Privacy policy

1.1 The controller of personal data within the scope described in this Policy is Zodi Labs SA, with its registered office at ul. Wilcza 42/12, 00-679 Warsaw, Poland, KRS 0001147187, tax identification number NIP 5214100693, REGON 540597698. Personal data protection and individual rights enquiries: dpo@generation9.co. Account support and deletion: support@zodi.chat. General enquiries: info@zodi.chat.

1.2 This Policy covers the Zodi websites, application, waiting list, registration and onboarding, payments, user support and creator data displayed in the Service. It also explains when Zodi Labs SA acts on a customer’s instructions. It does not constitute consent to marketing or unrestricted use of content. The Policy also covers handling a Customer’s request for campaign delivery by Generation9, as described in clause 3.6.

2.1 We receive identification and contact details from the user or the customer they represent, including first name, last name, email address, company name and job title, together with information entered in forms such as experience, intended use and a telephone number if supplied. Mandatory fields are identified; optional information is voluntary. Providing data necessary to create an account and perform the contract is a condition for using the relevant feature; without it, that feature cannot be provided. Applicable law determines information required for tax documentation.

2.2 We process account and login identifiers, language and preferences, access status, activation and usage dates, Plan details, Credits granted and used, and subscription changes. When signing in through Kinde, including with a Google account, we receive a user identifier, email address and available basic profile details such as first name, last name and profile picture, according to the selected method and permissions. Authentication and session information needed to recognise an authorised user is also processed.

2.3 Work content in Zodi includes questions, conversations, uploaded files, briefs, brand materials, documents and generated outputs. We also process support messages, complaints, withdrawal requests and evidence of agreements and consents where provided. Third-party personal data should not be submitted if unnecessary or without a basis for disclosure.

2.4 Billing data includes buyer details, address, tax identifiers, amount and currency, payment status, Stripe customer, transaction and subscription identifiers, sales documents and refunds. Card data needed for payment is entered directly into the payment system; Zodi receives information needed to manage and account for the transaction, including available masked payment-method details.

2.5 Automatically collected information may include IP address, device and browser details, timestamps, session events, errors and security events. Creator data and its sources are described in section 9. Data may also come from an authorised business-account administrator, the payment provider, data suppliers and public sources described in this Policy.

3.1 Waiting-list requests, account creation, trial activation, performance and termination of a paid contract rely on GDPR Article 6(1)(b) where the individual is a contracting party or requests pre-contractual steps. For representatives and users of a business customer, the basis is Article 6(1)(f): the legitimate interest in managing the customer relationship and authorised access.

3.2 Role, company, experience and goals help configure use of Zodi and tailor support. Analysis of company information provides work context for the user. These activities rely on contract performance where objectively necessary, and otherwise on the legitimate interest in useful support or consent where a particular optional feature requires it. Contact details are not automatically used for marketing as a result.

3.3 Sales accounting, tax and bookkeeping records and binding legal obligations rely on GDPR Article 6(1)(c). Payment and allowance administration needed to perform the contract also relies on Article 6(1)(b), or (f) for representatives. Accurate accounting records may require data to be retained after access ends.

3.4 Security, fraud prevention, investigation of errors and incorrect allowance deductions, and establishing, pursuing or defending claims rely on GDPR Article 6(1)(f). Our interest is protecting the Service, users and settlements. Complaints and individual rights are handled on the basis of contract performance or legal duties, as applicable. Credit records support service verification and settlement, not arbitrary denial of refund rights.

3.5 Optional marketing messages and optional tools requiring consent are used only after obtaining it, within the scope of the particular choice and applicable law. Messages needed for account administration, payments or security are not conditional on marketing consent. Consent can be withdrawn as easily as it is given.

