Privacy Policy

1. Who we are (data controller)

Zintus is operated by YS Ventures LLC, based in Pittsburgh, Pennsylvania, USA. For any privacy question or request, contact privacy@zintus.ai.

Data Protection Officer / EU representative: Not currently appointed. As a small business we believe a DPO is not mandatory, and we have not yet appointed an EU/UK representative under GDPR Art. 27. [To confirm with counsel; appoint if required].

2. What we collect

• Account email — if you create an account, so we can identify you, send sign-in / transactional email, and reach you about your subscription.
• Billing data — handled by our payment processor, Stripe. We do not store your full card number; Stripe does. We keep the subscription tier, status, and billing-period metadata needed to run your plan.
• Relay usage metadata / logs — if you use the optional cloud relay, we process operational metadata (timestamps, request counts, token totals, error states, the provider routed to) to enforce quotas, debug, and prevent abuse.

3. What we do NOT collect on the BYOK local path

When you run Zintus locally with your own keys, the local gateway binds to loopback (127.0.0.1) by default and talks to AI providers directly. On that path:

• Your prompts and completions never touch Zintus servers — they go from your machine straight to the provider.
• Your API keys stay on your machine — in your OS keychain (CLI / desktop / mobile) or encrypted in your browser (AES-256-GCM + PBKDF2). We never receive them.

When you use the optional cloud relay in BYOK mode, the relay is zero-knowledge: it forwards opaque ciphertext and cannot read your keys or your prompts. A managed-keys tier (where Zintus would hold provider keys for you) is not currently available; it is planned only as a possible future option and is described as such throughout this policy.

4. Legal basis for processing (GDPR Art. 6)

Where the GDPR applies, we rely on the following legal bases:

• Account email — performance of a contract (providing the account you asked for) and our legitimate interest in account security.
• Billing data — performance of a contract and compliance with legal/tax obligations.
• Relay usage metadata / logs — our legitimate interest in operating, securing, and debugging the service and preventing abuse.
• Any optional marketing email — your consent, which you may withdraw at any time.

5. How long we keep things (retention)

• Relay usage logs / connection state — [Retention period — to be finalized by legal; not yet set].
• Account & billing records — kept for the life of your account, plus any period required to retain financial records for tax and legal compliance after closure: [Retention period — to be finalized by legal; not yet set].

6. Your rights (GDPR)

If the GDPR applies to you, you have the right to:

• Access — get a copy of the personal data we hold about you;
• Rectification — correct inaccurate or incomplete data;
• Erasure— ask us to delete your data (“right to be forgotten”), subject to legal retention requirements;
• Restriction — ask us to limit how we process your data;
• Objection — object to processing based on legitimate interest;
• Portability — receive your data in a portable, machine-readable format;
• Withdraw consent — at any time, where we rely on consent.

To exercise any of these, email privacy@zintus.ai. You also have the right to lodge a complaint with your data protection supervisory authority (for example, your national or state DPA in the EU/UK).

7. California privacy rights (CCPA / CPRA)

If you are a California resident, the following applies. In the past 12 months we have collected these statutory categories of personal information:

• Identifiers — account email (and account identifiers).
• Commercial information — subscription tier and billing status (payment card details are processed by Stripe, not stored by us).
• Internet / network activity — relay usage metadata and logs (request counts, timestamps, token totals, error states).

We do not sell or share your personal information (as “sell” and “share” are defined under the CCPA/CPRA), and we have not done so in the past 12 months.

As a California resident you have the right to know, delete, and correct your personal information, to opt out of sale/sharing (not applicable, since we do neither), and to non-discrimination for exercising these rights. To make a request, email privacy@zintus.ai. You may use an authorized agent; we will take reasonable steps to verify your identity (and your agent's authority) before fulfilling a request.

8. Sub-processors

We rely on a small set of vendors to operate the service:

• Cloudflare — edge hosting for the relay and key-validation workers. Location: global edge (US and other regions).
• Stripe — payment processing and subscription billing. Location: USA / global.
• Resend — transactional email (sign-in, billing notices). Location: USA / global.
• Vercel — hosting for this website. Location: USA / global.

The AI providers you route to (when you supply your own keys) are independent services governed by their own privacy terms — see the Terms page.

9. International data transfers

Our sub-processors (Cloudflare, Stripe, Resend, Vercel) operate in the United States and other countries, so using the hosted services may involve transferring personal data outside your home country, including to the US. Where required, such transfers rely on an appropriate safeguard such as the EU Standard Contractual Clauses (SCCs) or an adequacy mechanism: [Transfer mechanism (e.g. SCCs / adequacy) — to confirm with counsel and each sub-processor].

10. Changes to this policy

This is a DRAFT pending legal review. Once finalized, we will notify you of material changes (for example by email to your account address or a notice on this page) and update the “last updated” date before the change takes effect. Questions: privacy@zintus.ai.