Privacy Policy

1. Data controller

Zenith (“we,” “our,” “us”) is the data controller for personal data collected through this platform. Contact us at privacy@zenithml.com.

2. Data we collect

• Account data: email address, display name, and OAuth profile information (when signing in with Google).
• Learning content: flashcard decks, cards, and study session data you create on the platform.
• Usage data: page views, feature interactions, and performance metrics (only after cookie consent).
• Technical data: IP address, browser type, and error logs necessary for platform operation.

3. Legal basis (GDPR Article 6)

• Performance of a contract (Art. 6(1)(b)): processing your account and learning data to deliver the service you signed up for.
• Legitimate interests (Art. 6(1)(f)): security monitoring, error logging, and fraud prevention.

4. Data processors

We share data with the following sub-processors, each bound by a Data Processing Agreement (DPA):

• Supabase — database and authentication (EU region)
• Google Cloud Platform (GCP) — machine learning infrastructure (EU region)
• Stripe — payment processing, subscription management and VAT determination
• Sentry — error monitoring
• Google (Gemini) — AI features: card generation, reading translation and comprehension questions, conversation practice, and study-plan generation (text you submit for processing; no training on your data)

5. Data retention

In accordance with Article 5(1)(e) GDPR (storage limitation), we retain personal data only for as long as necessary to fulfill the purposes for which it was collected or to comply with statutory legal obligations:

• Learning & account content: Flashcards, decks, study histories, reading sessions, conversations, and plan goals are retained for the lifetime of your active account. When you delete your account, your data is erased from the live database within 30 days.
• Operational logs & security records: Operational AI token usage records, security and moderation events, notification logs, and server diagnostic logs are automatically purged after 90 days.
• AI model inference: Prompts, voice audio, and reading extracts submitted for AI generation are processed ephemerally in memory and discarded immediately upon completion (zero provider data retention or model training).
• Financial & billing records: Invoices, payment transaction references, and VAT accounting records are retained for 5 years following the end of the applicable financial year in compliance with statutory requirements under the Danish Bookkeeping Act (Bogføringsloven §10).
• Disaster recovery backups: When personal data is deleted from our live database, encrypted copies may persist in access-controlled disaster recovery backup files for a residual window of up to 90 days before being automatically overwritten or expired by storage lifecycle policies. Deleted data is never restored to live production except during catastrophic recovery, where subsequent re-erasure is mandatory.

Inactive accounts. If you do not sign in for 18 consecutive months, we delete your account and its data. Storage limitation under Article 5(1)(e) GDPR means we should not hold personal data once we no longer have a reason to, and an account nobody has opened in a year and a half is data we have no reason to keep.

We email your registered address three times over the 30 days before that deletion — at 30, 14 and 3 days — stating the exact date and offering a one-click link to keep the account. Signing in also cancels it and resets the clock. Accounts with an active, paused or Lifetime plan, accounts inside a payment grace period or a period already paid for, and accounts holding unspent AI credits are never deleted this way.

We keep a record that a deletion happened, containing a one-way hash of the account identifier and no other identifying data. We cannot use it to work out who was deleted; it exists so that we can confirm a deletion took place if you ask us, and so we can demonstrate that we honour this policy.

6. Your rights (GDPR)

Under GDPR you have the right to:

• Access the personal data we hold about you
• Rectify inaccurate data
• Request erasure of your data
• Restrict or object to processing
• Data portability
• Lodge a complaint with a supervisory authority

To exercise any of these rights, email privacy@zenithml.com.

7. Browser extension

The Zenith browser extension (Chrome, Edge, Brave and Firefox) has two features. It talks only to zenithml.com, contains no analytics, advertising or tracking code, and never sells or shares your data.

• Read: when you click Save, the extension sends the page’s address and the reading language you chose to your Zenith account, and we fetch the page ourselves to build your reading copy. The page title and language are read in your browser, on that tab only, to show in the popup. Saves made offline wait in the extension’s local storage on your device until they sync.
• Watch: on Netflix, YouTube and Crunchyroll the extension reads the captions the player loads, in your browser, to show dual subtitles. Captions are held in memory and are not stored by us. Short upcoming stretches of caption text are sent to us for AI translation; words you tap, notes you write and cards you create are saved to your account. The extension never records or copies video or audio.
• Sign-in: the extension reads your existing zenithml.com sign-in cookie so you do not sign in twice. It reads no other site’s cookies.

Notes, taps and cards are covered by sections 2 to 6 above and can be exported or deleted from your account settings. Removing the extension deletes everything it stored on your device.

8. Cookies

We use an essential cookie to keep you signed in. See our Cookie Policy for details.