Version: 2026-09-05
Effective Date: September 5, 2026
Provider: ZealTop OÜ ("we", "us")
| Field | Value |
|---|---|
| Data Controller (GDPR term) | ZealTop OÜ |
| Registered Address | Harju maakond, Tallinn, Kesklinna linnaosa, Ahtri tn 12, 15551, Estonia |
| Registry Code | 17367911 |
| Contact Email | www.zeal.top@gmail.com |
| DPO (Data Protection Officer) | Not currently designated (not mandatory under current scale thresholds) |
| Type | Scope |
|---|---|
| Account info | Email, phone, nickname, avatar URL |
| Third-party OAuth | Google-provided email + sub (unique ID); no passwords stored |
| Profile additions | Bio, remarks you fill in |
| Content | Text, images, audio, video, file attachments, knowledge-base content, AI prompts/conversation history you upload |
| Developer info | Stripe Connect Express account ID (if you register as developer) |
| Type | Scope |
|---|---|
| Device/client | User-Agent, device ID, browser version |
| Logs | IP, login times, accessed URLs, error logs |
| Usage | Browsing history, AI Token consumption, voice transcription duration, web-search and tool-call counts, subscription records |
| Payment events | Stripe order ID, amount, currency, payment time (Stripe stores card data; we only store order metadata) |
| Purpose | Legal Basis |
|---|---|
| Service provision, order fulfillment | Art.6(1)(b) Contract necessity |
| Account security, anti-fraud | Art.6(1)(f) Legitimate interest |
| Customer support | Art.6(1)(b) Contract necessity |
| Marketing emails | Art.6(1)(a) Consent (revocable) |
| Legal obligations (tax, KYC) | Art.6(1)(c) Legal obligation |
| Severe violation / regulatory referral | Art.6(1)(c) + (e) Law / public interest |
AI content moderation uses OpenAI Moderation API; we transmit only required moderation fields, no identifiable personal data. Voice transcription, web search and AI tool execution are part of the service itself, based on Art.6(1)(b) contractual necessity.
We use your personal data to:
We will NOT:
To provide service, we share necessary data with the following categories of third parties:
| Category | Third Party | Shared Data | Purpose |
|---|---|---|---|
| Payments | Stripe Inc. (US) | email, name, order metadata, IP | Payment processing, fraud detection, Connect account management |
| LLM inference | Model services configured by you or the assistant developer (a commercial API provider, or a server / personal device operated by the developer — see 5.2) | Conversation content (anonymized user_id) | AI inference (endpoint chosen by the configuring party) |
| Voice transcription | Groq Inc. (US, primary), OpenAI (fallback) | Voice input audio | Speech-to-text |
| Web search | Tavily Inc. (US) | Search query terms | webSearch built-in tool |
| Content moderation | OpenAI Inc. (US) | Text/image URLs to be moderated | Moderation API |
| Cloud infrastructure | Google Cloud Platform (primarily Singapore region) | All data (encrypted storage) | GKE / Cloud SQL / Pub/Sub / Secret Manager / logging |
| File storage & delivery | Cloudflare Inc. (global edge) | Files and attachments you upload (R2 object storage), frontend static assets | R2 / Pages / CDN / origin protection |
| Code execution | Cloudflare Inc. (Workers) | Hosted-tool call inputs and runtime logs (code-execution processor only, no long-term business data storage, see 5.1) | Workers for Platforms |
| Human verification | Cloudflare Turnstile | Device and browser signals | Abuse prevention (login / guest entry) |
| Push notifications | Google Firebase (FCM) | Device push tokens, notification content | Mobile / web push |
| Email notifications | Resend (primary) and other email providers | Email, notification content | System notifications |
| Regulatory / judicial | Government bodies (per legal requirement) | Necessary data | Compliance |
Assistants may mount tools provided by developers. When you use such an assistant:
We do not operate our own model inference. The model endpoint an assistant uses is supplied by that assistant's developer, and every turn of your conversation with that assistant is sent to that endpoint. The endpoint may be:
We do not control how the endpoint stores or uses this content. Model endpoints for official platform assistants are configured by ZealTop OÜ and involve no third-party developer.
Which assistant you talk to is your choice; an assistant's detail page lists the models and tools it mounts.
Due to deployment on GCP, Cloudflare and Stripe, some data transfers outside the European Economic Area (EEA):
If you have concerns about international transfers, please contact us for details.
| Type | Retention |
|---|---|
| Account info | Account lifetime + 30 days post-closure for dispute handling |
| Order / payment records | 7 years (EE Commercial Code + Tax Act requirement) |
| Chat history / AI conversations | Per assistant's memory_mode; up to account lifetime |
| Chat attachments / tool-produced files | 7 days (hard cleanup) |
| Hosted-tool data (rows and files) | For the lifetime of the tool; you can delete yours at any time; reclaimed within 7 days after the tool is deleted |
| Hosted-tool runtime logs | 3 days |
| Logs | 90 days (rolling) |
| Violation logs | banWindowDays (default 30) + 90 days audit |
| Marketing consent records | Cease use immediately upon withdrawal; records kept 6 years for evidence |
As a data subject, you have the right to:
| Right | Description | How to Exercise |
|---|---|---|
| Access Art.15 | Get a copy of data we process about you | Contact support |
| Rectification Art.16 | Correct inaccurate data | Settings page / support |
| Erasure ("right to be forgotten") Art.17 | Delete your data (subject to legal retention: orders/tax records for 7 years) | Settings → Delete Account (self-service) |
| Restrict processing Art.18 | Pause certain processing | Support |
| Data portability Art.20 | Get structured data export (JSON) | Support |
| Object Art.21 | Object to legitimate interest processing | Support |
| Withdraw consent Art.7(3) | Applies only to optional consent-based processing (e.g., marketing emails). The Terms of Service constitute a contract and cannot be unilaterally withdrawn; to terminate the relationship, use Account Deletion | No optional consent-based processing currently enabled; if introduced (e.g., marketing emails), Settings will provide individual toggles |
| Lodge complaint Art.77 | File complaint with DPA | Estonia Andmekaitse Inspektsioon (AKI) |
We commit to responding to reasonable requests within 30 days.
We use the following cookie types:
We do NOT use: third-party advertising cookies, cross-site tracking.
If we deploy in EU markets at scale, we will publish a separate Cookie banner (EU ePrivacy requirement).
The Platform is not directed at users under 18. Accounts found to be minors will be deleted upon confirmation.
Guardians who discover unauthorized registration by a child should contact support for removal.
We implement industry-standard measures to protect your data:
However, no system is 100% secure. In the event of a data breach, we will notify regulators and affected users within 72 hours per GDPR Art.33/34.
The Platform uses AI / algorithms for:
If such decisions have significant impact on you (e.g., account ban), you have the right to:
13.1 We may modify this Policy in response to legal changes or business adjustments. Material changes will be communicated via login interception + email.
13.2 Current and historical versions are available on the Settings page.
End of Policy