Privacy Policy

1. Data controller

Zenith (“we,” “our,” “us”) is the data controller for personal data collected through this platform. Contact us at privacy@zenithml.com.

2. Data we collect

• Account data: email address, display name, and OAuth profile information (when signing in with Google).
• Learning content: flashcard decks, cards, and study session data you create on the platform.
• Usage data: page views, feature interactions, and performance metrics (only after cookie consent).
• Technical data: IP address, browser type, and error logs necessary for platform operation.

3. Legal basis (GDPR Article 6)

• Performance of a contract (Art. 6(1)(b)): processing your account and learning data to deliver the service you signed up for.
• Legitimate interests (Art. 6(1)(f)): security monitoring, error logging, and fraud prevention.

4. Data processors

We share data with the following sub-processors, each bound by a Data Processing Agreement (DPA):

• Supabase — database and authentication (EU region)
• Google Cloud Platform (GCP) — machine learning infrastructure (EU region)
• Stripe — payment processing, subscription management and VAT determination
• Sentry — error monitoring
• Anthropic — AI card generation (text you submit for processing; no training on your data)

5. Data retention

We retain your personal data for as long as your account is active. When you delete your account, all associated personal data is deleted within 30 days, except where we are required to retain it by law (e.g. billing records).

Inactive accounts. If you do not sign in for 18 consecutive months, we delete your account and its data. Storage limitation under Article 5(1)(e) GDPR means we should not hold personal data once we no longer have a reason to, and an account nobody has opened in a year and a half is data we have no reason to keep.

We email your registered address three times over the 30 days before that deletion — at 30, 14 and 3 days — stating the exact date and offering a one-click link to keep the account. Signing in also cancels it and resets the clock. Accounts with an active, paused or Lifetime plan, accounts inside a payment grace period or a period already paid for, and accounts holding unspent AI credits are never deleted this way.

We keep a record that a deletion happened, containing a one-way hash of the account identifier and no other identifying data. We cannot use it to work out who was deleted; it exists so that we can confirm a deletion took place if you ask us, and so we can demonstrate that we honour this policy.

6. Your rights (GDPR)

Under GDPR you have the right to:

• Access the personal data we hold about you
• Rectify inaccurate data
• Request erasure of your data
• Restrict or object to processing
• Data portability
• Lodge a complaint with a supervisory authority

To exercise any of these rights, email privacy@zenithml.com.

7. Cookies

We use an essential cookie to keep you signed in. See our Cookie Policy for details.