I am pretty sure exa specifically say it trains on your data in it's privacy policy, so how can it be ZDR ?

I remember as I was looking at the available web tools for hermes agent not to long ago and looked through the keyless web providers privacy policies, which exa is one of them.

An important enough customer can get special contract terms.

it is not zdr via cloudflare, just a typo in the documentation. it is stated no zdr elsewhere on the page.