1. Data controller
Zenith (“we,” “our,” “us”) is the data controller for personal data collected through this platform. Contact us at privacy@zenithml.com.
2. Data we collect
- Account data: email address, display name, and OAuth profile information (when signing in with Google).
- Learning content: flashcard decks, cards, and study session data you create on the platform.
- Usage data: page views, feature interactions, and performance metrics (only after cookie consent).
- Technical data: IP address, browser type, and error logs necessary for platform operation.
3. Legal basis (GDPR Article 6)
- Performance of a contract (Art. 6(1)(b)): processing your account and learning data to deliver the service you signed up for.
- Legitimate interests (Art. 6(1)(f)): security monitoring, error logging, and fraud prevention.
- Consent (Art. 6(1)(a)): analytics tracking via PostHog, collected only after you accept cookies.
4. Data processors
We share data with the following sub-processors, each bound by a Data Processing Agreement (DPA):
- Supabase — database and authentication (EU region)
- Google Cloud Platform (GCP) — machine learning infrastructure (EU region)
- Lemon Squeezy — payment processing and subscription management
- PostHog — product analytics (EU Cloud, consent-gated)
- Sentry — error monitoring
- Anthropic — AI card generation (text you submit for processing; no training on your data)
5. Data retention
We retain your personal data for as long as your account is active. When you delete your account, all associated personal data is deleted within 30 days, except where we are required to retain it by law (e.g. billing records).
6. Your rights (GDPR)
Under GDPR you have the right to:
- Access the personal data we hold about you
- Rectify inaccurate data
- Request erasure of your data
- Restrict or object to processing
- Data portability
- Lodge a complaint with a supervisory authority
To exercise any of these rights, email privacy@zenithml.com.
7. Cookies
We use cookies for authentication and, with your consent, for analytics. See our Cookie Policy for details.
This policy will be updated before any DPAs are finalised and before the platform processes real user data at scale. It is a stub for development purposes.