PRIVACY POLICY

1. What we collect

1.1 What you give us

• Account: name, email address, username, profile picture
• Page content: links, text, and images you add
• Payment: Creem customer, subscription, transaction and refund references, status, amount, currency, and tax details. Card details are entered and stored with Creem; we do not store a card number, security code or card token
• Correspondence: your messages to support

1.2 What is collected automatically

• Technical data: IP address, browser type, operating system, device type
• Page analytics: views, link clicks, referral source, country derived from IP
• Dashboard usage: which sections you open, which features you enable

We do not collect special categories of data — health, religion, political views and the like — and we ask you not to publish them on your page.

2. Why we do it

3. Who we share it with

We do not sell personal data and do not pass it to third parties for their own marketing. It reaches only the suppliers who provide technical services to us:

Image moderation. An uploaded image is sent to Google Cloud Vision for automated screening before it is stored. Google returns a category assessment only. We do not send your name, email, or account identifier with the image, and we keep no copy of a rejected one.

A creator's own pixel. A creator may add their own Meta Pixel to their page. Where they have, Meta receives information about your visit directly from your browser. The creator is the controller of that processing, not us, and their own privacy notice applies. We do not add tracking of this kind to creator pages ourselves.

We also disclose data where the law or a court requires it, and to protect rights and safety — ours or someone else's.

4. Transfers abroad

Zori.bio is operated from Ukraine. Some suppliers process data in the EU and the United States, so data crosses borders. For transfers from the EU we rely on the Standard Contractual Clauses approved by the European Commission. Ukraine is a party to Council of Europe Convention 108 on data protection.

5. How long we keep it

• Account data: while the account is active, then deleted within 30 days
• Analytics: 26 months
• Payment and accounting records: 1095 days, the period set by tax law
• Support correspondence: 3 years
• Moderation log: 3 years

After the period ends, data is deleted or anonymised.

6. Your rights

Under Article 8 of the Law of Ukraine “On Personal Data Protection” you have the right to:

• Know what data we process about you, and receive a copy
• Correct inaccurate or incomplete data
• Delete your data and your account
• Restrict or object to processing
• Withdraw consent where consent is the basis
• Complain to the Ukrainian Parliament Commissioner for Human Rights

Most of this is available directly in your account settings. For the rest, email hi@zori.bio — we reply within 30 days.

7. For visitors from the EU

If you are in the European Union, the GDPR applies to you. Its rights largely match the list above and add the right to receive your data in a machine-readable format. The legal bases are set out in section 2.

You may complain to the supervisory authority in your country. We answer requests within 30 days, extendable to 90 for complex ones, with notice that we are extending.

8. Cookies and analytics

Zori.bio does not currently display a cookie consent banner and does not respond to “Do Not Track” or Global Privacy Control signals. Analytics cookies are set when a page loads. You can refuse them through your browser settings or with an extension such as uBlock Origin.

On public pages we use Google Analytics 4 and our own event logging. In the signed-in dashboard we additionally use PostHog, hosted in the EU, which records session replays of your activity there; all form inputs are masked, so what you type is not captured.

9. Security

We encrypt data in transit (TLS), do not store card data or payment tokens (Creem holds them), hash passwords, restrict who can reach data, and log administrator actions. No method of transmission or storage is completely secure, so we cannot guarantee absolute security.

If a breach creates a high risk to your rights, we will notify you and the competent authorities without undue delay — within 72 hours where feasible.

10. Children

Zori.bio is for people aged 18 and over. We do not knowingly collect children's data. If we learn that an account belongs to someone under 18, we delete it. If you know of such a case, write to hi@zori.bio.

11. Changes and contact

We will announce material changes by email or through the service and update the date at the top. Continuing to use Zori.bio after they take effect means you accept the updated policy.

Questions about personal data: hi@zori.bio.