Privacy Policy

Last updated: 22.10.2026. In the section "Purposes, legal basis, and period of personal data processing" we added that when a community post or comment, a message in a community Support ticket or a message in a live room chat is deleted, we keep a copy of it for 30 days, available only to the Zanfia team (on the basis of our legitimate interest), and then delete it automatically. Previous version of the Privacy Policy (of 16.10.2026).

The administrator of the website is MailingR spółka z ograniczoną odpowiedzialnością with its registered office in Warsaw, at ul. Naddnieprzańska 24A, 04-205 Warsaw, registered in the Polish Court Register kept by the District Court in Warsaw, 14th Commercial Division, under KRS [entry number]: 0000922648, NIP [tax id]: 9522220567, REGON [statistical id]: 389999686, initial share capital: PLN 20,000.

If you have any doubt in connection with the privacy policy, you can contact us at any time by sending an email to support@zanfia.com.

SHORT VERSION - KEY INFORMATION

We care about both your privacy and your time. Therefore, we have prepared for you a short version of the key information related to privacy protection.

By visiting our website, choosing to use the Zanfia system, subscribing to our newsletter, or contacting us by phone or email, you provide us with your personal data. We keep it confidential and secure. We share it only with the providers who help us run Zanfia and measure our marketing (listed by name in the section "Your data recipients"), with the platforms you choose to connect, and with public authorities where the law requires it. We never sell your personal data.

We have entrusted the processing of personal data only to well-tried and trusted providers of personal data processing services. Some of them are based outside the European Economic Area, mainly in the USA; such transfers are covered by the safeguards required by the GDPR (see the section "Transfer of personal data to third countries").

We use Google Analytics analytical tools to collect information about your visits to the website, such as the subpages you have viewed, the time you have spent on the website, and subpages transitions. To this end, Google Analytics cookies from Google LLC are used, but only if you agree to analytics cookies in the cookie settings.

We use marketing tools such as the Meta (Facebook) Pixel and Google Ads to target ads to you, which involves using cookies from Meta and Google. Using the cookie settings, you can decide whether or not you agree to our use of these tools in your case.

The Zanfia System includes features based on artificial intelligence (e.g. the AI Assistant). To provide them we use external AI model providers, but we do not use your data to train models. You will find the details in the section "Artificial intelligence (AI) features".

If the above information is not sufficient for you, please find further details below.

PERSONAL DATA

The controller of your personal data within the meaning of the provisions on personal data protection is MailingR spółka z ograniczoną odpowiedzialnością with its registered office in Warsaw, Naddnieprzańska 24A, 04-205 Warsaw, entered into the Polish Court Register kept by the District Court in Warsaw, 14th Commercial Division, under KRS [entry number]: 0000922648, NIP [tax id]: 9522220567, REGON [statistical id]: 389999686, initial share capital: PLN 20,000.

Purposes, legal basis, and period of personal data processing

1. performance of the service contract (registration and maintenance of the customer account, placing orders for paid and free of charge services, the performance of the contract): the legal basis is that the processing is necessary for the performance of a contract or to take steps at the request of the data subject before entering into a contract (Article 6(1)(b) of the GDPR), the data are to be processed until the end of performing of the service (deletion of the customer account, termination of the services contract);
2. complying with the tax obligations (issuing invoices, keeping accounting records): the legal basis is compliance with a legal obligation to which we are subject (Article 6(1)(c) of the GDPR), the data will be processed until the expiry of the limitation periods for tax obligations;
3. establishment, exercise and defence of legal claims: the legal basis is our legitimate interest (Article 6(1)(f) of the GDPR) in taking actions aimed at protecting our rights in proceedings before courts and other state authorities, the data will be processed until the expiry of the limitation periods for claims under applicable law;
4. providing proper functioning of the Website and analysis of the Website users activities: the legal basis is our legitimate interest (Article 6(1)(f) of the GDPR) in ensuring the proper operation of the Website and conducting analysis and statistics on the use of its particular functionalities, the data will be processed until an effective objection is raised or the purpose of the processing is achieved; we use Google Analytics cookies and the Meta (Facebook) Pixel on zanfia.com only on the basis of your consent (Article 6(1)(a) of the GDPR), which you give or refuse in the cookie settings, and we process the data collected with them until you withdraw your consent or the purpose of the processing is achieved (the withdrawal of consent does not affect the lawfulness of the processing before its withdrawal);
5. maintaining fan pages and groups on Facebook, YouTube channel, Instagram account and interacting with users of the above mentioned social media: the legal basis is our legitimate interest (Article 6(1)(f) of the GDPR), which we have in promoting the Website and adapting its functionalities to current needs, the data will be processed until the expiry of the limitation periods for claims under applicable law;
6. responding to questions made to us by phone or email, the legal basis is our legitimate interest (Article 6(1)(f) of the GDPR), which we have in communicating with our customers and answering potential questions from our customers or other people interested in our products and services, the data will be processed until the expiry of the limitation periods for claims under applicable law;
7. marketing (promotion of our products and services): the legal basis is our legitimate interest (Article 6(1)(f) of the GDPR) in maintaining business relationships with the customers and surveying their satisfaction, looking after our own interests and image, or respectively the contract for the newsletter service (Article 6(1)(b) of the GDPR),
8. marketing (promotion of the products and services of entities cooperating with us): the data will be processed until an effective objection is raised or the purpose of the processing is achieved, and where the basis for processing is consent - until the consent is withdrawn (whereby withdrawal of the consent does not affect the lawfulness of data processing before its withdrawal).

We process your personal data as long as it is necessary to achieve the purposes mentioned above unless you make a valid and proper request to delete your personal data. In addition, the data processing period may depend on the legal provisions applicable to us, e.g. in the case of the storage of financial documents or the time limits for pursuing the claims.

When someone deletes a community post or comment, a message in a community Support ticket or a message in a live room chat, it disappears from view at once, and we keep a copy of it for 30 days, available only to the Zanfia team, so that we can investigate possible abuse. The legal basis is our legitimate interest (Article 6(1)(f) of the GDPR) in preventing abuse in communities and handling disputes about deleted content. Creators and community members never see this copy, and we delete it automatically after 30 days.

Data subjects' rights

The GDPR grants you the following potential rights concerning the processing of your personal data:

• the right of access to personal data,
• the right to rectification of personal data,
• the right to the erasure of personal data,
• the right to restriction of processing of personal data,
• the right to objection to the processing of personal data,
• the right to transfer the personal data,
• the right to file a complaint to a supervisory authority (President of the Personal Data Protection Office),
• the right to withdraw the consent to the processing of the personal data, where you have given your consent.

The terms of exercising the above rights are described in detail in Articles 16 - 21 of the GDPR. We encourage you to familiarise yourself with the provisions thereof. The rights indicated above are not absolute and, under the applicable law, you will not enjoy them in relation to all activities involving the processing of your personal data.

If you request us to exercise any of the above rights, we will respond to your request immediately, but no later than within one month of its receipt. If we cannot satisfy your demand within one month due to the complexity of the request or the number of requests, we will comply with it within a further two months. However, we will inform you in advance of the intended extension of the deadline.

Please also be informed that the withdrawal of your consent to data processing will not affect the lawfulness of data processing that took place under the consent given before its withdrawal.

Security

We guarantee you the confidentiality of all personal data provided. We ensure the implementation of all security and data protection measures required by data protection legislation. Personal data are collected with due care and suitably protected against access by unauthorised third parties.

Your data recipients

Your personal data recipients may be:

1. entities involved in the performance of our contracts, e.g., accounting office, IT services providers, hosting services providers, payment systems providers, providers of artificial intelligence models and transcription services,
2. entities providing us with the support and the services under separate agreements, within the scope of our business activity, e.g. website activity and direct marketing tools suppliers, suppliers of tools for creating landing pages and collecting leads, office systems suppliers, project management software suppliers, communication software suppliers,
3. authorised state authorities under applicable laws,
4. other entities whose request for data transfer is justified under the applicable laws.

All entities we entrust the processing of personal data ensure the application of suitable measures for the protection and security of personal data required by the provisions of law.

Our main service providers (sub-processors)

These are the main providers we use to run Zanfia. They process your data as our customer, and, as sub-processors, the data of Creators' customers that we process on behalf of Creators (see the section "Zanfia as a processor" and § 12 of the Terms of Service).

Payment operators that a Creator connects to their store (for example Stripe, PayU, Tpay, Przelewy24, PayNow, PayPal) receive the buyers' payment data under the Creator's own agreement with them.

Transfer of personal data to third countries

Some of our service providers (listed in the section "Your data recipients") are based in, or process data in, countries outside the European Economic Area (EEA), mainly the USA. This applies in particular to Microsoft, OpenAI and Deepgram (AI features), Vercel, Cloudflare, LiveKit, Trigger.dev, Upstash, Typesense and Postmark (operation of the service), Sentry (error monitoring), Slack (internal notifications), Firecrawl and ScrapeCreators (brand analysis), Stripe (payments), and Meta and Google (our marketing and analytics tools).

In such cases we transfer personal data on the basis of an adequacy decision of the European Commission (including the EU-U.S. Data Privacy Framework, for providers certified under it) or standard data protection clauses adopted by the European Commission (Article 46(2)(c) of the GDPR). Where a provider lets us choose, we use servers located in the EU (for example Google Cloud, Amazon SES and PostHog). For more information on the data processing by the above entities, please visit the websites of these service providers.

Profiling

As part of the Website and the technologies used, we may profile your data. Profiling involves using the user's data (i.e. gender, age, hobbies, approximate location, website behaviours) to assess his/her activity and potential demand for the services.

The profiling enables to personalise offers and advertisements addressed to the users; however, it does not affect the terms and conditions of concluded service contracts. The information processed is anonymous and is not associated with the user ordering the services. Thus, we do not make any automated decisions that could produce legal effects on individuals or affect them in a similarly significant way.

How we measure our own marketing

When you create a Zanfia account and use it, we record selected events: registration, start of the trial, your first product, your first sale, the start of a subscription and the purchase of a plan. We send them:

• if you accepted marketing cookies on zanfia.com, to Meta (Conversions API), together with your email address, first name, last name and country (hashed before sending), your user identifier (hashed), your IP address, browser information and the _fbp and _fbc identifiers, so that Meta can measure and optimise our ads,
• to Google Analytics 4 (Measurement Protocol), together with your Google Analytics identifier, your user identifier, the data of your first visit (campaign, referring page, landing page) and the plan and amount; we do not send your email address or name to Google; Google Ads imports plan purchases from Google Analytics as conversions; if you did not accept marketing cookies, we mark these events so that Google does not use them for advertising (Google Ads conversions, personalised ads),
• to PostHog (EU cloud), together with your user identifier, to analyse how Creators use Zanfia.

We read your cookie choice when you register (or buy a plan on our offer page) and save it with your account; when you change it on zanfia.com, the Zanfia panel updates it the next time you open it.

We save the data of your first visit (UTM parameters, ad click identifiers, the Google Analytics identifier, IP address, browser information, referring page and landing page) with your account when you register.

We keep the Meta ad click id (fbclid) from the link you sign up through with your account, as our own record of where the sign-up came from, like UTM tags. We share it with Meta only after you accept marketing cookies.

When you register, we add you as a contact in our own Zanfia account so that we can send you information about Zanfia. Our team receives internal notifications (in Slack) about new trials, payments and cancellations, with your name, email address and plan.

If you came to Zanfia through a partner's referral link, we record your email address with the partner's code. The partner sees your masked email address (for example j***k@g***l.com), the date you signed up, the status of your account (for example trial or paying), your plan and the commission they earn.

If you sign up on zanfia.com for information about our premiere or other events, we save your email address, first name and consent as a contact in our own Zanfia account. If you accepted marketing cookies, we also report the sign-up to Meta and TikTok as a lead, with your email address, IP address and browser information. If you also give us your phone number for SMS notifications, we save it with your consent and send the messages through SMSAPI.

Zanfia as a processor

Providing services under Zanfia Terms of Service, we also act as a processor, processing personal data of our customers' clients (Creators). These data are collected and recorded in the Zanfia system in connection with the provision of separate services by our customers (Creator).

As a processor, we process data only upon a documented instruction of the controller of such data (under a data entrustment agreement), committing ourselves to secure them properly by applying appropriate technical and organisational measures and ensuring an adequate level of security corresponding to the risks involved in the processing of personal data (according to the Article 32 of the GDPR). We also ensure that persons authorised by us to the processing have undertaken to keep them confidential.

Data from Meta Platforms (Facebook, Instagram, Threads and WhatsApp)

Zanfia allows you to connect your Facebook Pages, Instagram account, Threads profile, WhatsApp Business number and Meta ad accounts to use features based on Meta technologies: publishing posts, reading and answering Instagram and WhatsApp messages in Zanfia, showing the statistics of your accounts, and creating and managing ad campaigns and measuring their performance.

