Privacy Policy

1. Introduction

Zorai ("we", "us", "our") is committed to protecting your privacy. This Privacy Policy explains how we collect, use, disclose, and safeguard your information when you use our video generation platform and related services (collectively, the "Service").

We are based in Chemin du Pré-Guillot 9, Switzerland and comply with the Swiss Federal Act on Data Protection (FADP), the General Data Protection Regulation (GDPR), and other applicable data protection laws.

2. Data Controller Information

The data controller responsible for your personal data is:

3. Information We Collect

3.1 Information You Provide

• Account Information: Email address, name, and password when you create an account.
• Payment Information: Billing address and payment details processed through our secure payment provider (Stripe). We do not store full credit card numbers.
• Content Data: Text prompts, images, and other content you upload or generate using our Service.
• Character Data: Information about AI characters you create, including names, descriptions, and reference images.
• Social Media Credentials: OAuth tokens when you connect social media accounts for publishing (stored encrypted).

3.2 Information Collected Automatically

• Usage Data: Pages visited, features used, time spent on the Service, and interaction patterns.
• Device Information: Browser type, operating system, device identifiers, and IP address.
• Cookies and Similar Technologies: Session cookies, authentication tokens, and analytics cookies.

4. Legal Basis for Processing (GDPR Article 6)

We process your personal data based on the following legal grounds:

• Contract Performance: Processing necessary to provide our Service and fulfill our contractual obligations to you.
• Legitimate Interests: Processing for our legitimate business interests, such as improving our Service, preventing fraud, and ensuring security.
• Consent: Where you have given explicit consent for specific processing activities (e.g., marketing communications).
• Legal Obligations: Processing required to comply with applicable laws and regulations.

5. How We Use Your Information

We use the collected information to:

• Provide, maintain, and improve our Service
• Process your video generation requests
• Manage your account and subscription
• Process payments and prevent fraud
• Publish content to connected social media platforms on your behalf
• Send transactional emails (account updates, receipts)
• Send marketing communications (only with your consent, easily unsubscribable)
• Analyze usage patterns to improve user experience
• Comply with legal obligations
• Respond to your inquiries and support requests

6. Data Sharing and Disclosure

We do not sell your personal data. We may share your information with:

6.1 Service Providers

• AI Processing: Third-party AI providers for video generation (prompts and content only, no personal identification data)
• Payment Processing: Stripe for secure payment handling
• Cloud Infrastructure: Hosting and storage providers
• Analytics: Privacy-focused analytics services

6.2 Social Media Platforms

When you connect and publish to social media platforms (TikTok, YouTube, Instagram), we share your video content and associated metadata with those platforms according to their respective APIs and terms.

6.3 Legal Requirements

We may disclose your information if required by law, court order, or government request, or to protect our rights, property, or safety.

7. International Data Transfers

Your data may be transferred to and processed in countries outside Switzerland and the European Economic Area (EEA). When we transfer data internationally, we ensure appropriate safeguards are in place:

• Standard Contractual Clauses (SCCs) approved by the European Commission
• Adequacy decisions by the Swiss FDPIC or European Commission
• Other legally recognized transfer mechanisms

8. Data Retention

We retain your personal data for as long as necessary to:

• Provide our Service to you
• Comply with legal obligations (e.g., tax records: 10 years)
• Resolve disputes and enforce agreements

Specific retention periods:

• Account data: Until account deletion + 30 days
• Generated videos: Until you delete them or close your account
• Payment records: 10 years (legal requirement)
• Server logs: 90 days

9. Your Rights (GDPR & Swiss FADP)

You have the following rights regarding your personal data:

• Right of Access: Request a copy of your personal data
• Right to Rectification: Request correction of inaccurate data
• Right to Erasure: Request deletion of your data ("right to be forgotten")
• Right to Restrict Processing: Request limitation of how we use your data
• Right to Data Portability: Receive your data in a structured, machine-readable format
• Right to Object: Object to processing based on legitimate interests or for direct marketing
• Right to Withdraw Consent: Withdraw consent at any time where processing is based on consent

To exercise these rights, contact us at alopez.nevicom@gmail.com. We will respond within 30 days.

You also have the right to lodge a complaint with a supervisory authority. In Switzerland, this is the Federal Data Protection and Information Commissioner (FDPIC). In the EU, you may contact your local data protection authority.

10. Data Security

We implement appropriate technical and organizational measures to protect your personal data, including:

• Encryption of data in transit (TLS/SSL) and at rest
• Secure authentication mechanisms
• Regular security assessments and updates
• Access controls and employee training
• Encrypted storage of sensitive credentials (OAuth tokens)

Despite our efforts, no method of transmission over the Internet is 100% secure. We cannot guarantee absolute security.

11. Cookies and Tracking Technologies

We use the following types of cookies:

• Essential Cookies: Required for the Service to function (authentication, security)
• Functional Cookies: Remember your preferences and settings
• Analytics Cookies: Help us understand how you use our Service (can be disabled)

You can manage cookie preferences through your browser settings. Note that disabling essential cookies may affect Service functionality.

12. Children's Privacy

Our Service is not intended for children under 16 years of age. We do not knowingly collect personal data from children under 16. If you believe we have collected data from a child under 16, please contact us immediately at alopez.nevicom@gmail.com.

13. Changes to This Privacy Policy

We may update this Privacy Policy from time to time. We will notify you of significant changes by:

• Posting the updated policy on our website
• Updating the "Last updated" date
• Sending an email notification for material changes (if you have an account)

Your continued use of the Service after changes constitutes acceptance of the updated Privacy Policy.

14. Contact Us

If you have questions about this Privacy Policy or our data practices, please contact us: