.

Deleting an organization. An admin can archive the organization on the Subscription page after cancelling its subscription (a trial can be archived right away). You have 30 days to change your mind. After that we erase its devices, device history, and feedback, and cancel any subscription still running.

Backups roll off within 7 days of deletion.

Security

In short: we collect less so there's less to protect, and we protect what we keep.

No system is perfectly secure. If a breach affects your personal information, we'll notify you and the relevant regulators as the law requires. Report security issues to security@365itguard.com.

Your rights and choices

In short: wherever you live, you can see, correct, export, or delete your data. Email us and we'll respond within 30 days.

We give these rights to everyone, not only people in places where the law requires them:

Right What it means
Access Get a copy of the personal information we hold about you
Correction Fix anything that is wrong or out of date
Deletion Have your account and its data erased
Portability Receive your data in a machine-readable format
Objection and restriction Ask us to stop or limit certain uses, such as product emails
Withdraw consent Turn off anything you opted into, at any time, without affecting what came before
Appeal If we decline a request, ask us to reconsider. We'll explain the outcome and how to complain to a regulator

How to make a request. Email privacy@365itguard.com. You can also delete your account yourself in the admin portal's Settings. We may ask you to confirm you own the account before we act. You can use an authorized agent. We won't charge you or treat you differently for using these rights.

If you're not satisfied. You can complain to your state attorney general or your local data protection authority.

US state residents (including California, Virginia, Colorado, Connecticut, Texas and Oregon). We do not sell your personal information. We do not share it for cross-context behavioral advertising, and we do not use it for targeted advertising or for profiling that produces legal or similarly significant effects. We use sensitive information only to provide the service you asked for.

Monitored devices on a Business account. If your employer installed 365 IT Guard, your employer controls that data. Send requests to them first. We'll help them respond.

Children

Accounts are for adults (18+). On a Family plan, a parent or guardian can install 365 IT Guard on a child's PC and enroll the device without giving the child an account. Device data from that PC is collected at the parent's direction and is visible to the parent. We don't knowingly create accounts for children under 13 (under 16 in the EEA and UK). If we learn we have, we delete the account. Parents can ask us to review or delete a child's device data at privacy@365itguard.com.

Employees on Business accounts

If your employer installed 365 IT Guard, your employer controls the data from that device, and their privacy notice applies. We process it on their behalf under our Data Processing Agreement. Employers must tell employees about the monitoring and have a lawful basis for it.

Where your data is processed

365 IT Guard is offered to customers in the United States. We and our service providers store and process data in the US. If you use the service from another country, your data is transferred to and processed in the US.

Cookies and similar technology

The desktop app, the admin portal, and this page load no analytics or tracking scripts. The admin portal does read the Google Analytics ID our website set, so a sign-up made there can be counted (see Service providers). Our other web pages use:

Name Type Purpose Lasts
Sign-in session (Firebase) Browser storage Keeps you signed in Until you sign out
Preferences (language, theme, terms accepted) Browser storage Remembers your settings Until cleared
_ga, _ga_* (Google Analytics) Cookie Counts visits and sign-ups 2 years
reCAPTCHA (Google) Cookie Blocks bots during two-step sign-in Session
lhd_lp_* (our website) Cookie Remembers the site that referred you, the page you landed on, campaign tags and any ad click ID, so they can be sent with a form 90 days
lhd_lp_journey (our website) Browser storage Lists the pages you view in this visit, so they can be sent with a form Until you close the tab
Userback (our website) Cookie and browser storage Runs the feedback tool and links your visits together Set by Userback; see its privacy policy

We use Google Analytics only to measure visits and sign-ups, with its advertising features turned off. Our websites don't yet change what they do for Global Privacy Control or Do Not Track signals. Because we don't sell or share personal information, there is nothing for those signals to opt you out of.

Changes to this policy

We'll post changes here and update the date at the top. For significant changes, we'll notify you by email or in the app before they take effect. Earlier versions are available on request.

Contact