Privacy Policy
How we collect, use, share and protect your personal data.
KEY DETAILS — the only place these values appear. To update the company, country, product, contact or date, change them here and nowhere else in this document.
Field Value Company / Data Controller ZARZOOM Ltd (referred to in this document as "the Company", "we", "us" or "our") Company registration 17428670 Registered address 13 Bournehall Lane, Bushey, WD23 3NQ, United Kingdom Product / Service name ZARZOOM (the "Service") Website https://zarzoom.com Governing law England & Wales, United Kingdom Privacy / data contact privacy@zarzoom.com Data protection representative None appointed at present (see section 8.4) Last updated 2026-09-01
1. About this Policy
1.1 This Privacy Policy explains how we collect, use, share and protect personal data when you use the Service, visit our website, or otherwise interact with us. It applies alongside our Terms of Service and Cookie Policy.
1.2 We act in two different roles depending on the data:
- As a controller — for personal data about you as our customer, your account, billing, support, and our website visitors. This Policy covers that role.
- As a processor — for personal data you put into the Service, or that we handle on your behalf when generating and publishing Content and operating your Connected Accounts. For that role, you are the controller and our Data Processing Agreement governs how we handle it. Section 9 explains this split.
1.3 We comply with the UK GDPR and Data Protection Act 2018, the EU GDPR where it applies, and applicable US state privacy laws including the CCPA/CPRA, as relevant to where you are.
2. The personal data we collect
We collect the following categories of personal data:
(a) Account and identity data — name, email address, password (stored hashed), organisation name, and account settings.
(b) Billing and transaction data — billing name, billing address, country, currency, plan, subscription and payment history. Card details are handled by our payment processor; we do not store full card numbers.
(c) Workspace and content data — the brands, prompts, instructions, Content, schedules and configuration you create within Workspaces. This may contain personal data if you choose to include it.
(d) Connected Account data — the access tokens and identifiers needed to publish to your Connected Accounts, the platforms you connect, and post and performance data returned by those platforms (for example, post status, impressions and engagement metrics).
(e) Avatar and likeness data — where you use Avatar features, the face or image references you provide and the synthetic likenesses generated from them. Depending on how it is used, image data of an identifiable person may be sensitive. You are responsible for having the rights and consents to provide it (see your warranties in the Terms of Service), and we process it only to provide the feature to you.
(f) Support and communications data — the content of your messages to us, support tickets, and our responses, including any interactions with our AI customer-service agents.
(g) Technical and usage data — IP address, device and browser information, log data, pages and features used, and analytics about how the Service is used.
(h) Cookie and similar data — as described in the Cookie Policy.
3. How we use personal data, and our legal bases
We use personal data for the purposes below. Where the UK/EU GDPR applies, our legal basis is shown.
| Purpose | Legal basis |
|---|---|
| Creating and managing your account; providing the Service | Performance of a contract with you |
| Generating, scheduling and publishing Content to your Connected Accounts on your instruction | Performance of a contract; and, for data of third parties, processing on your behalf (see DPA) |
| Billing, taking payment, preventing fraud | Performance of a contract; legal obligation; legitimate interests (fraud prevention) |
| Providing support and responding to you | Performance of a contract; legitimate interests |
| Securing, maintaining, monitoring and improving the Service | Legitimate interests (running a safe, reliable Service) |
| Compliance and content moderation within our Platform | Legitimate interests; legal obligation |
| Creating a synthetic presenter or voice from your own face or voice reference | Your explicit consent, given in the product when you upload the reference (recorded with the date, time and the wording you agreed to) and withdrawable at any time (see section 4) |
| Sending service and transactional messages | Performance of a contract; legitimate interests |
| Sending marketing (where permitted) | Consent, or legitimate interests where allowed by law; you can opt out at any time |
| Complying with law and enforcing our terms | Legal obligation; legitimate interests |
3.2 Where we rely on legitimate interests, we have considered your rights and interests and you can ask us about that assessment. Where we rely on consent, you can withdraw it at any time without affecting prior processing.
