Privacy Policy
Short version: we collect your email, your credit balance and a log of which tools you used — not what you asked your AI. We don't use analytics or advertising trackers, we don't sell data, and our only cookie keeps you signed in. You can download or delete your data from your account page.
[company legal name] ("we") operates the ZonRival service and is the data controller for the information described here. Contact: support@example.com, [registered address].
What we collect and why
| Data | Why | Legal basis (GDPR) |
|---|---|---|
| Email address | Your account identity; sign-in codes and links; receipts and important service emails | Contract |
| Credit balance and usage log (tool name, credits, time — the last 500 entries) | Metering credits, showing your activity, handling refunds and disputes | Contract |
| API key and access tokens (stored only as one-way hashes) | Authenticating your AI apps | Contract |
| Connected apps (app name, when connected, when last used) | Letting you see and disconnect apps | Contract |
| Billing references from our payment provider (customer ID, subscription status, renewal date) | Showing your plan and opening the billing portal | Contract |
| IP address (in memory for rate limiting; in short-lived server logs) | Preventing abuse and keeping the Service secure | Legitimate interest |
What we don't store: the questions you ask your AI, the conversation, or the ASINs, keywords and store URLs you look up. Those are processed only to answer the request.
Card details are handled entirely by our payment provider; we never see or store them.
Who we share data with
We use these service providers ("processors"), only as needed to run the Service:
- Dodo Payments — payments, subscriptions, invoices and tax (receives your email and payment details; acts as merchant of record).
- Resend — sending sign-in and billing emails (receives your email address and the email content).
- Rainforest API — Amazon data (receives the ASINs and keywords in your requests, not your identity).
- our hosting provider — runs our servers and stores the account database.
- Cloudflare — our domain's DNS, and encrypted daily backups of the account database (kept for 30 days).
When you look up a Shopify store, our server requests that store's public catalog directly. Your AI app (e.g. Claude, ChatGPT) is a separate service you chose; its own privacy policy covers your conversations with it.
We don't sell or rent personal data and don't share it for advertising. We may disclose data if required by law or to protect the Service and its users.
International transfers
Our providers may process data outside your country, including in the United States and India. Where required, transfers rely on appropriate safeguards such as the European Commission's Standard Contractual Clauses.
Cookies and local storage
We use one cookie, rs_session, set only when you sign in while connecting an AI app, so you don't have to sign in again for 30 days. It's strictly necessary and contains a signed account reference. On the account page, your API key is kept in your browser's local storage on that device until you sign out. We don't use analytics, advertising or third-party cookies, and our fonts are served from our own server.
How long we keep data
- Account data: while your account exists. Deleting your account removes it from our live database immediately; any copies in backups are deleted when those backups expire.
- Access tokens expire after 1 hour, refresh tokens after 90 days; sign-in codes after 10 minutes.
- Usage log: the most recent 500 entries.
- Free-trial record: a one-way hash of your email address (not the address itself), kept after deletion so each person gets the free credits once.
- Payment records are kept by Dodo Payments as required by tax and accounting law.
Your rights
Depending on where you live (including under the GDPR, UK GDPR and California law) you can access, correct, export or delete your data, object to or restrict processing, and complain to your data protection authority. You can do the most common things yourself on your account page:
- Download my data — a JSON file of everything in your account.
- Delete account — removes your account, key, connected apps and remaining credits.
For anything else, email support@example.com; we'll respond within 30 days.
Security
Keys and tokens are stored only as hashes, sign-in links and codes are single-use and expire quickly, all traffic uses HTTPS, and access to our servers is restricted. No system is perfectly secure; if a breach affects your data, we'll notify you as the law requires.
Children
The Service is for businesses and adults. We don't knowingly collect data from anyone under 18.
Changes
We'll update the effective date when this policy changes and email account holders about material changes before they apply.