When you connect a Meta account to Zanfia, we receive certain data from Meta Platforms, Inc. via its APIs ("Platform Data"). Depending on the accounts you connect and the permissions you grant, this may include:

• your public profile information (name, username, profile picture) and the identifiers of the connected accounts,
• a list of ad accounts, Facebook Pages, and Instagram accounts you manage,
• data about your ad campaigns and their performance (e.g., reach, clicks, spend),
• the posts on your Instagram account and Threads profile, and the statistics of your Instagram account,
• messages sent to your Instagram account and to your WhatsApp Business number.

Publishing posts and first comments

We publish to your Facebook Pages, Instagram account and Threads profile the posts you create in Zanfia (text, images and videos, with the captions and settings you choose). For this we use the permissions pages_show_list, pages_manage_posts, pages_read_engagement and business_management (Facebook Pages), instagram_business_basic and instagram_business_content_publish (Instagram), and threads_basic and threads_content_publish (Threads).

If you add a first comment to a post, we publish it under the post. For this we request the permissions pages_manage_engagement and pages_read_user_content (Facebook Pages), instagram_business_manage_comments (Instagram) and threads_manage_replies (Threads), currently only from accounts in our early access programme. We use them only to publish your comment; we do not read the comments other people leave under your posts.

Statistics

With the instagram_business_manage_insights permission we display the statistics of your Instagram account in Zanfia. We also display your recent Instagram and Threads posts. We do not store these statistics or posts.

Once a week, and when you add a measurement in the statistics view, we store the follower count of your connected Instagram account, Facebook Pages and Threads profile, so that you can see how it changes over time. For Threads this requires the threads_manage_insights permission, which we currently request only from accounts in our early access programme. We store only the number of followers, not data about individual followers.

Instagram and WhatsApp messages

If you connect Instagram, we use the instagram_business_manage_messages permission to show in Zanfia the direct messages sent to your Instagram account and to send the replies you write there. When you connect the account, and when you refresh the inbox, we import up to 200 of your most recent conversations, with about the 20 most recent messages in each (a limit set by Meta). After that, Meta sends us new messages as they arrive.

If you connect a WhatsApp Business number through Meta's Embedded Signup, you grant the whatsapp_business_management and whatsapp_business_messaging permissions for the WhatsApp Business account you choose. We store the identifiers of that account and phone number, the phone number with its verified display name, and the access token. We then receive the messages sent to that number and send the replies you write in Zanfia.

For each conversation we store the identifier the platform gives the other person (on WhatsApp, their phone number), their username or profile name and profile picture address when the platform provides them, and the messages: text, links to attachments, and time. You can link a conversation to one of your clients in Zanfia.

These messages contain personal data of other people (your followers and customers). We process this data on your behalf, as your processor (see the section "Zanfia as a processor"), only to show it to you in Zanfia and to send your replies.

How we use Platform Data

We process Platform Data only to provide you with the Zanfia features you have chosen to use. In particular:

• we do not sell Platform Data or transfer it to data brokers,
• we do not use Platform Data for advertising purposes of our own or of third parties,
• we share Platform Data with our subprocessors (e.g., hosting providers) only to the extent necessary to operate the service,
• we process Platform Data in accordance with the Meta Platform Terms and Meta Developer Policies.

Access tokens are stored encrypted in Google Cloud Secret Manager. Access tokens and Platform Data are protected with the security measures described in the "Security" section. What happens to Platform Data when you disconnect an account is described in the section "Disconnecting your account and data deletion".

Data from Google

Zanfia allows you to connect your Google account to use features based on Google technologies, in particular sending conversion events from your store to your own Google Analytics 4 property and connecting your YouTube channel. You can also sign in with your Google account and import files from Google Drive.

Signing in with Google

You can create a Zanfia account and sign in to it with your Google account. If a Creator enables it, their customers can also sign in to the Creator's platform with Google. Signing in uses Google's standard sign-in scopes (openid, email and profile): we receive your Google account identifier, name, email address and profile picture, and use them only to create your account and sign you in. Signing in with Google does not give Zanfia access to any other data in your Google account.

Google Analytics 4

When you connect your Google account to Zanfia, you grant the https://www.googleapis.com/auth/analytics.edit scope, together with the openid and email scopes. Using them, we receive from Google:

• the email address of the connected Google account, used solely as a label so that you can tell your connections apart,
• a list of the Google Analytics properties and web data streams you have access to,
• the measurement ID of the data stream you select.

We use this access only at the moment of connecting, for two purposes: to present you with a list of your properties to choose from, and to create a Measurement Protocol secret on the data stream you select, so that you do not have to generate and paste it yourself.

