Privacy Policy for ZehnAI

Effective date: May 21, 2026

This Privacy Policy describes how ZehnAI ("ZehnAI", "we", "us") collects, uses, and shares information when you use the ZehnAI mobile application (the "App"). By using the App, you agree to the practices described here.

1. Information We Collect

We collect only the information needed to operate the App:

• Study content you upload (e.g., documents, images, notes, or other study materials) that you submit so the App can process it with AI and return results to you.
• Subscription and purchase information handled by RevenueCat and the Apple App Store (such as your subscription status and transaction identifiers). We do not collect or store your payment card details; these are processed by Apple.
• Basic technical information needed to deliver requests, such as your IP address and request metadata, used transiently for rate-limiting, abuse prevention, and debugging.

We do not sell your personal information, and we do not use it for advertising.

2. How Your Content Is Processed

When you upload study content, the App sends that content to Google's Gemini API for AI processing. The processed result is returned to your device and stored locally on your phone (for example, in the App's local storage). We do not save your uploaded study content or AI responses in our own database after processing.

Google's handling of data sent to Gemini is governed by Google's own privacy and API terms. Please review Google's Privacy Policy for details.

3. How We Use Information

• To provide the App's core features (processing your study content with AI and returning results).
• To manage your subscription and entitlements via RevenueCat and the Apple App Store.
• To monitor for abuse, enforce usage limits, fix bugs, and keep the service secure and reliable.

4. Third-Party Services

We share limited information with the following service providers strictly to operate the App:

• Google Gemini API — processes the study content you submit. Content is sent over a secure connection and is not retained by us after the response is returned.
• RevenueCat — manages in-app subscriptions on top of Apple App Store purchases.
• Apple App Store — processes payments and delivers the App.
• Railway — hosts the App's backend infrastructure.

5. Data Retention

Uploaded study content is processed in transit and is not persisted in our databases. Subscription records and minimal account identifiers are retained for as long as your account or subscription is active, and afterwards only as required to comply with legal, accounting, or fraud-prevention obligations.

6. Data Security

We use industry-standard measures, including encryption in transit (HTTPS), to protect information handled by the App. No method of transmission or storage is 100% secure, so we cannot guarantee absolute security.

7. Children's Privacy

The App is not directed to children under 13 (or under 16 in jurisdictions where that is the applicable minimum, such as parts of the EU/EEA). We do not knowingly collect personal information from children below the applicable age. If you believe a child has provided us with personal information, please contact us so we can remove it.

8. Your Choices and Rights

• You can stop using the App at any time and uninstall it from your device, which removes the study content stored in the App's local storage.
• You can manage or cancel your subscription through your Apple ID settings.
• You may contact us to request access to, correction of, or deletion of any account-level data we hold about you, subject to legal retention requirements.

9. Rights for Users in the European Economic Area, United Kingdom, and Switzerland (GDPR / UK GDPR)

If you are located in the EEA, the UK, or Switzerland, you have the following rights regarding your personal data:

• Right of access, rectification, and erasure of your personal data.
• Right to restrict or object to processing.
• Right to data portability.
• Right to withdraw consent where processing is based on consent.
• Right to lodge a complaint with your local data protection authority.

Our legal bases for processing are: performance of a contract (to provide the App and your subscription), legitimate interests (to keep the service secure, debug, and prevent abuse), consent (where required), and compliance with legal obligations. For data processor relationships (e.g., transfers to Google for AI processing), we rely on the providers' contractual safeguards, including Standard Contractual Clauses where applicable.

10. Rights for Users in California (CCPA / CPRA)

If you are a California resident, you have the right to:

• Know what personal information we collect, use, and disclose.
• Request deletion of your personal information.
• Request correction of inaccurate personal information.
• Opt out of the "sale" or "sharing" of personal information — we do not sell or share personal information as defined under the CCPA/CPRA.
• Not be discriminated against for exercising your privacy rights.

11. Rights for Other Jurisdictions

We aim to honor equivalent privacy rights for users worldwide, including under laws such as Canada's PIPEDA, Brazil's LGPD, Australia's Privacy Act, South Korea's PIPA, Japan's APPI, and similar frameworks. To exercise any of these rights, contact us using the details in Section 14.

12. International Data Transfers

ZehnAI is available globally. Our backend is hosted on Railway, and content is processed by Google's Gemini API. Your information may be transferred to and processed in countries other than your own, including the United States. Where required by law, we rely on appropriate safeguards (such as Standard Contractual Clauses or equivalent mechanisms) for international transfers.

13. Changes to This Policy

We may update this Privacy Policy from time to time. When we do, we will update the "Effective date" above and post the new version at this URL. Material changes will be communicated through the App where appropriate.

14. Contact

If you have questions about this Privacy Policy or your data, contact:

ZehnAI
Email: rakhmatullaevulmas@gmail.com
Policy URL: https://web-production-dbe39.up.railway.app/privacy