3.6 At the Customer’s request, a campaign submission may be handled by the Generation9 team, the agency brand of Zodi Labs SA. Routing the submission to this team does not itself disclose it to a separate company; Zodi Labs SA remains controller for enquiry-handling data. Authorised personnel receive only contact details, the brief, the specified creator list and other materials necessary to assess the enquiry and prepare a proposal. We do not automatically disclose the entire chat history or all account files. Handling relies on GDPR Article 6(1)(b) where an individual requests steps before entering into their own contract, and on Article 6(1)(f) for a business customer’s representatives: the legitimate interest in handling the enquiry and business communications. Data processed on a customer’s behalf remains subject to the rules and instructions in section 5. This is not consent to unrelated marketing. Access, confidentiality, retention and location remain subject to this Policy. Further processing for campaign delivery requires the roles, bases and obligations to be specified in connection with the separate agency agreement, and appropriate information to be provided before that processing begins.

4.1 Zodi uses AI models to perform requested functions such as analysis, preparing materials and generating responses. The model provider may receive the request, necessary conversation context, relevant file and data extracts, and processing outputs. We limit the scope to information needed for the task and security.

4.2 Zodi Labs SA does not use customers’ private conversations, briefs or files to train general-purpose models or authorise providers to do so as part of ordinary service delivery. Any separate training project requires a separately specified purpose, basis and conditions; acceptance of this Policy is not consent to such a project.

4.3 Response generation, diagnostics and abuse detection are distinct from model training. Data may be needed for those operations for a period justified by their purpose, subject to retention and location rules. Pseudonymised data remains protected; only information that cannot be attributed to an individual by reasonably available means is treated as anonymous.

5.1 Zodi Labs SA is controller for data needed for its own user relationships, billing, security and creator database. Where a customer determines the purposes and means for personal data entrusted in campaign materials and Zodi acts solely on documented instructions, the customer remains controller and Zodi acts as processor.

5.2 For processing on instructions, a separate data processing agreement under GDPR Article 28 defines the scope of data, instructions, safeguards, subprocessors, assistance with the exercise of rights, and rules for returning and deleting data. Requests concerning such data are forwarded to the relevant controller or handled with its authority. This Policy does not replace a customer’s notice obligations to its employees, customers or other individuals.

6.1 Recipients to the necessary extent may include providers of hosting, databases and file storage, authentication, AI models, communications, support and security, as well as authorised personnel and contractors. We use data processing agreements where a recipient acts on our instructions. Selection of recipients and their subprocessors is subject to the location and transfer rules in section 7.

6.2 Payments are handled by Stripe Payments Europe, Limited and, for regulated payment services, Stripe Technology Europe, Limited, both with their registered office at One Wilton Park, Wilton Place, Dublin 2, D02 FX04, Ireland. Stripe receives information necessary for payments, subscriptions, refunds and billing records, including identification, contact and billing details and transaction information. Stripe may also collect data directly when handling payments, including payment instrument, device and transaction data.

6.3 Stripe’s role depends on the operation. Stripe may act as a processor on Zodi’s instructions and, for its own purposes such as fraud prevention, payment network security and legal compliance, act as a separate controller or joint controller with relevant group companies. Stripe identifies Stripe Technology Company, Limited, with its registered office at One Wilton Park, Wilton Place, Dublin 2, D02 FX04, Ireland, as its principal entity responsible for data protection in Europe. The allocation of roles, purposes and individual rights is explained in the Stripe Privacy Policy at https://stripe.com/privacy and Stripe Privacy Center at https://stripe.com/legal/privacy-center. These links are informational and do not constitute blanket consent to processing or data transfers.

6.4 Data may also be received by the user’s chosen login provider, banks and payment participants, accountants, legal advisers and authorised public authorities where a proper basis exists. Service customers receive creator information needed to assess collaboration and are responsible for their own further use. Information about the specific recipients of an individual’s data is provided as required by law on request to dpo@generation9.co.

