Legal

Privacy Policy

Last updated: October 18, 2026

Plain-language summary: we collect the minimum needed to run the studio — your email, your prompts and uploads (to run the AI models), your credit activity, and privacy-preserving visit statistics. We don't run ads, we don't sell your data, and you can delete your creations at any time.

The website at zappyquote.com and the Zappy creative studio (the “Service”) are operated by ZappyQuote Digital, trading as Zappy AI Studio, Komorni Hradek 416, Chocerady 257 24, Czech Republic (“Zappy”, “we”, “us”), who is the data controller for the personal information described in this policy. This Privacy Policy describes the information we collect, how we use it, and the choices you have.

Information we collect

Account information

When you create an account we collect your name, your email address and a securely hashed password, and we send a one-time link to confirm the email address belongs to you. If you sign in with Google, we receive your Google account email, name and basic profile information via Google Sign-In. We do not receive your Google password.

Payment information

Paid plans are processed by Stripe. Your card details are entered directly with Stripe and are handled by Stripe under their terms and privacy policy. We do not see or store full card numbers.

Content you provide

To generate results, the prompts you type and any images or audio you upload are sent to third-party AI providers that run the models (for example BytePlus and fal.ai for images, video and audio, Google Gemini for planning and image review, and OpenRouter for prompt enhancement). The generated outputs are returned to you. If you are signed in, your generated media is also saved privately to the My Creations gallery on your account (we keep your most recent creations, currently up to 80), where you can download or permanently delete any of them at any time. Do not upload content you do not have the right to use.

Usage and technical data

We keep a credit ledger of your activity (credits used and granted) and use your IP address for rate limiting and abuse prevention. We use a session cookie (HTTPS-only, inaccessible to scripts) to keep you signed in. We also keep basic first-party visit statistics: the page visited, the referring site, and an approximate location (country/region/city) derived from your IP address by a geolocation service. We store a salted one-way hash of the IP for these statistics, not the address itself. We do not use third-party advertising trackers.

Optional analytics cookie (only with your permission): if you choose Allow in the cookie banner, we set one first-party cookie (zq_aid, HTTPS-only, inaccessible to scripts, kept up to 180 days) holding a random identifier, not your name or email, and remember your choice in a second cookie (zq_consent). With it we record the page you landed on, the campaign tags in the link (utm_source, utm_medium, utm_campaign, utm_content, utm_term), the referring website's domain and a coarse browser type (for example: browser or bot). When you sign in, that identifier is linked to your account so we can count sign-ups, first creations and purchases by campaign - only for what happens while your permission is in place; if you withdraw it, nothing further is counted or linked for your account. Without your permission - or if you choose Decline, or your browser sends a Global Privacy Control or Do Not Track signal - we set no such cookie and record nothing for this purpose. We never store your full browsing address, your IP address, your prompts or your creations for this purpose, we do not fingerprint your device, and we do not share this data with advertisers. You can change your mind at any time:

Emails we send

We send account emails tied to your account: an email-confirmation link, a welcome email, payment and renewal confirmations, security notices, and password-reset links when you request them. These are part of the Service and are sent because you have an account with us, not for marketing.

We send marketing emails — occasional tips, creative ideas and product updates — only if you have asked for them. The checkbox at sign-up is optional and is not ticked for you, it is separate from accepting the Terms, and you can register without it. If you have never been asked, you are not signed up: we treat “we do not know” as “no”, and we do not email you to ask. You can turn marketing email on or off yourself at any time in your account, and every marketing email carries a one-click unsubscribe link that takes effect immediately.

Unsubscribing from marketing does not stop account emails, because those are how we tell you about your own payments, renewals and security. If an address stops accepting mail, or is reported as spam, we stop sending to it.

Developer access

If you create an API key we store a hash of it, never the key itself, together with the name and limits you chose and when it was last used. If you authorise an application through OAuth we store the connection, the permissions you approved and the tokens that represent it, so that you can see and revoke it. We record requests made with a key or a connection — what was asked for, what it cost and whether it succeeded — so that your balance and your limits are correct and so we can investigate abuse.

Invitations

If you invite someone with your referral link, we store an opaque code for your account, and, for an account that joins through it, the fact that it was referred by you and whether a reward became due. Your referral link carries no information about you and reveals nothing about your account to the person you send it to. We never tell you who joined, what they bought or anything else about them: you see counts only. The link uses one first-party cookie to remember the code until sign-up; it contains no identity and is not used to track you across other websites.

How we use information

To provide the Service, generate your results, and maintain your account and credit balance.
To process payments and manage subscriptions.
To prevent abuse, enforce limits, and keep the Service secure.
To respond to your requests and, where you have opted in, send product updates.

How information is shared

We share information only with service providers that help us run the Service, including: Stripe (payments), Google (sign-in, and Gemini AI models), AI model providers such as BytePlus, fal.ai and OpenRouter (to produce outputs), and our hosting provider. We do not sell your personal information.

Data retention

We keep account and transaction records for as long as your account is active and as needed to comply with legal and accounting obligations. Media in your My Creations gallery is kept until you delete it or it rotates out beyond the most recent creations we store. We take routine backups of our database for disaster recovery and retain them for roughly two weeks before they are overwritten.

Your choices and rights

You can request access to, correction of, or deletion of your personal information. You can turn marketing email on or off yourself at any time in your account, or with the unsubscribe link in any marketing email To make a request, contact us at our contact page. Depending on where you live, you may have additional rights under laws such as the GDPR or CCPA.

Children

The Service is not directed to children under 13 (or the minimum age in your country), and we do not knowingly collect their information.

Changes

We may update this policy from time to time. Material changes will be reflected by updating the date above.

Contact

Data controller: ZappyQuote Digital, trading as Zappy AI Studio.
Address: Komorni Hradek 416, Chocerady 257 24, Czech Republic.
Questions about this policy, or a privacy request? Email support@zappyquote.com or use the contact page.