Privacy Policy

ZeoTool ("we", "us", "our") is the data controller for personal information processed through our website, app and APIs. You can reach our privacy team at privacy@zeotool.com.

• Account data — email address, display name, password hash, profile picture, OAuth identifiers (Google etc.), preferred language.
• Usage data — prompts you submit, generated outputs, tool selections, credits consumed, model used, timestamps and request metadata.
• Device & log data — IP address, browser type and version, operating system, device type, approximate location derived from IP, referrer URL, pages viewed, click events.
• Payment data — order reference, plan, amount, currency, gateway, transaction ID and screenshot you submit for manual payments. We do not see or store full card numbers — those are handled by the payment processor.
• Support data — messages you send via live chat, email or support forms, including any attachments.
• Cookies & local storage — session tokens, preferences and limited analytics identifiers as described in §7.

• Provide the service — run generations, deliver outputs, save history, enforce plan limits.
• Billing — process payments, issue invoices, prevent fraud, calculate refunds.
• Safety & integrity — detect abuse, enforce our acceptable use policy, secure accounts and infrastructure.
• Support — answer your questions, troubleshoot issues, follow up on requests.
• Product improvement — analyse aggregated usage patterns, fix bugs, ship new features.
• Legal compliance — meet tax, accounting and other legal obligations.

Legal bases (GDPR): contract performance for providing the service and billing; legitimate interests for safety, fraud prevention and product improvement; consent where required for analytics and marketing cookies; and legal obligations for tax and compliance records.

We share data only with the providers needed to operate the service, under contracts that restrict their use of it:

• Cloud hosting & database — to store accounts, generations and metadata.
• AI model providers — to generate outputs from your prompts (image, video, audio, edits).
• Payment processors — to handle card payments, mobile wallets and bank transfers.
• Email & messaging providers — to send transactional emails and live chat.
• Analytics & error tracking — to understand usage and diagnose crashes.

We may also disclose data to comply with legal process (subpoena, court order), to enforce our Terms, or to protect the rights, property or safety of users and the public.

Our infrastructure and providers may process data in countries outside your own, including the EU and the United States. Where required, we use Standard Contractual Clauses or equivalent safeguards to protect that data.

• Generations & prompts — kept while your account is active. You can delete individual items from history at any time.
• Account data — kept until you delete your account, then purged within 30 days.
• Payment records — kept for the period required by tax and accounting law (typically 7 years), even after account deletion.
• Support tickets — kept for up to 24 months after resolution.
• Backups — encrypted backups are rotated and overwritten within 90 days.

We use a minimal set of cookies and local storage entries:

• Essential — authentication sessions, CSRF tokens, basic preferences. Cannot be disabled.
• Functional — UI preferences such as chat box height, theme, last-used tool.
• Analytics — anonymous pageview and event counts used to improve the product.

You can clear cookies from your browser at any time. Doing so will sign you out.

• TLS 1.2+ in transit, AES-256 at rest for sensitive data.
• Role-based access controls and row-level security on the database.
• Encrypted password hashes (never stored in plaintext).
• Regular dependency scanning and security reviews.

Depending on your country, you may have the right to:

• Access the personal data we hold about you.
• Correct inaccurate or incomplete data.
• Delete your data ("right to be forgotten").
• Export your data in a portable format.
• Object to or restrict certain processing.
• Withdraw consent where processing is based on consent.
• Lodge a complaint with your local data protection authority.

To exercise any of these rights, email privacy@zeotool.com from your account address. We respond within 30 days.

The service is built around automated AI generations. While these are generated automatically, they do not produce decisions that have legal or similarly significant effects on you. Abuse-detection systems may temporarily limit a session and flag it for human review; you can always contact support to appeal.

ZeoTool is not directed at children under 13 (or the minimum age in your jurisdiction). We do not knowingly collect personal information from them. If you believe a child has provided us with personal data, contact privacy@zeotool.com and we will delete it.

Our service may link to websites we do not control. This policy does not cover their practices — review their own privacy policies before sharing data with them.

We may update this policy as our practices change. Material changes are announced in-app and/or by email at least 14 days before they take effect. The "Last updated" date at the top of this page always shows the latest revision.