In particular:

• we do not read your Google Analytics reports or any statistical data held in your property,
• we do not use the OAuth token during normal operation of the service; sending events relies on the Measurement Protocol secret described above,
• we do not sell data obtained from Google APIs, transfer it to data brokers, or use it for advertising purposes of our own or of third parties,
• we do not use data obtained from Google APIs to develop, improve, or train generalised artificial intelligence or machine learning models,
• we share this data with our subprocessors (hosting providers) only to the extent necessary to operate the service.

The refresh token is stored encrypted in Google Cloud Secret Manager and is used solely to allow you to add further properties at a later time. It is protected with the security measures described in the "Security" section.

YouTube

Zanfia uses YouTube API Services. You can connect your YouTube channel to Zanfia to see your channel's statistics, publish videos to YouTube, copy the captions of your videos, and stream live rooms to YouTube. By connecting a YouTube channel you agree to the YouTube Terms of Service. How Google processes your data is described in the Google Privacy Policy.

When you connect a channel, you grant us the following scopes (the last two only when you enable publishing to YouTube):

• https://www.googleapis.com/auth/youtube.readonly - to read your channel's name, handle, thumbnail and subscriber count, and the list of your uploaded videos with their statistics,
• https://www.googleapis.com/auth/yt-analytics.readonly - to show the statistics of your channel and videos (views, watch time, average view duration, subscribers gained and lost),
• https://www.googleapis.com/auth/youtube.upload - to publish to your channel the videos you choose, with the title, description and settings you enter,
• https://www.googleapis.com/auth/youtube.force-ssl - to download the captions you have added to your videos, so that you can copy them as a transcript, and, when you stream a live room to YouTube, to create, start, end and remove the live broadcast Zanfia created for that stream. We do not use this scope to edit or delete your existing videos, comments or playlists.

We store:

• your channel's identifier, name, handle and thumbnail address, and the list of scopes you granted,
• the refresh token, encrypted in Google Cloud Secret Manager; access tokens are created for each request and are not stored,
• your channel's subscriber count, once a week and when you open the statistics, to show how it changes over time,
• for videos you publish and live rooms you stream through Zanfia: the identifier and link of the video or broadcast and the title, description and settings you entered.

We only display, without storing: the list of your videos, YouTube Analytics statistics, and the text of captions (shown so that you can copy it; we do not save it and do not send it to AI models).

We use data obtained from YouTube only to provide you with the features described above. We do not sell it, use it for advertising, or use it to train artificial intelligence models. We share it only with our subprocessors (hosting providers) to the extent necessary to operate the service. If you use the AI Assistant, it may see the name of your connected channel so that it can suggest where to publish a post; a video is published to YouTube by the Assistant only after you approve it.

You can revoke Zanfia's access at any time:

• by disconnecting the channel in your Zanfia account settings - we immediately revoke Zanfia's access at Google, delete the refresh token, and within 7 days delete the other data obtained from YouTube that we store,
• on Google's security settings page at security.google.com/settings/security/permissions - we then delete the data obtained from YouTube within 30 days.

You can also ask us to delete this data, or send any questions about it, to support@zanfia.com; we handle deletion requests within 7 days. Deleting data from Zanfia does not affect videos or data stored on YouTube.

Google Drive

When you choose to import a file from Google Drive, you grant the https://www.googleapis.com/auth/drive.file scope, which gives Zanfia access only to the files you pick in the Google Picker. We copy the selected file to your Zanfia media library and do not access any other files in your Drive.

Zanfia's use of information received from Google APIs adheres to the Google API Services User Data Policy, including the Limited Use requirements.

Data from TikTok

Zanfia allows you to connect your TikTok account to see your own TikTok videos and, if you allow it, your follower count in Zanfia, and to publish videos from your Zanfia media library to your TikTok account. By publishing to TikTok through Zanfia you agree to the TikTok Terms of Service, the Music Usage Confirmation and, for branded content, the Branded Content Policy. How TikTok processes your data is described in the TikTok Privacy Policy.

When you connect your account, you grant us the following scopes:

• user.info.basic - to identify your TikTok account (its open ID),
• video.publish - to read your publishing options (your username, display name and avatar, the privacy levels available to you, whether comments, Duet and Stitch are available, the maximum video length) and to publish to your account the videos you choose, with the caption, privacy level and interaction settings you select,
• video.list - to show the list of your own TikTok videos with their statistics (views, likes, comments),
• user.info.stats, if you grant it - to read the follower count of your account, so that the statistics view in Zanfia can show how your audience changes over time.