6.5 We use Google services for infrastructure and AI. For Google Cloud services, customer data processing is governed by the applicable agreement and Cloud Data Processing Addendum at https://cloud.google.com/terms/data-processing-addendum. Separate rules apply to service data, such as account, diagnostic and support data, described in the Google Cloud Privacy Notice at https://cloud.google.com/terms/cloud-privacy-notice. Gemini services delivered through the Gemini Developer API may be subject to different terms from Google Cloud: https://ai.google.dev/gemini-api/terms. Section 4 describes the content disclosed; section 7 sets out location and transfer rules.

6.6 Login, account identity verification and session management are provided through Kinde, a service of Kinde Australia Pty Ltd (ABN 11 655 096 263, Australia). For these activities, Kinde processes data on Zodi’s instructions. This covers identification and contact details needed for login, a user identifier, profile details shared by the selected login provider, and technical data and authentication events needed to operate and protect access. The data supports account administration, email verification, login and prevention of unauthorised access; it is not automatically used for marketing. When signing in with Google, the Google account password is entered with Google; Zodi does not receive that password. Kinde’s policy: https://docs.kinde.com/trust-center/privacy-and-compliance/privacy-policy/. Providing authentication does not by itself give Kinde access to conversations or uploaded files. Section 7 sets out location rules.

6.7 Website and application hosting, execution of application functions, content delivery and traffic protection are provided by Vercel Inc., 440 N Barranca Avenue #4133, Covina, CA 91723, United States. Vercel may process IP addresses, device and browser data, request URLs and times, session, error and security information, and data submitted to application functions where handled through that infrastructure. The scope depends on the feature and configuration. Vercel processes customer data as a processor under a data processing agreement; for certain contact data and data generated in providing its own services, it may act as a separate controller. Details: https://vercel.com/legal/privacy-notice and https://vercel.com/legal/dpa. Section 7 distinguishes function locations from other processing operations.

7.1 The Zodi application’s primary databases, primary image repositories and VPS servers we use to store personal data are maintained in the European Economic Area, comprising the European Union Member States, Iceland, Liechtenstein and Norway. This description concerns the specified primary application infrastructure, not every resource of external authentication, hosting, payment and AI providers. It does not mean that every processing operation takes place exclusively in the EEA. This also applies to images of identifiable individuals; an image’s public availability does not remove its protection as personal data.

7.2 Use of Google Cloud and other Google services, including AI models, may involve personal data processing outside the EEA. The scope depends on the particular service, model, selected region, endpoint and contractual terms. Selecting a European storage region does not by itself guarantee that all computation, service data, diagnostics or support access remain in the EEA.

7.3 Stripe operates globally and may process payment and other personal data outside the EEA, including in the United States. A European Stripe company’s registered office in Ireland does not mean that data is processed exclusively in the EEA. Transfers may also arise from authentication, communications, content delivery through a CDN, diagnostics or support involving recipients outside the EEA. The location of a primary image repository does not determine the location of CDN copies or access logs.

7.4 Kinde account data is stored in the region assigned to the service environment. Kinde offers a European region in Dublin, but the availability of that option does not mean it covers every login, email delivery and support operation. Depending on the configuration and subprocessor services, data may also be processed outside the EEA, in particular in Australia, the United States or the United Kingdom. Kinde lists separate locations for email and support services; the primary hosting region does not guarantee EEA-only processing. Its current subprocessor list and their roles are at https://docs.kinde.com/trust-center/privacy-and-compliance/sub-processors/. Information about the configuration applicable to Zodi and safeguards is available under clause 7.7.

7.5 For the Zodi application on Vercel, Frankfurt, Germany is configured as the default region for server-side functions. This setting does not determine the location of every Vercel operation. The global content delivery network, network layers, logs, service data and support may involve processing outside the EEA, including in the United States. We do not treat a European function region as an assurance that all data handled by Vercel remains in the EEA. The transfer rules in clauses 7.6–7.7 also apply to Vercel and Kinde.

