Privacy Policy
Last updated: 10 August 2026
Draft — needs review before launch. This document still needs your registered business name, contact address, and jurisdiction filling in, and should be reviewed by a lawyer before you take real payments.
What we collect
We collect only what the product needs to work:
- Account details — your name and email address. Your password is hashed by our authentication provider and is never visible to us.
- Creator profile — the answers you give during onboarding: your stage, niche, platforms, goals, and challenges.
- Content data — the handles, follower counts, post titles, and performance numbers you enter or that we retrieve from a platform you connect.
- Usage data — your audits, coach conversations, saved items, and credit history.
- Billing data — held by Stripe. We store only a customer reference and your subscription status. We never see or store your card number.
How we use it
We use your data to provide the service, generate your analysis and coaching, process payments, send you service emails, and support you when you get in touch. We do not sell your personal information.
AI processing
To generate your reports and coach replies, we send relevant parts of your profile and content data to Anthropic, our AI provider. This is required for the product to function. Your data is not used to train AI models.
Who we share it with
We use a small number of processors, each for a specific purpose:
- Supabase — database hosting and authentication
- Anthropic — AI analysis and coaching
- Stripe — payment processing
- Resend — sending emails
- Vercel — application hosting
We may also disclose data where the law requires it, or to protect our rights or the safety of others.
Connected platforms
If you connect a platform such as YouTube, we store an encrypted access token so we can retrieve your analytics. We request only read access. You can disconnect at any time from your settings, and we delete the stored tokens when you do.
How long we keep it
We keep your data for as long as your account is open. If you close your account, we delete your personal data within 30 days, except where we are legally required to keep records — for example, invoices for tax purposes.
Your rights
Depending on where you live, you may have the right to access, correct, export, or delete your personal data, to object to certain processing, and to withdraw consent. To exercise any of these, email us from the address on your account and we will respond within 30 days.
Security
Data is encrypted in transit and at rest. Access is isolated at the database level, so one user's data cannot be read by another. OAuth tokens are encrypted before storage. No system is perfectly secure, but we take this seriously and design accordingly.
Cookies
We use cookies that are strictly necessary to keep you signed in and to keep the service secure. We do not use advertising cookies or third-party tracking.
Children
ZMF Media is not intended for anyone under 16. We do not knowingly collect data from children. If you believe a child has given us data, contact us and we will delete it.
International transfers
Our providers may process data in countries other than yours, including the United States. Where required, appropriate safeguards are in place for those transfers.
Changes
If we make a material change to this policy we will tell you by email or in the app before it takes effect.
Contact
For any privacy question, or to exercise your rights, email the support address listed on our website.