We store:

• your TikTok open ID, username, display name and avatar address, and the list of scopes you granted,
• if you granted user.info.stats: the follower count of your account, once a week and when you add a measurement in the statistics view; we store only the number of followers, not data about individual followers,
• the refresh token, encrypted in Google Cloud Secret Manager; access tokens are created when needed and are not stored,
• for videos you publish through Zanfia: the caption, the address of the video file in your Zanfia media library, the publishing status, and the identifier and link of the TikTok post.

We only display, without storing: the list of your TikTok videos and their statistics.

We use data obtained from TikTok only to provide you with the features described above. We do not sell it, use it for advertising, or use it to train artificial intelligence models. We share it only with our subprocessors (hosting providers) to the extent necessary to operate the service. If you use the AI Assistant, it may see the name of your connected TikTok account when it checks which accounts you can publish to.

You can revoke Zanfia's access at any time:

• by disconnecting TikTok in Zanfia (Marketing → Social media) - we immediately revoke Zanfia's access at TikTok and delete the refresh token and the stored account data (open ID, username, display name, avatar address); the records of videos you published through Zanfia and the follower counts recorded in the statistics stay in your Zanfia account until you delete the account or ask us to delete them,
• by removing Zanfia from the apps connected to your account in TikTok's settings - Zanfia then loses access to your account; to delete the data Zanfia stores, also disconnect TikTok in Zanfia or write to support@zanfia.com.

Data from LinkedIn

Zanfia allows you to connect your LinkedIn profile to publish on it the posts you create in Zanfia, right away or on a schedule you set. When you connect your profile, you grant us the following scopes:

• openid, profile and email - to read your LinkedIn member identifier, name and profile picture, so that we can show which profile is connected; LinkedIn also sends us your email address, which we do not store,
• w_member_social - to publish on your profile the posts you create in Zanfia (text and images) and the first comment under a post if you add one, and to delete from LinkedIn a post published through Zanfia when you choose to.

We store:

• your LinkedIn member identifier, name and profile picture address, and the list of scopes you granted,
• the access token, encrypted in Google Cloud Secret Manager, with its expiry date (LinkedIn tokens are valid for about 60 days, after which you reconnect your profile),
• the posts you create in Zanfia (text, images, schedule) and, for published posts, the identifier and link of the post on LinkedIn.

We do not read your LinkedIn feed, contacts, messages or statistics. We use data obtained from LinkedIn only to provide you with the features described above. We do not sell it, use it for advertising, or use it to train artificial intelligence models. If you use the AI Assistant, it can prepare a LinkedIn post for you, and it schedules or publishes it only after you approve it.

You can revoke Zanfia's access at any time by disconnecting LinkedIn in Zanfia (Marketing → Social media) - we then immediately delete the access token and the stored profile data, so Zanfia can no longer publish on your profile - or by removing Zanfia under "Permitted services" in your LinkedIn settings. Posts you created in Zanfia stay in your Zanfia account until you delete them or the account.

Artificial intelligence (AI) features

The Zanfia System includes features based on artificial intelligence, in particular: the AI Assistant for Creators (chat), content generation (pages, offer copy, lessons, quizzes, articles, images), transcription of audio and video recordings, and - if the Creator enables them - assistants answering questions from community members and course participants. AI-created content is labelled as originating from artificial intelligence.

To provide these features we use AI models supplied by external providers (providers of large language models and speech transcription services), acting as our processors. Only the data necessary to handle a given feature is transmitted to the model provider, for example: the content of your conversation with the Assistant together with uploaded files, data from your Zanfia account that you ask the Assistant about (including - if you use such features - data of your customers, of which you remain the controller), the content of a community member's question together with excerpts of course or knowledge-base content, or the audio track of a recording submitted for transcription. Some providers process data on servers located outside the EEA - in such cases we apply the compliance mechanisms described in the section "Transfer of personal data to third countries".

Our current AI providers are Microsoft (Azure AI Foundry: the language and image models behind the AI Assistant, content, page and image generation), OpenAI (text embeddings used to search your content) and Deepgram (transcription of recordings and live dictation; during dictation the audio goes from your browser directly to Deepgram). We may switch a feature to another provider listed in the section "Your data recipients". Text embeddings of your lessons, knowledge-base articles, video transcripts and imported email campaigns are stored in Upstash Vector, and the Assistant memory in Upstash Redis. When you ask us to analyse your brand or a website, we fetch the public website or the public social media profile you indicate using Firecrawl or ScrapeCreators and pass its content to the AI model.