7.6 Transfers to third countries must comply with Chapter V of the GDPR and the other applicable data protection requirements. We use the European Commission adequacy decision applicable to the transfer or appropriate safeguards, in particular the European Commission’s standard contractual clauses. Before relying on those clauses, we assess the circumstances of the transfer and apply supplementary measures where needed. If the required protection cannot be ensured, we do not start or we suspend the transfer. Reliance on a decision concerning a particular framework requires the specific recipient and processing to be covered by the current decision and to satisfy its conditions.

7.7 Information about recipients, processing countries, the transfer mechanism and how to obtain a copy of the applicable safeguards is available by contacting dpo@generation9.co. When providing a copy, we may protect confidential information and the rights of others without depriving the requester of meaningful information about the protection of their data. Acceptance of the Terms, reading this Policy or using payments does not replace the required transfer mechanism. Pseudonymisation and tokenisation do not automatically remove personal data protection.

8.1 Waiting-list data is retained until access is granted, the request is withdrawn or its handling ends. Once the purpose ends, data not required on another basis is deleted. Account data, conversations and files are retained for the contract until termination and as needed to fulfil content-return or deletion requests. An inactive subscription does not itself mean account deletion.

8.2 Tax and accounting documents are retained for the period required by applicable law, generally 5 years from the relevant statutory starting point, subject to events extending that period. Evidence of the contract, allowance usage and settlements is retained as necessary to complete settlement and until the applicable limitation period expires, and, in the event of a dispute, until it is resolved and the outcome is implemented.

8.3 Keeping evidence longer does not justify retaining every conversation and file. Only data needed for a specific duty or claim is selected, with restricted access. Technical and security logs are retained for the necessary period to investigate events and maintain protection, then deleted or effectively anonymised. Backups follow a separate deletion cycle and are not used for ordinary continued use of deleted data.

8.4 Creator data is kept while needed for lawful, current profile analysis and while a processing basis exists. It is subject to accuracy review, rectification, erasure, restriction and consideration of objections under section 9. Public availability does not mean indefinite retention. Clause 9.8 governs a minimal suppression record and any further retention after profile removal. The period or criterion applicable to particular data can be obtained at dpo@generation9.co.

9.1 The Zodi database may contain names or public display names, handles, profile identifiers and links, public content and images, activity and commercial-collaboration data, statistics, and analytical assessments or estimates associated with a profile. Sources include publicly available social platforms, particularly Instagram and TikTok, other public sources, data suppliers and individuals or customers providing information lawfully.

9.2 The purpose is professional creator-market analysis, collaboration matching and assessment of its potential. The basis is GDPR Article 6(1)(f): the legitimate interest in operating an analytical tool and supporting lawful marketing collaboration, taking account of individuals’ rights and reasonable expectations. Inferred information is an estimate, not a certain fact. Special-category data is not inferred or disclosed without the separate basis required by law.

9.3 Every Creator whose profile is analysed in Zodi may request rectification or completion of data and removal of the profile from Zodi’s analytics database. Requests should be sent to dpo@generation9.co or Zodi Labs SA’s postal address. It is helpful to identify the platform and profile link or identifier, the scope of the request and a contact method. A Zodi account, purchase, acceptance of the Terms or use of a special form is not required. An authorised representative may also submit a request, subject to appropriate verification of their authority.

9.4 Rectification ensures that data reflects the facts, while completion addresses missing information relevant to the processing purpose. Changes are based on reliable, relevant evidence and available information, such as source data, dated platform statistics, a document confirming a particular fact or verifiable explanations. We do not introduce false data, artificially inflated statistics or changes intended solely to improve a profile’s image without a factual basis. Evidence requirements are tailored to the dispute; we do not request unnecessary information and take account of data already held. A request does not transfer our duty to maintain accurate data to the Creator.

