Privacy Policy
Zymera SAS places the utmost importance on the protection of your personal data. This policy is written in accordance with Regulation (EU) 2016/679 (GDPR) and applicable French data protection law.
1. Data Controller
The controller of personal data collected via Zymera.ai is:
Zymera SAS
France
Email: contact@zymera.ai
2. Data Collected
2.1 Data You Provide
- Registration data: email address, hashed password, first/last name (optional)
- Billing data: payment information processed exclusively by Stripe (we do not store your card details)
- User content: images, audio/video files you upload for generations
- Communications: messages sent to our support team
2.2 Automatically Collected Data
- Usage data: generation history, credits consumed, models used
- Technical data: IP address, browser type, operating system, pages visited, session duration
- Cookies: see our Cookie Policy
2.3 Data We Do Not Collect
We do not intentionally collect sensitive data as defined by the GDPR (ethnic origins, political opinions, religious beliefs, health data, etc.). If you upload content containing such data, you bear full responsibility for it.
3. Purposes and Legal Bases
| Purpose | Legal basis | Retention |
|---|---|---|
| Account creation and management | Contract performance | Account lifetime + 3 years |
| Service provision (AI generations) | Contract performance | Account lifetime |
| Billing and payments | Legal obligation | 10 years (accounting) |
| Service improvement (anonymised analytics) | Legitimate interest | 26 months |
| Transactional emails | Contract performance | Account lifetime |
| Newsletters / offers (with consent) | Consent | Until unsubscribed |
| Fraud prevention and security | Legitimate interest | 1 year after incident |
| Compliance with legal obligations | Legal obligation | Applicable legal period |
4. Data Sharing
4.1 Technical Sub-processors
Zymera uses the following sub-processors:
- Supabase Inc. — Database hosting and authentication (USA — covered by SCCs)
- Stripe Inc. — Payment processing (USA — covered by SCCs)
- Cloudflare R2 — Storage of generated content (USA — covered by SCCs)
- fal.ai — AI model inference for image/video/avatar (USA — covered by SCCs)
- WaveSpeed AI — AI model inference for image/video
- KIE.ai — AI model inference for image/video
- ElevenLabs Inc. — Voice synthesis (USA — covered by SCCs)
- Inngest Inc. — Asynchronous background job execution
- Umami Analytics — Privacy-friendly audience analytics, no cookies, no personal data collected (EU — GDPR compliant by design)
These sub-processors only have access to data strictly necessary for their services. Data processing agreements compliant with the GDPR (DPA) have been concluded with each of them.
4.2 No Sale of Data
Zymera never sells, rents or transfers your personal data to third parties for commercial purposes. Your data is never used to train third-party AI models without your explicit consent.
4.3 Legal Disclosure
We may be required to disclose your data to competent authorities if required by law (court order, regulatory obligation).
5. Data Security
Zymera implements appropriate technical and organisational measures to protect your data against unauthorised access, loss, destruction or alteration:
- Encryption of data in transit (TLS 1.3) and at rest (AES-256)
- Passwords stored as hashes (bcrypt via Supabase Auth)
- Access to production data restricted to authorised personnel
- Regular review of permissions and access rights
- Access logging and anomaly detection
In the event of a data breach likely to result in a high risk to your rights and freedoms, we will notify you as soon as possible in accordance with Article 34 of the GDPR.
6. Your Rights
Under the GDPR, you have the following rights:
Right of access
Obtain a copy of your personal data
Right to rectification
Correct inaccurate or incomplete data
Right to erasure
Request deletion of your data ("right to be forgotten")
Right to restriction
Restrict processing in certain circumstances
Right to portability
Receive your data in a structured, readable format
Right to object
Object to processing based on legitimate interests
Withdrawal of consent
Withdraw your consent at any time
Right to complain
Lodge a complaint with the CNIL (French DPA)
To exercise your rights: contact@zymera.ai. We will respond within one month (extendable by two months for complex requests). Proof of identity may be required.
You may also lodge a complaint with the CNIL: www.cnil.fr
8. Children's Data
The Platform is restricted to adults. Zymera does not knowingly collect personal data from individuals under 18 years of age. If we learn that a minor has created an account, we will immediately delete their data.
9. Policy Updates
This policy may be updated. The date of last modification is shown at the top of the page. In the event of a material change, you will be notified by email. Continued use of the Platform constitutes acceptance of the updated policy.
10. DPO Contact
Data Protection Officer (DPO)
Email: contact@zymera.ai
Post: Zymera SAS — France