3.3 We do not use your private Workspace Content or your customers' data to train our own or third parties' general-purpose AI models. AI providers process Content to deliver outputs to you, under the terms in section 7 and our DPA.
4. Avatar, face and voice data — extra care
4.1 Some features generate synthetic likenesses from a face or image reference, and synthetic voice. Where image or voice data relates to an identifiable individual and is used to uniquely identify them, it may be special category (biometric) data requiring additional protection and a specific legal basis.
4.2 Where the face or voice is your own, we process it only with your explicit consent, which you give in the product when you upload the reference. We record when you gave it and the wording you agreed to. You can withdraw that consent at any time by deleting the Avatar or voice in your Workspace, or by emailing the privacy contact in the Key Details; we then stop using it and delete the reference and the synthetic assets made from it within 30 days of a verified request, apart from copies in backups (removed within a further 30 days) and any record we are legally required to keep.
4.3 Where the face or voice belongs to someone else, you must have that person's explicit consent before providing it, as the Terms of Service require, and you are the controller of that person's data (see section 9). We process it only to provide the feature to you. If you do not have the right to provide such data, you must not use these features.
4.4 The providers that receive face images and voice recordings on our behalf are named on our sub-processor list (section 6).
5. Children
The Service is not intended for anyone under 18, and we do not knowingly collect personal data from children. If you believe a child has provided us data, contact us and we will delete it.
6. Who we share personal data with
We share personal data with:
(a) Service providers / sub-processors who help us run the Service, under contracts that require them to protect it and use it only on our instructions. These currently include providers of:
- hosting and database (e.g. Vercel; Supabase);
- file and content storage (e.g. Cloudflare R2);
- AI model routing and generation (e.g. OpenRouter; fal.ai);
- reading your own website during setup, when you ask us to and the site refuses our own request (e.g. Jina AI);
- text-to-speech (e.g. Inworld; ElevenLabs);
- social publishing routing (our Publishing Partner, e.g. Upload-Post / Ayrshare);
- payments (e.g. Stripe);
- email delivery, analytics and support tooling.
The current list of sub-processors — who they are, what they do for us, what data they receive and where they process it — is published at https://zarzoom.com/en/legal/sub-processors and is maintained under the DPA.
(b) Third-Party Platforms — when you publish, the relevant Content and associated data are sent to the Connected Accounts and platforms you have chosen. Those platforms are independent controllers of the data once it reaches them, under their own privacy policies.
(c) Professional advisers, authorities and acquirers — our advisers; authorities where required by law; and a buyer or successor in a merger, acquisition or reorganisation (with your data protected on equivalent terms).
We do not sell your personal data.
7. AI providers and how Content is processed
7.1 To generate Content, we send your prompts, instructions and related material to AI model providers via secure connections. They process it to return outputs to us, which we deliver to you. We use providers that contractually limit their use of this data to providing the service and (where applicable) do not use it to train their general models, and we configure their services to that effect where the option exists.
7.2 You should not include in prompts or Content any personal or confidential data you are not entitled to process, and you should avoid putting sensitive personal data into the Service unless you have a lawful basis and have configured the Service appropriately.
8. International transfers
8.1 Where your data is held. Your account data, Workspace data and Content records are stored in the United States with our database and hosting providers (Supabase and Vercel). Media files — images, audio and video you upload or that the Service generates, including any face image or voice recording you provide — are stored in Western Europe (Cloudflare R2). Our content-generation engine runs in the United Kingdom (Manchester). Individual providers may process data in other locations; our sub-processor list (https://zarzoom.com/en/legal/sub-processors) names each provider, what it does and where it processes.
8.2 Safeguards. Where personal data leaves the UK, we rely on a lawful transfer mechanism — a UK adequacy regulation, the UK International Data Transfer Agreement or Addendum, or the EU Standard Contractual Clauses — together with appropriate supplementary safeguards. You can ask us for details of the safeguards used for any transfer.
