Privacy Policy

This Privacy Policy explains how Zivv ("we," "us," or "our") collects, uses, stores, and protects personal information generated through your use of the Service. Please read this Policy carefully before using the Service.

1. Scope & Geographic Restriction

This Policy applies to all users outside mainland China who interact with our website, API, and related services.

Regulatory context: China's Personal Information Protection Law (PIPL, 2021) imposes strict requirements on cross-border personal data transfers. The Measures for Security Assessment of Cross-border Data Transfer (2022) require a security assessment before transferring important data overseas. As an overseas service provider not operating within mainland China, this Platform is not subject to PIPL's territorial jurisdiction. Nevertheless, we adhere to internationally recognized data protection standards.

Lawful basis for processing: We process your personal data on the following legal bases: contract performance (necessary to provide the Service to you), legitimate interests (security protection and fraud detection), and consent (where applicable).

2. Information We Collect

2.1 Information You Provide

• Account information: Email address, display name, and password (hashed) provided at registration;
• Payment information: Top-up records (we do not store full payment card numbers; payments are processed by a third-party payment processor);
• Support requests: Content submitted through our support channels.

2.2 Automatically Collected Information

• API usage logs: Request timestamps, model names, token counts, latency, and error codes — no prompt or response content;
• Device & network info: IP address (for security and rate limiting), browser type, and operating system;
• Cookies & local storage: To maintain login sessions and user preferences (e.g., language).

2.3 Information We Do Not Collect

• The content of prompts you send via the API;
• AI model responses;
• Your precise geographic location.

3. How We Use Your Information

We use collected information solely for:

• Providing, maintaining, and improving the Service;
• Account authentication and security;
• Billing and usage tracking;
• Sending service notifications (major changes, security alerts);
• Detecting and preventing abuse, fraud, and policy violations;
• Responding to support requests.

We do not use your personal data for unrelated commercial purposes, and we do not sell your data to third parties.

4. Data Sharing

We may share your information with third parties only in these limited circumstances:

• Service providers: Cloud storage providers, payment processors, and CAPTCHA services (Cloudflare Turnstile);
• Upstream AI services: Your API requests are routed to upstream providers such as Google Gemini or Anthropic. We do not proactively share your account information with them;
• Legal requirements: Compliance with lawful requests from competent law enforcement under applicable law;
• Business transfers: User data may transfer as an asset in a merger, acquisition, or asset sale. You will be notified in advance.

5. Data Storage & Security

• Your data is stored on cloud servers located outside mainland China;
• Passwords are stored using industry-standard one-way hashing (bcrypt/argon2) — we cannot recover plaintext passwords;
• All transmissions use TLS 1.2+ encryption;
• We conduct regular security reviews with access controls and log monitoring;
• No internet transmission can be guaranteed 100% secure. Please safeguard your credentials.

6. Data Retention

• Account data: Retained while the account is active; deleted within 30 days of account closure (subject to legal hold obligations);
• API usage logs: Retained for 90 days for billing reconciliation and security audits;
• Payment records: Retained as required by applicable law (typically 5–7 years).

7. Your Rights

You have the following rights regarding your personal data:

• Access: View the data we hold about you;
• Rectification: Update inaccurate personal information;
• Erasure: Request deletion of your account and related data (subject to legal retention obligations);
• Portability: Export your data in a machine-readable format;
• Withdraw consent: Withdraw consent for specific processing activities (without affecting prior processing).

To exercise these rights, contact us through our support channels. We will respond within 30 business days.

8. Cookie Policy

We use the following types of cookies:

• Essential cookies: Required to maintain login sessions and cannot be disabled;
• Preference cookies: Remember language and theme settings;
• Security cookies: Required by Cloudflare Turnstile for bot protection.

We do not use third-party advertising tracking cookies.

9. Minors

The Service is not directed at children under 18 years of age. If we discover that personal data of a minor has been collected, we will promptly delete it and close the associated account.

10. Policy Changes

We may update this Privacy Policy periodically. Material changes will be communicated via email or in-platform notifications. Continued use of the Service constitutes acceptance of the updated Policy.

11. Contact Us

For questions about this Policy or to exercise your data rights, contact us through our in-platform support channels or official support email.