The principles we adhere to:

• we do not use your data to train our own AI models,
• the history of conversations with the Assistant is stored within your account so that you can return to it; you can delete individual threads, and the history is deleted together with your account,
• the Assistant may remember information about your business (Assistant memory) to give more accurate answers - you can disable the memory or clear it at any time in the Assistant settings,
• for billing, statistical, and failure- and abuse-prevention purposes we record metadata of AI feature usage (feature type, model, token counts, cost, response time) - this metadata does not contain conversation content,
• for quality control, safety, and improvement of the AI features we may analyse the content of conversations with the Assistant, including review by authorised members of our team; the legal basis is our legitimate interest (Art. 6(1)(f) GDPR) in ensuring the correctness and safety of the AI features; access is limited to authorised persons bound by confidentiality,
• responses generated by AI are automatic in nature and may contain errors; we do not make any automated decisions based on them that produce legal effects concerning you (Art. 22 GDPR).

Disconnecting your account and data deletion

You can stop the processing of data obtained from Meta, Google, TikTok and LinkedIn at any time and ask us to delete it:

1. disconnect your Facebook Pages, Instagram, Threads, WhatsApp, TikTok or LinkedIn account in Zanfia - we then immediately delete the stored connection and its access token, so Zanfia can no longer access the account; for TikTok we also revoke Zanfia's access at TikTok. Data already saved in your Zanfia account stays there until you delete the account or ask us to delete it: imported and received messages, records of published posts, and the follower counts recorded in the statistics,
2. disconnect your Google account or your YouTube channel in Zanfia - for Google Analytics we then delete the stored token and remove the Measurement Protocol secrets we created in your property; for YouTube we revoke Zanfia's access at Google, delete the refresh token and, within 7 days, the other data obtained from YouTube,
3. remove Zanfia's access in your Facebook settings (Settings & Privacy → Settings → Apps and Websites, or Business Integrations), in your Instagram or Threads settings, or in your TikTok or LinkedIn settings,
4. remove Zanfia's access in your Google account settings at myaccount.google.com/permissions,
5. send a deletion request to support@zanfia.com - we will delete your Platform Data and the other data obtained from these platforms and confirm the deletion within 30 days.

If you remove Zanfia's access in your Facebook, Instagram or Threads settings, or ask Meta to delete your data from Zanfia, Meta notifies us and we delete the stored connection and its access token. To also delete the data already saved in your Zanfia account (messages, records of published posts, follower counts), write to support@zanfia.com.

Cookies and other tracking technologies

Like almost all other websites, our website uses cookies to give you the best browsing experience.

Cookies are small text files stored on your device (e.g. computer, tablet, smartphone) that our IT system can read. Some of the tools described below use similar technologies, such as your browser's local storage.

For more details, please see below.

Consent to the use of cookies

During your first visit to zanfia.com, a cookie banner (CookieYes) informs you about the use of cookies and asks whether or not you agree to analytics and marketing cookies; CookieYes stores your choice in a cookie. We also copy your choice to the zanfia_cc cookie (kept for 1 year), so that our own analytics script on zanfia.com can respect it; this cookie is strictly necessary and is set without consent. You can change your decision at any time in the cookie settings. Furthermore, you can always change the settings of your browser's cookies or clear your cookies. Please note, however, that disabling the cookies may cause difficulties in using the website and many other websites using cookies.

Third party cookies

Like most modern websites, our website uses features provided by third parties, which involves using cookies from third parties. The use of this type of cookies is described below.

Analysis and statistics

On zanfia.com we load Google Tag Manager (Google), which loads the cookie banner and, depending on your cookie settings, the analytics and marketing tools described below.

We use cookies to track website statistics such as the number of visitors, type of operating system and browser used to browse, time spent on the website, subpages visited, etc. To this end, we use Google Analytics, which involves using cookies from Google LLC. Google Analytics stores its cookies only if you agree to analytics cookies in the cookie settings; until you make a choice, or if you refuse, it stores no cookies and receives only cookieless signals about your visit (Google Consent Mode).

zanfia.com also uses Zanfia's own analytics script (the same one Creators can add to their own websites). It records the pages you view in our own Zanfia account. Only if you agree to analytics cookies does it use a random visitor identifier kept in your browser's local storage and a visit identifier kept until you close the tab; without that consent it counts the page view without any identifier.

