Privacy Policy

1. Data we collect

• Account data: your name, email address and password. We store the password only as a secure one-way hash — we cannot see it.
• Usage data: credit purchases and spending, your subscription plan, and the content you generate in the AI Studio (prompts, selected formats and outputs).
• Payment data: when online payments are enabled, payments are handled by our payment provider (Stripe). We receive confirmation of the payment and limited details such as the amount and the last digits of the card — never your full card number.
• Communications: messages you send us by email or WhatsApp.
• Technical data: IP address, browser type and request logs, collected automatically by our hosting provider for security and to keep the service running.
• Cookies: only the strictly necessary cookies described in our Cookie Policy. We do not use advertising or analytics cookies.

We do not knowingly collect data from children under 18.

2. Why we use it and our legal basis

• To create and run your account, provide the AI Studio, manage credits and subscriptions and give you support — necessary to perform our contract with you (GDPR art. 6(1)(b)).
• To process payments, issue invoices and keep accounting records — to comply with legal obligations (art. 6(1)(c)).
• To keep the Services secure, prevent abuse (for example multiple accounts created to collect free credits) and improve them — our legitimate interests (art. 6(1)(f)).
• To send you service messages (for example about your account, payments or changes to our terms) — contract and legitimate interests.
• To send you marketing emails — only with your consent, which you can withdraw at any time (art. 6(1)(a)).

We do not sell your personal data and we do not use your prompts or generated content to train AI models.

3. Who we share it with

We share personal data only with service providers that help us run the Services and that are bound by contract to protect it:

• Vercel Inc. — website and application hosting.
• Neon (Databricks, Inc.) — database hosting.
• Stripe — payment processing (when online payments are enabled).
• Third-party AI providers — when the AI engine is connected, your prompts and uploaded materials are sent to the provider that generates the content. We will list these providers here before they are used.
• Meta (WhatsApp) — only if you choose to contact us on WhatsApp.

We may also disclose data where required by law or by a competent authority, or to protect our rights.

4. International transfers

Zooka is based in the United Arab Emirates and some of our providers are located in the United States or elsewhere. When personal data of people in the EU is transferred outside the European Economic Area, we rely on appropriate safeguards such as the European Commission's Standard Contractual Clauses or the EU–US Data Privacy Framework, as applicable to each provider.

5. How long we keep it

• Account data and generated content: for as long as your account is open. When you close your account we delete it within 30 days, except as stated below.
• Payment and invoicing records: for the period required by UAE and other applicable tax and accounting laws.
• Security logs: for a limited period, normally no longer than 90 days.
• Messages: as long as needed to handle your request, and then for a reasonable period in case of follow-up questions.

6. Your rights

Depending on where you live, you have the right to:

• access the personal data we hold about you and receive a copy;
• have inaccurate data corrected;
• have your data deleted;
• restrict or object to certain processing, including processing based on legitimate interests;
• receive your data in a portable format;
• withdraw consent at any time, without affecting earlier processing.

To exercise these rights, email zookamarketingfze@gmail.com. We will reply within one month. We may need to verify your identity first.

If you are in the EU, you also have the right to complain to a data protection authority — in Romania, the National Supervisory Authority for Personal Data Processing (ANSPDCP, www.dataprotection.ro). In the UAE you may contact the UAE Data Office.

7. Security

We use encrypted connections (HTTPS), hashed passwords, secure session cookies and access controls. No system is completely secure, but we work to protect your data and will notify you and the authorities of a data breach where the law requires it.

8. Changes

We may update this policy. The date at the top shows the latest version. We will notify registered users of material changes.

9. Contact

Zooka Marketing FZE LLC · Amber Gem Tower, 26th Floor, Ajman, United Arab Emirates · Email: zookamarketingfze@gmail.com