Zandra Use and Privacy Policy

Effective date: November 2026

Policy for Use and Protection of Privacy When Using Zandra AI

This policy governs the responsible use and protection of personal and sensitive data when processed by Zandra AI, Paraben Corporation’s digital forensics and incident response (DFIR) tool. It ensures compliance with global privacy laws and ethical standards while maximizing investigative effectiveness.

Scope and Applicability

Applies to all personnel using Zandra AI within the organization. Covers all data sources ingested by Zandra AI, including logs, files, devices, cloud data, and user information.

Data Collection and Minimization

Only collecting and processing data is strictly necessary for specific forensic or investigative purpose. All data should be normalized to required formats (e.g., .DOCX, .TXT, .CSV) to ensure compatibility and minimize unnecessary data exposure. All data once input into Zandra AI will be obfuscated from its original source to a numerical representation to avoid the storing of the original readable data in the Zandra AI system.

Purpose Specification and Transparency

Clearly define and document the specific purposes for which data is processed by Zandra AI. Inform data subjects (where applicable) that their data may be analyzed by AI tools for forensic or incident response purposes. Disclose the use of Zandra AI by name in privacy notices or policies, specifying how and why user data is shared with or processed by the AI platform.

Legal Compliance and User Rights

Before the processing of data ensure all processing aligns with applicable data protection laws (e.g., GDPR, CCPA, LGPD, POPIA). Conduct Data Protection Impact Assessments (DPIA) before deploying Zandra AI or when making significant changes to its use. When starting your additional data to Zandra provide mechanisms for data subjects to exercise their rights (access, correction, deletion, objection), unless restricted by legal or investigative requirements.

Data Security and Access Controls

Zandra AI implements robust technical and organizational measures to protect data, including encryption, secure storage, and access controls. The user of Zandra AI is responsible for the control of limited access to Zandra AI and processed data to authorized personnel only. All Zandra AI access is limited to a single login account that has 2FA enabled. Zandra AI credentials for login are recommended to remain private and under the control of the user.

Data Retention and Deletion

Zandra AI data retention is limited to the obfuscated data associated with the users interaction. All other data associated with Zandra AI is considered operating data and does not contain references to user data or case data. All data uploaded through the Zandra AI system as done so from the end user and the end user should implement a data control policy for the closure of cases and associated data.

Human Oversight and Validation

Zandra AI is an assistant to a digital investigation and does not replace the need for a human to verify the data discussed in the AI. While using Zandra AI it is recommended an audit of your activities is maintained to use for legal review of your processes.

Ethical Considerations and Bias Mitigation

Regularly review Zandra AI’s outputs for potential biases or unfair outcomes, especially when handling sensitive or protected data. Although Zandra AI has been trained to not provide false positives it still requires outputs to be reviewed by a human.

Policy Review and Updates

Review this policy annually or upon significant changes to Zandra AI’s functionality, data sources, or applicable laws. Update procedures and training to reflect changes in technology, law, or organizational practices.

Accountability and Documentation

Maintain up-to-date documentation of all AI-related data processing activities, privacy impact assessments, and compliance measures. Assign responsibility for policy enforcement and compliance monitoring to a designated Data Protection Officer or equivalent role.