Privacy Policy

Zyberon (“we”, “us”) operates the Zyberon platform, an AI operations service for ecommerce businesses. For the personal data described in this policy we act as the data controller for our own website, account, and billing data, and as a processor for the store and customer data you connect to run your workspace.

Contact for all privacy matters: hello@zyberon.ai.

Account data: your name, email address, company details, and login credentials (passwords are stored only as secure hashes by our authentication provider).

Integration data: the accounts you connect (Shopify store, Meta and other ad accounts, mailbox, Slack workspace) and the operational data those integrations expose under the scopes you authorize — orders, products, customer messages, ad metrics, and similar records needed to run the tools you enable.

Content you create: prompts, settings, and the pages, ads, quizzes, videos, and messages generated in your workspace.

Usage and technical data: log data, device and browser information, and product-usage events used for security and to improve the Service.

Billing data: subscription and payment status. Card details are collected and processed by Stripe; we never see or store full card numbers.

To provide the Service you signed up for — running the AI tools you enable, syncing your integrations, and billing your subscription (performance of a contract).

To secure, debug, and improve the Service, and to prevent abuse (legitimate interest).

To send you service communications about your account, and — only with your consent where required — product news you can opt out of at any time (consent / legitimate interest).

To comply with legal obligations such as tax and accounting rules (legal obligation).

Zyberon works by sending relevant parts of your workspace data to third-party AI providers to generate output. Depending on the tools you use, this can include support emails and order context, product titles and descriptions, ad copy and briefs, images, and your prompts. We send what the task needs — we do not send your entire database.

Current AI providers: OpenAI (openai.com/policies/privacy-policy), Anthropic (anthropic.com/legal/privacy), Google (policies.google.com/privacy), and Higgsfield (higgsfield.ai). These providers process your data under their own terms and may retain it (for example for abuse monitoring) in accordance with their policies. Where you connect your own API key, your direct agreement with that provider applies to that traffic.

We do not use your data to train AI models ourselves, and we do not sell it. Providers' own retention and training practices are governed by their policies linked above — review them if this matters for your business.

Our marketing website (zyberon.ai) does not currently load any third-party advertising or analytics tracking tags — no Meta Pixel, TikTok Pixel, Google Ads tag, or Google Analytics. We do not track your browsing across our marketing pages for advertising purposes today.

We use a small number of strictly necessary cookies to run the site and your account — for example to keep you signed in and to remember your active organization once you are inside the Zyberon platform. The cookie banner on our homepage lets you record an accept/decline preference in your browser's local storage; that preference is not currently connected to any advertising or analytics technology, because none is loaded.

If we introduce advertising or analytics tags on the marketing website in the future, we will update this policy first and, where required by law, request your consent before those tags load.

Important: pixels and tags that you install on your own store or landing pages — including pages created with Zyberon (for example, the pixels you configure for your Quiz Funnels) — are your responsibility as the operator of that store, including any consent requirements toward your own visitors.

We share personal data only with service providers that help us run Zyberon, under data-protection agreements, and only to the extent needed. Current categories and providers: hosting and delivery (Vercel; Hetzner — EU data centers); database and authentication (self-hosted Supabase on Hetzner, EU); payments (Stripe); AI processing (OpenAI, Anthropic, Google, Higgsfield); public-web data collection for research features (e.g. Apify); and the platforms you explicitly connect (Shopify, Meta, TikTok, Google, Slack, your email provider) so the Service can act on your behalf.

We may update this list as the Service evolves; the current version is always in this policy. We never share your data with third parties for their own marketing.

Where a provider processes data outside the EEA/UK (for example US-based AI providers), transfers are protected by the EU Standard Contractual Clauses and/or an adequacy mechanism such as the EU–US Data Privacy Framework, as applicable to that provider.

We keep workspace data for as long as your account is active so your tools keep working. When you delete your account (or ask us to), we delete or anonymize your personal data within 30 days, with encrypted backups expiring on their own schedule of up to 90 days.

We retain limited billing and invoice records for as long as tax and accounting law requires, and security logs for a short rolling window.

You have the right to access your personal data, receive a copy in a portable format (export), correct inaccurate data (rectification), have it deleted (erasure), restrict or object to certain processing, and withdraw consent at any time without affecting prior processing.

To exercise any of these rights, email hello@zyberon.ai from your account email. We respond within one month, as GDPR requires; for complex requests we may extend by up to two further months and will tell you if so. You can also disconnect any integration or delete your account directly from your dashboard at any time.

If you believe we have not handled your data correctly, you can lodge a complaint with your local data-protection authority (in the Netherlands: Autoriteit Persoonsgegevens).

We apply industry-standard measures including encryption in transit and at rest, encrypted storage of API keys, least-privilege access controls, and strict isolation between customer workspaces. No system is perfectly secure, but protecting your data is a design requirement, not an afterthought.

We may update this policy as the Service or the law changes. Material changes will be announced before they take effect. Continued use after the effective date means the updated policy applies.

For any privacy question or request, email hello@zyberon.ai.