Privacy Policy

Last updated: July 2026

1. Introduction

Zonix AI ("Zonix," "we," "us," or "our") is a project by Narek Hovhannisyan. Billing and payment services are operated by Artur Hovhannisyan. We are committed to protecting your privacy. This Privacy Policy explains how we collect, use, disclose, and safeguard your information when you use our artificial intelligence-powered script generation platform and related services (collectively, the "Service").

By accessing or using the Service, you acknowledge that you have read, understood, and agree to be bound by this Privacy Policy. If you do not agree with our policies and practices, you must not access or use the Service.

2. Information We Collect

2.1 Information You Provide to Us

We collect the following categories of information that you voluntarily provide:

Account Information: When you register, we collect your email address, username, and password (which is encrypted using bcrypt with a cost factor of 12). If you authenticate via Google OAuth, we collect your Google account email address and profile name.
User Content: All text prompts, scripts, captions, chat messages, and other content you submit to or generate through the Service.
Communication Data: Information you provide when contacting our support team, including your name, email address, and the contents of your communications.
Payment Information: We do not collect, process, or store payment card information directly. Card payments are handled by Paddle and cryptocurrency payments by Cryptomus. Paddle and Cryptomus process payment information in accordance with their own privacy policy. We receive from payment providers only your transaction status, subscription status, and billing identifiers necessary to administer your account.

2.2 Information Collected Automatically

When you access or use the Service, we may automatically collect:

Usage Data: Information about your interactions with the Service, including pages visited, features used, scripts generated, credits consumed, response types selected, and time spent on various sections.
Device Information: IP address, browser type and version, operating system, and device identifiers.
Log Data: Server logs that record requests, error messages, and diagnostic information.

2.3 Cookies and Tracking Technologies

We use only essential cookies that are strictly necessary for the operation of the Service:

Session Cookie: A secure, HTTP-only session cookie used to maintain your authentication state. This cookie is temporary and expires when you close your browser.
Refresh Token Cookie: A secure, HTTP-only cookie used to store your encrypted refresh token for persistent authentication across sessions.

We do not use third-party tracking cookies, analytics cookies, advertising cookies, or any similar tracking technologies.

3. How We Use Your Information

We use the information we collect for the following purposes:

To Provide and Maintain the Service: Processing your script generation requests, managing your account, tracking your credit usage, and delivering generated content.
To Improve the Service: Analyzing usage patterns to enhance our AI models, optimize prompt processing, and develop new features. User prompts may be processed through our AI gateway (OmniRoute) and, as a fallback, through Google's Gemini API.
To Communicate With You: Sending transactional emails related to your account (password resets, subscription confirmations, billing notifications) and responding to your support inquiries.
To Manage Subscriptions: Processing plan changes, credit allowances, and billing events through Paddle for cards and Cryptomus for cryptocurrency.
To Secure the Service: Detecting and preventing fraudulent, unauthorized, or abusive activity.

We do not use your content to train or fine-tune our AI models unless you provide explicit opt-in consent. Prompts are processed transiently and are not retained by our AI providers for model training purposes.

4. Legal Bases for Processing (EEA and UK Users)

If you are located in the European Economic Area (EEA) or the United Kingdom, we process your personal data under the following legal bases as defined by the General Data Protection Regulation (GDPR):

Contractual Necessity (Article 6(1)(b)): Processing is necessary to perform our contract with you - to provide the Service, manage your account, and process subscription transactions.
Legitimate Interests (Article 6(1)(f)): Processing for our legitimate interests, including improving the Service, ensuring security, and preventing fraud, where such interests are not overridden by your rights.
Consent (Article 6(1)(a)): Where we request your consent for specific processing activities, you may withdraw consent at any time without affecting the lawfulness of processing based on consent before its withdrawal.
Legal Obligation (Article 6(1)(c)): Processing necessary to comply with applicable legal obligations.

5. Data Sharing and Disclosure

We share your information only in the following circumstances:

Cryptomus: We share checkout and billing identifiers with the selected payment provider: Paddle for card subscriptions and Cryptomus for cryptocurrency purchases. Paddle privacy information is available at https://www.paddle.com/legal/privacy. Cryptomus acts as an independent data controller with respect to your payment information. See Cryptomus's Privacy Policy at https://cryptomus.com/privacy.
Google OAuth: If you choose to authenticate via Google, Google shares your email address and profile name with us according to Google's Privacy Policy. We do not share any data with Google beyond the authentication request.
AI Processing Providers: Your prompts are routed through our OmniRoute AI gateway and, as a fallback, Google's Gemini API for the sole purpose of generating your requested scripts. These providers are prohibited from using your data for their own purposes.
Legal Compliance: We may disclose information if required to do so by law, valid legal process (such as a court order or subpoena), or government request.
Protection of Rights: We may disclose information to enforce our Terms of Service, protect our rights, property, or safety, or investigate potential violations.
Business Transfers: In the event of a merger, acquisition, reorganization, or sale of assets, your information may be transferred as part of that transaction. You will be notified via email and/or a prominent notice on the Service of any change in ownership or data use practices.

We do not sell, rent, or trade your personal information to third parties. We do not share your information for advertising or marketing purposes.

