Privacy Policy

Zyberon (“we”, “us”) operates the Zyberon platform, an AI operations service for ecommerce businesses. For the personal data described in this policy we act as the data controller for our own website, account, and billing data, and as a processor for the store and customer data you connect to run your workspace. Our Data Processing Agreement sets out how we process that store and customer data on your behalf.

Contact for all privacy matters: hello@zyberon.ai. The company details below identify the controller.

Account data: your name, email address, company details, and login credentials (passwords are stored only as secure hashes by our authentication provider).

Integration data: the accounts you connect (Shopify store, Meta and other ad accounts, mailbox, Slack workspace) and the operational data those integrations expose under the scopes you authorize. That means orders, products, customer messages, ad metrics, and similar records needed to run the tools you enable.

Content you create: prompts, settings, and the pages, ads, quizzes, videos, and messages generated in your workspace.

Usage and technical data: log data, device and browser information, the network (IP) addresses your account is used from, and product-usage events, used for security and to improve the Service.

Billing data: subscription and payment status. Payment details are collected and processed by Mollie; we never see or store full card numbers.

To provide the Service you signed up for: running the AI tools you enable, syncing your integrations, and billing your subscription (performance of a contract).

To secure, debug, and improve the Service, and to prevent abuse (legitimate interest).

To send you service communications about your account, and, only with your consent where required, product news you can opt out of at any time (consent / legitimate interest).

To comply with legal obligations such as tax and accounting rules (legal obligation).

Zyberon works by sending relevant parts of your workspace data to third-party AI providers to generate output. Depending on the tools you use, this can include support emails and order context, product titles and descriptions, ad copy and briefs, images, and your prompts. We send what the task needs. We do not send your entire database.

Current AI providers: OpenAI (openai.com/policies/privacy-policy), Anthropic (anthropic.com/legal/privacy), Google (policies.google.com/privacy), and Higgsfield (higgsfield.ai). These providers process your data under their own terms and may retain it (for example for abuse monitoring) in accordance with their policies. Where you connect your own API key, your direct agreement with that provider applies to that traffic.

We do not use your data to train AI models ourselves, and we do not sell it. Providers' own retention and training practices are governed by their policies linked above, so review them if this matters for your business.

The marketing pages of our website (zyberon.ai) do not load any third-party advertising or analytics tracking tags. There is no Meta Pixel, no TikTok Pixel, no Google Ads tag and no Google Analytics on them. We do not track your browsing across other websites, and we do not share your browsing behaviour on our marketing pages with any advertising platform.

Our own campaign pages are the one exception: the quizzes under zyberon.ai/sales and the stories under zyberon.ai/stories, which you usually reach from one of our ads on Facebook or Instagram. Those pages first ask whether you accept tracking. Only if you accept do they load the Meta Pixel and send Meta the steps of your visit (viewing the page, starting and completing the quiz, leaving your details, booking a call), from your browser and from our server through Meta's Conversions API, so that we can measure which of our ads work. With those events Meta receives your IP address and the country it belongs to, your browser details, Meta's own cookies (_fbp and _fbc), a random visitor ID in hashed form and, when you leave your details, your email address, phone number and name in hashed form. If you decline or do not answer, nothing about your visit is shared with Meta. You can change your choice at any time with the Privacy choices link at the bottom of those pages. For this collection Meta and Zyberon are joint controllers; what Meta does with the data afterwards is governed by Meta's own privacy policy (facebook.com/privacy/policy). We keep these events for 180 days.

We measure visits to our own marketing pages with a first-party system we built and host ourselves. It records the page you viewed, the site that referred you, your country, your device type and a technical identifier that changes every day and cannot be linked back to you afterwards. It sets no cookies, stores no IP addresses and follows no one across days or websites. If your browser sends the Do Not Track signal, we skip the measurement entirely.

We use a small number of strictly necessary cookies to run the site and your account, for example to keep you signed in and to remember your active organization once you are inside the Zyberon platform. The cookie banner on our homepage lets you record an accept/decline preference in your browser's local storage; that preference is not connected to any advertising technology, because none is loaded on the marketing pages. The tracking question on our campaign pages is separate: your answer is kept in your browser's local storage for at most twelve months, together with, only after you accept, a random visitor ID and the ID of the ad you arrived from.

If we introduce advertising tags or third-party analytics on the marketing pages in the future, we will update this policy first and, where required by law, request your consent before those tags load.

Important: pixels and tags that you install on your own store or landing pages are your responsibility as the operator of that store, including any consent requirements toward your own visitors. That covers pages created with Zyberon, for example the pixels you configure for your Quiz Funnels.

We share personal data only with service providers that help us run Zyberon, under written data processing terms, and only to the extent needed. Every one of them is listed below with what it does, the data it receives and where that data is processed. Our database and authentication run on software we host ourselves on these servers, not with an outside database provider.

We update this list before a new provider starts processing personal data, and we notify the owner of every workspace by email at least 30 days in advance, as our Data Processing Agreement describes. The sub-processor page shows the date of the last change. We never share your data with third parties for their own marketing.

Where a provider processes data outside the EEA or the UK (for example US based AI providers), transfers are protected by the EU Standard Contractual Clauses or an adequacy mechanism such as the EU-US Data Privacy Framework, as applicable to that provider.

The platforms you connect yourself (such as Shopify, Meta, Snapchat, TikTok, Pinterest, Google, Microsoft, Klaviyo, Slack or your own mail server) are not our sub-processors: we exchange data with them on your instructions, and your own agreement with each of them governs what they do with it.

We keep workspace data for as long as your account is active so your tools keep working. When you delete your account (or ask us to), we delete or anonymize your personal data within 30 days, with encrypted backups expiring on their own schedule of up to 90 days.

We retain limited billing and invoice records for as long as tax and accounting law requires. Operational records are trimmed automatically on fixed clocks: application logs after 30 days, incoming platform webhooks after 30 days, health check results after 30 days, the network addresses an account was used from 90 days after their last use, error records after 90 days, AI usage records after 180 days, conversion tracking events after 180 days, and the administrative audit trail after 400 days. Sales enquiries are removed 24 months after the last contact.

You have the right to access your personal data, receive a copy in a portable format (export), correct inaccurate data (rectification), have it deleted (erasure), restrict or object to certain processing, and withdraw consent at any time without affecting prior processing.

To exercise any of these rights, email hello@zyberon.ai from your account email. We respond within one month, as GDPR requires; for complex requests we may extend by up to two further months and will tell you if so. You can also disconnect any integration or delete your account directly from your dashboard at any time.

If you believe we have not handled your data correctly, you can lodge a complaint with your local data-protection authority (in the Netherlands: Autoriteit Persoonsgegevens).

We apply industry standard measures including encryption in transit, encrypted storage of access tokens and API keys, encrypted database backups, least privilege access controls, and strict isolation between customer workspaces. No system is perfectly secure, but protecting your data is a design requirement, not an afterthought. Annex III of our Data Processing Agreement describes these measures in detail.

To stop abuse, we record the network addresses each account is used from, and we can block an account, an email address or a network address from the Service. A blocked person is told so when they sign in. These addresses are kept for 90 days after their last use.

If you believe you have found a security vulnerability, please report it as described in our vulnerability disclosure policy.

We may update this policy as the Service or the law changes. Material changes will be announced before they take effect. Continued use after the effective date means the updated policy applies.

For any privacy question or request, email hello@zyberon.ai.