8.3 EU customers. Where the EU GDPR applies to you, transfers from the EEA to the UK rely on the European Commission's adequacy decision for the United Kingdom, and onward transfers from us rely on the mechanisms in 8.2.
8.4 Representative. We are a UK company with no establishment in the EU. We have not yet appointed an EU representative under Article 27 of the EU GDPR; when we do, their details will appear in the Key Details. Until then, EU data subjects may contact us directly using the privacy contact.
9. Controller vs processor — your data vs your customers' data
9.1 For data about you as our customer (account, billing, support, website usage), we are the controller and this Policy applies.
9.2 For data you put into the Service or that belongs to your audience and customers — including the personal data of people who follow or engage with your Connected Accounts, and any personal data within your Content — you are the controller and we act as your processor. You are responsible for having a lawful basis and for your own privacy notices to those individuals. Our Data Processing Agreement governs that processing, including our security and sub-processor commitments. If you are a Business Customer, the DPA forms part of your agreement with us.
10. How long we keep personal data
10.1 We keep personal data for as long as needed for the purposes above. As a guide: account, Workspace and Content data — for the life of your account; billing records — 6 years after the transaction (tax and accounting law); security, consent and audit logs (including the record of your cookie choices and any consent you give for your own face or voice) — up to 6 years, because they evidence what you agreed to; support correspondence — 2 years after the last message. Deleted Avatars and voice references are scheduled for removal 30 days after you delete them.
10.2 Deletion when you leave us. Self-service account deletion is not yet available in the product; we are building it. Until it is, you can ask us to delete your account and personal data by emailing the privacy contact in the Key Details. We will delete or anonymise your personal data within 30 days of verifying your request, apart from data we must keep by law (for example billing records) and copies in backups, which are removed within a further 30 days.
10.3 Some automated deletion routines described above are still being introduced; where a routine has not yet run, the data remains subject to the same rights and the same 30-day request process in 10.2.
11. How we protect personal data
We use appropriate technical and organisational measures, including encryption in transit, access controls, secret management for credentials and tokens, network controls, and monitoring. No system is perfectly secure, but we work to protect your data and to detect and respond to incidents. If a personal data breach is likely to result in a risk to people's rights and freedoms, we will notify the Information Commissioner's Office within 72 hours of becoming aware of it (UK GDPR Article 33) and, where the risk is high, tell the people affected without undue delay (Article 34).
12. Your rights
12.1 Subject to the law that applies to you, you have rights to:
- access your personal data and get a copy;
- rectify inaccurate or incomplete data;
- erase data in certain circumstances;
- restrict or object to certain processing, including objecting to direct marketing at any time;
- data portability for certain data;
- withdraw consent where we rely on it; and
- not be subject to solely automated decisions with legal or similarly significant effects, except as the law allows.
12.2 If the CCPA/CPRA applies to you (California), you also have rights to know what personal information we collect and how we use and disclose it, to access and delete it, to correct it, to opt out of any "sale" or "sharing" (we do not sell personal data), and not to be discriminated against for exercising your rights.
12.3 To exercise any right, contact us using the privacy contact in the Key Details. We may need to verify your identity. We respond within the timeframes required by law.
12.4 Where we act as processor (section 9.2), requests from your audience or customers should usually be directed to you as controller; we will assist you as set out in the DPA.
13. Marketing
We only send marketing where the law allows, and you can opt out at any time using the unsubscribe link or by contacting us. Opting out of marketing does not stop essential service messages.
14. Complaints
If you have a concern, please contact us first using the Key Details. You also have the right to complain to a data protection authority — in the UK, the Information Commissioner's Office (ICO); in the EU, your local supervisory authority.
15. Changes to this Policy
We may update this Policy. Where changes are material we will give reasonable notice. The "Last updated" date in the Key Details shows the current version.
16. Language
16.1 The authoritative version of this Policy is the English version. Translations are provided for convenience only.
16.2 In the event of any conflict, inconsistency, ambiguity, or question of interpretation between the English version and any translation, the English version prevails.
End of Privacy Policy.