In the Zanfia panel (app.zanfia.com) we use Google Analytics for Firebase (Google) and PostHog (PostHog's EU cloud) to see how the panel is used. They record the pages you visit and the actions you take in the panel (for example page views and clicks) and, once you log in, link them to your account identifier and email address; PostHog also receives your name and your roles in Zanfia. The panel has no cookie banner of its own; it follows your choice on zanfia.com. Only after you agree to analytics cookies there do these tools store cookies and data in your browser and link your activity to your account identifier, email address and name. Until then PostHog records your use of the panel without cookies and without linking it to you, and Google Analytics for Firebase does not run.

Marketing

On zanfia.com we use marketing tools, the Meta (Facebook) Pixel and Google Ads, to measure our ads and target ads to you. This involves cookies from Meta and Google. Under the cookie settings, you can decide whether or not you agree to our use of these tools in your case; they load only if you agree to marketing cookies.

In the Zanfia panel, our Meta Pixel loads only if you accepted marketing cookies on zanfia.com; it records the registration of a new Creator account.

Our attribution cookies

When you come to zanfia.com, we save in cookies where your visit came from, so that when you create a Zanfia account we can attribute it to the campaign, ad or partner that brought you.

We save zanfia_acquisition, _zanfia_attr and _fbc only if you agree to marketing cookies in the cookie settings. The partner code from a referral link (zanfia_referral_code, zanfia_ref) is saved without that consent, because it is strictly necessary to credit the referral link you chose to follow (and the partner's commission); it contains no tracking identifiers and is not shared with anyone.

When you create a Zanfia account, we save the data of your first visit with your account; if you came through a partner's referral link, we also record your email address with the partner's code.

Cookies and tracking on creators' sites

On the sites, stores and checkouts that creators run on Zanfia, the creator decides which analytics and advertising tools (for example Meta Pixel and Conversions API, Google Analytics, Google Tag Manager, TikTok, X, LinkedIn, Microsoft Clarity or Hotjar) are connected, and is the controller of the visitors' and buyers' data these tools process. Zanfia processes this data on the creator's behalf, as a processor. When a creator connects any such tool, Zanfia shows a cookie consent banner on their site by default, and the tools' scripts load in the visitor's browser only after the visitor agrees. A purchase may still be reported to the creator's advertising account from our servers, unless the buyer refused marketing cookies. A creator who collects consent with their own tool may turn our banner off and is then responsible for obtaining that consent.

Error monitoring and session recording

We use Sentry, a tool provided by Functional Software, Inc. (USA), to monitor technical errors in our applications. In connection with error handling, Sentry processes technical information such as your browser and operating system type, IP address, and the details of the error that occurred.

Additionally, for creator accounts created within the last 7 days, we use PostHog Session Replay, a tool provided by PostHog, Inc. (USA), to record how new users interact with the creator admin panel. We use PostHog's EU cloud, so recordings are processed and stored on servers located in the European Union. The recording covers clicks, scrolls, and navigation between pages. All text you type or view is masked, and all images and media are blocked before the recording leaves your browser - the recording therefore contains neither your content nor your customers' personal or payment data. We use these recordings to improve the first-run experience of our platform and to diagnose errors, on the basis of your consent to analytics cookies on zanfia.com (Article 6(1)(a) of the GDPR). Recordings are stored by PostHog for up to 90 days.

Functional Software, Inc. is certified under the EU-U.S. Data Privacy Framework, which ensures an adequate level of protection for data transferred to the USA (see also the section "Transfer of personal data to third countries" above).

Server logs

Using the website involves sending queries to the server that hosts the website. Each query sent to the server is recorded in server logs and stored.

The logs include, among the others, your IP address, date and time of the server, the information on the Internet browser and operating system you use. The logs are recorded and stored on the server.

The data stored in the server logs are not associated with specific website users and are not used to identify you.

The server logs constitute solely auxiliary material used to manage the website, and their content is not disclosed to anyone except persons authorised to manage the server.

Amendments to the Privacy Policy

Our Privacy Policy may be supplemented or amended, as we will inform you of this by a post on the website. In the event of material changes, the customers having accounts at Zanfia or subscribed to the newsletter will be sent separate email notices.

If you have any concerns or questions about the processing of your personal data, please email us at: support@zanfia.com.