6. Data Retention

We retain your personal data only as long as necessary to fulfill the purposes described in this Privacy Policy, or as required by applicable law:

Account Data: Retained for the duration of your account's existence. Upon account deletion, your account data is permanently deleted within 30 days, except as needed to comply with legal obligations (e.g., tax records for paid subscriptions).
User Content: Your generated scripts, chat messages, and prompts are retained while your account is active. Upon account deletion, this content is permanently deleted within 30 days.
Payment Records: Transaction records retained for tax and accounting purposes may be kept for up to 7 years as required by applicable financial regulations.
Log Data: Server logs are retained for a maximum of 90 days for security and diagnostic purposes, after which they are permanently deleted.

7. Your Rights and Choices

7.1 For All Users

Access and Update: You may access and update your account information (username, email, password) directly through the Service's Settings panel.
Account Deletion: You may delete your account by contacting our support team. Upon deletion, your personal data is permanently removed within 30 days.
Communication Preferences: You may opt out of non-transactional communications at any time.

7.2 For EEA, UK, and Swiss Users (GDPR Rights)

If you are located in the EEA, UK, or Switzerland, you have the following additional rights under the GDPR:

Right of Access: You may request a copy of the personal data we hold about you.
Right to Rectification: You may request correction of inaccurate or incomplete personal data.
Right to Erasure (Right to be Forgotten): You may request deletion of your personal data where there is no compelling legal or legitimate basis for continued processing.
Right to Restriction of Processing: You may request restriction of processing of your personal data under certain circumstances.
Right to Data Portability: You may request a structured, commonly used, machine-readable copy of your personal data.
Right to Object: You may object to processing based on legitimate interests, including processing for direct marketing.
Right to Withdraw Consent: Where processing is based on consent, you may withdraw consent at any time.

To exercise any of these rights, please contact us at the email address provided in Section 11. We will respond to your request within 30 days. If you are unsatisfied with our response, you have the right to lodge a complaint with your local data protection supervisory authority.

7.3 For California Residents (CCPA Rights)

If you are a California resident, the California Consumer Privacy Act (CCPA) grants you the following rights:

Right to Know: You may request disclosure of the categories and specific pieces of personal information we have collected about you, the sources from which it was collected, the business purpose for collection, and the categories of third parties with whom it was shared.
Right to Delete: You may request deletion of personal information we have collected from you, subject to certain exceptions.
Right to Non-Discrimination: We will not discriminate against you for exercising any of your CCPA rights.

California residents may exercise these rights by contacting us at the email address in Section 11. We will verify your identity before processing your request.

Notice of Collection: In the preceding 12 months, we have collected the following categories of personal information: identifiers (email, username, IP address), commercial information (subscription status), internet activity (usage data), and inferences drawn from the above.

We do not sell personal information as defined by the CCPA and have not done so in the preceding 12 months.

8. Data Security

We implement robust technical and organizational security measures to protect your information:

Encryption at Rest: All user data stored in our database is encrypted at rest using industry-standard AES-256 encryption.
Encryption in Transit: All communications between your browser and our servers are encrypted using TLS 1.3.
Password Security: Passwords are hashed using bcrypt with a cost factor of 12 and are never stored in plaintext.
Token Authentication: We use short-lived JWT access tokens (15-minute expiry) with rotating SHA-256 hashed refresh tokens (30-day expiry) for secure, session-based authentication.
Secure Webhook Verification: Payment webhook signatures are verified before processing: HMAC-SHA256 for Paddle and the Cryptomus signature scheme for cryptocurrency payments.
Infrastructure Security: Our Service runs in a Docker-containerized environment with regular security updates and minimal attack surface.
Access Controls: Access to production systems is restricted to authorized personnel only.

While we strive to protect your personal data, no method of transmission or storage is 100% secure. We cannot guarantee absolute security.

9. International Data Transfers

Zonix AI is based in and primarily serves users globally. Your personal data may be processed in countries where our servers or service providers are located. When we transfer data across borders, we ensure appropriate safeguards are in place:

Standard Contractual Clauses: For transfers from the EEA, UK, or Switzerland to countries not deemed adequate by the European Commission, we rely on Standard Contractual Clauses approved by the European Commission.
Cryptomus: Cryptomus processes payment data in accordance with their own data processing agreements and complies with applicable cross-border transfer requirements.
AI Providers: Our AI processing providers maintain data processing agreements that comply with GDPR requirements for international transfers.

10. Children's Privacy

The Service is not intended for individuals under the age of 16 (or the age of majority in your jurisdiction). We do not knowingly collect personal information from children. If we become aware that a child has provided us with personal data, we will take steps to delete such information and terminate the associated account. If you believe we may have collected information from a child, please contact us immediately.

11. Contact Information

If you have any questions, concerns, or requests regarding this Privacy Policy or our data practices, please contact us:

Email: [email protected]

We will acknowledge receipt of your inquiry within 48 hours and respond substantively within 30 days.

12. Changes to This Privacy Policy

We reserve the right to update or modify this Privacy Policy at any time. When we make material changes, we will notify you by:

Sending an email to the address associated with your account
Displaying a prominent notice within the Service prior to the change taking effect

Changes become effective immediately upon posting the revised Privacy Policy, except for material changes, which will become effective 30 days after notification. Your continued use of the Service after any changes constitutes your acceptance of the updated Privacy Policy.

If you do not agree with any changes, you must stop using the Service and delete your account.