9.5 If an AI assessment, classification or estimate is disputed, a person reviews the request, considering source data, the analysis period and the identified issues. As appropriate, we correct inaccurate data or outputs, add context or withdraw an assessment whose continued processing lacks a basis. Dissatisfaction alone does not entitle a person to replace an outcome with an arbitrary more favourable rating. An output’s estimated nature or the risk of AI error does not remove the right to challenge it. Where GDPR Article 18 applies, we restrict processing, particularly while verifying disputed data accuracy.

9.6 Before removing an entire profile, we confirm that the requester is the Creator entitled to make the request or represents the person or entity operating the analysed source account. We use available information; where reasonable doubts remain, we request only additional information necessary to confirm identity, the link to the profile or authority to act. This may involve an agreed method of confirming control of the profile, contact through a reliably linked channel or an authorisation document. A single screenshot may not always suffice. The method must be proportionate to risk and as unobtrusive as possible. We do not request passwords, login codes or control of the account; a copy of an identity document is not a standard requirement. If access to the account is unavailable, we accept other appropriate means of confirmation.

9.7 Once authority and the scope of a profile removal request are confirmed, we remove the profile from Zodi’s active search and recommendation database and stop further collection and analysis of that profile for the database. Related personal data covered by the request is deleted or effectively anonymised in systems for which we are responsible, subject to clauses 9.8–9.9. This profile removal option is available even if the source account remains public. It does not delete the account on Instagram, TikTok or another platform, or all information on the internet.

9.8 After profile removal, we may retain a minimal platform and profile identifier and a suppression record to prevent the data from being added again, together with a necessary record of handling the request. These serve to fulfil the request and demonstrate compliance with legal duties and, where applicable, the legitimate interest in respecting suppression; they are not used for further marketing analysis. Other data is retained only as necessary on a separate basis, such as a legal duty or the establishment, exercise or defence of specific legal claims. We explain the scope, purpose, basis and retention period or criterion. Verification documents are deleted when no longer needed. The suppression record is reviewed periodically and retained only as long as needed to respect the request; any further retention requires a separate basis.

9.9 Rectification, erasure or restriction also covers relevant derived data and copies under our control. Restricted data is not used for ordinary analysis and recommendations contrary to the scope of the restriction. Backups are retired under a secure retention cycle, and previously implemented rectifications, erasures and suppressions are reapplied when data is restored. Under GDPR Article 19, we notify recipients of rectification, erasure or restriction unless this proves impossible or involves disproportionate effort, and identify those recipients on request. Where Article 17(2) applies, we take reasonable steps concerning further copies. We do not have technical control over every copy held by separate controllers, but this does not remove those obligations.

9.10 This procedure does not restrict the rights of other people appearing in materials or whose data is analysed. Exercising rights over one’s own data does not require proof of ownership of the entire source account. Loss of account access, impersonation or incorrect attribution is assessed using other appropriate information. Objections to processing based on legitimate interests are considered individually, and that processing stops unless we demonstrate compelling overriding legitimate grounds or grounds relating to legal claims under GDPR Article 21. Personal data erasure is also assessed independently under Article 17. Response times, verification rules and remedies are set out in section 11.

9.11 This section also informs people whose data was not obtained directly from them. Zodi fulfils GDPR Article 14 notice requirements in the required scope and time; publishing this Policy alone does not replace individual notification where the law requires it.

10.1 Data may be analysed automatically to search, rank and match profiles and produce marketing estimates. This may constitute profiling and affect a profile’s visibility in recommendations. Outputs are advisory, may require correction and do not guarantee selection for a campaign. Price estimates are produced by Zodi algorithms based on account parameters and other publicly available information, using machine learning training methods and AI. This description does not change the rules on private customer content set out in clause 4.2.

10.2 Zodi does not make solely automated decisions about individuals producing legal or similarly significant effects within GDPR Article 22. Customers decide whether to collaborate. Concerns about a profile assessment may be sent to dpo@generation9.co, and concerns about an automated security restriction to support@zodi.chat, for human review. Clause 9.5 explains how creator assessments and data can be challenged and corrected. The advisory nature of recommendations and the description of AI risks in the Terms do not remove data accuracy duties or individuals’ rights.

11.1 Subject to the conditions set out in the GDPR, individuals have the right to access their personal data and obtain a copy, to rectification, to erasure and to restriction of processing. They also have the right to data portability in the cases specified in Article 20 of the GDPR. Individuals may object to processing based on legitimate interests on grounds relating to their particular situation; an objection to direct marketing requires no such grounds. Consent may be withdrawn without affecting the lawfulness of earlier processing.

11.2 Deletion of a Zodi user account may be requested at support@zodi.chat. Personal data requests, including creator data and removal of an analysed profile, should be sent to dpo@generation9.co or in writing to Zodi Labs SA’s postal address. A request received through another official Zodi channel is routed to the appropriate team. An account or paid access is not required. We verify the person or representative as needed for secure handling and request only necessary additional information where reasonable doubts arise. We provide information on action taken without undue delay and no later than one month after receiving the request. This may be extended by two further months only where permitted by the GDPR due to the complexity or number of requests; the extension and its reasons are communicated within the first month.

11.3 After account deletion, unnecessary data is deleted or effectively anonymised in the relevant systems and appropriate instructions are sent to processors. Only data required on a separate basis, such as accounting records and necessary claims evidence, is retained with restricted purpose and access. Separate controllers, such as a payment provider for its own duties, assess their own retention basis; we help identify the appropriate contact.

11.4 If a request is refused in whole or in part, we explain the reasons and the right to complain to a supervisory authority and seek a judicial remedy. An individual may complain to the President of the Polish Personal Data Protection Office at https://uodo.gov.pl or another competent authority, particularly in the EEA country of habitual residence, workplace or alleged infringement. Contacting Zodi first is not a condition for lodging a complaint.

11.5 Handling GDPR requests is generally free of charge. A fee or refusal based on a manifestly unfounded or excessive request is applied only within GDPR Article 12(5), after demonstrating the required grounds. Evidence is used solely to verify and handle the matter and lawfully document its handling. The B2B liability exclusions, 6-month fee cap and acceptance of AI risks in the Terms do not restrict individuals’ rights or liability to them under the GDPR.

12.1 The Service uses mechanisms necessary for login through Kinde, security, session management and technical traffic handling on Vercel, and user-selected language or appearance settings. Disabling strictly necessary mechanisms may prevent login or proper use of the relevant feature. A tool is not necessary merely because Kinde or Vercel provides it: optional analytics, advertising or embedded external services are activated only after the required consent has been obtained. Details of the tools, providers, purposes and duration are made available when settings are selected. Refusing optional consent does not disable the basic service.

12.2 We apply organisational and technical measures appropriate to risk, including permission controls, protection in transit and restricted data access. Human access to private content is limited to justified support, security, instructed tasks or legal duties. Users should protect their devices and login credentials and report incidents to support@zodi.chat. Personal data protection incidents may be reported to dpo@generation9.co.

12.3 Zodi is intended only for users aged 18 or over. Accounts are not offered to children, including with guardian consent. If an underage account is identified, we verify the situation, block unauthorised access and delete unnecessary data, subject to legal duties. The user age requirement does not mean everyone appearing in source data is an adult; such data requires separate assessment and particular protection.

13.1 This Policy is updated when processes, providers or legal requirements change. Material changes are communicated sufficiently in advance in the Service or on a durable medium. An update does not replace a legal basis, required consent, data processing agreement or transfer safeguards. Changes to recipients or processing countries are preceded by an assessment of compliance and fulfilment of notice obligations. Where a separate agreement with a Customer restricts processing locations, an update to this Policy does not itself amend that agreement.

13.2 The Polish and English versions describe the same processes and rights. Questions about this Policy, its version or its application to a particular account should be sent to dpo@generation9.co.