> Translation notice: This English text is a non-binding translation of the Chinese version. In the event of any discrepancy or ambiguity, the Chinese version controls.
Version: 2026-10-20
Effective Date: October 20, 2026
Provider: ZealTop OÜ ("we", "us")
| Field | Value |
|---|---|
| Data Controller (GDPR term) | ZealTop OÜ |
| Registered Address | Harju maakond, Tallinn, Kesklinna linnaosa, Ahtri tn 12, 15551, Estonia |
| Registry Code | 17367911 |
| Contact Email | www.zeal.top@gmail.com |
| DPO (Data Protection Officer) | Not currently designated (current processing does not fall under the cases in GDPR Art.37 that require one) |
| Type | Scope |
|---|---|
| Account info | Email, nickname, avatar URL |
| Third-party OAuth | Google-provided email + sub (unique ID); no passwords stored |
| Profile additions | Bio, remarks you fill in |
| Content | Text, images, audio, video, file attachments, knowledge-base content, AI prompts/conversation history you upload |
| Developer info | If you register as a developer: your Stripe Connect Express account ID, plus the payout account country, entity type (individual / company), legal name (company name or personal name), and tax ID that you choose during payout setup or that Stripe syncs to us |
| Location (only if you choose) | Location sharing (off by default; turn it on or off in Settings): your device's current location — coordinates rounded to 4 decimal places (about 10 m) plus the city / region / country derived from them — is attached to the messages you send in conversations with AI assistants. Sending a location: the place you pick in a chat (coordinates, name, address) is sent as a chat message |
Location shared automatically is passed to the assistant's model for that reply only and is not saved in your chat history. A location you send as a message is stored like any other message and is visible to the members of that conversation. To turn coordinates into a city or address, and to show and search the map, your device contacts the location services listed in §5 directly.
| Type | Scope |
|---|---|
| Device/client | User-Agent, device ID, browser version |
| Logs | IP, login times, accessed URLs, error logs |
| Usage | Browsing history, AI Token consumption, voice transcription duration, web-search and tool-call counts, subscription records |
| Payment events | Stripe order ID, amount, currency, payment time (Stripe stores card data; we only store order metadata) |
| Purpose | Legal Basis |
|---|---|
| Service provision, order fulfillment | Art.6(1)(b) Contract necessity |
| Account security, anti-fraud | Art.6(1)(f) Legitimate interest |
| Customer support | Art.6(1)(b) Contract necessity |
| Location sharing (optional) | Art.6(1)(a) Consent (turn it off in Settings at any time) |
| Marketing emails (not currently sent; consent will be asked separately before any are sent) | Art.6(1)(a) Consent (revocable) |
| Legal obligations (tax, KYC) | Art.6(1)(c) Legal obligation |
| Severe violation / regulatory referral | Art.6(1)(c) + (e) Law / public interest |
AI content moderation uses OpenAI Moderation API; we transmit only required moderation fields, no identifiable personal data. Voice transcription, web search and AI tool execution are part of the service itself, based on Art.6(1)(b) contractual necessity.
We use your personal data to:
We will NOT:
To provide service, we share necessary data with the following categories of third parties:
| Category | Third Party | Shared Data | Purpose |
|---|---|---|---|
| Payments | Stripe Inc. (US) | email, name, order metadata, IP | Payment processing, fraud detection, Connect account management |
| LLM inference | Model services configured by the model's owner (you, the assistant developer, or another developer whose model the assistant borrows; a commercial API provider, or a server / personal device operated by the developer — see 5.2) | Conversation content (anonymized user_id); your location, if you turned on location sharing | AI inference (endpoint chosen by the configuring party) |
| Voice transcription | Groq Inc. (US, primary), OpenAI (fallback) | Voice input audio | Speech-to-text |
| Web search | Tavily Inc. (US) | Search query terms | webSearch built-in tool |
| Content moderation | OpenAI Inc. (US) | Text/image URLs to be moderated | Moderation API |
| Cloud infrastructure | Google Cloud Platform (primarily Singapore region) | All data (encrypted storage) | GKE / Cloud SQL / Pub/Sub / Secret Manager / logging |
| File storage & delivery | Cloudflare Inc. (global edge) | Files and attachments you upload (R2 object storage), frontend static assets | R2 / Pages / CDN / origin protection |
| Code execution | Cloudflare Inc. (Workers) | Hosted-tool call inputs and runtime logs (code-execution processor only, no long-term business data storage, see 5.1) | Workers for Platforms |
| Human verification | Cloudflare Turnstile | Device and browser signals | Abuse prevention (login / guest entry) |
| Location lookup | BigDataCloud Pty Ltd (Australia, primary), OpenStreetMap Foundation Nominatim (UK, fallback) | Coordinates of your device or of the place you pick, place names you search for, your IP address (requested directly from your device) | Turning coordinates into a city / address; place search when sending a location |
| Maps | OpenStreetMap Foundation map tile servers (UK) | The map area you view, your IP address (requested directly from your device) | Showing the map when you send a location |
| Push notifications | Google Firebase (FCM) | Device push tokens, notification content | Mobile / web push |
| Email notifications | Resend (primary) and other email providers | Email, notification content | System notifications |
| Regulatory / judicial | Government bodies (per legal requirement) | Necessary data | Compliance |
Assistants may mount tools provided by developers. When you use such an assistant:
We do not operate our own model inference. The model endpoint an assistant uses is supplied by the owner of that model: usually the assistant's developer, or — if the developer has borrowed the model from another developer's assistant — that other developer. Every turn of your conversation with that assistant is sent to that endpoint. The endpoint may be:
We do not control how the endpoint stores or uses this content. Model endpoints owned by official platform assistants are configured by ZealTop OÜ; if an official assistant borrows a model or tool from another developer, the corresponding conversation content and tool arguments go directly to that developer, whose endpoint is not configured by ZealTop OÜ.
Which assistant you talk to is your choice; an assistant's detail page lists the models and tools it mounts, who configured each one, and links to each item's owner profile.
Due to deployment on GCP, Cloudflare and Stripe, some data transfers outside the European Economic Area (EEA):
If you have concerns about international transfers, please contact us for details.
| Type | Retention |
|---|---|
| Account info | Account lifetime; anonymized when you delete your account |
| Order / payment records | 7 years (EE Commercial Code + Tax Act requirement) |
| Chat history / AI conversations | Until you delete it, at most for the lifetime of your account (the messages you sent are deleted when you delete your account); the AI reasoning details shown alongside replies are removed after 7 days |
| Chat attachments / tool-produced files | 7 days (hard cleanup) |
| Hosted-tool data (rows and files) | For the lifetime of the tool; you can delete yours at any time; reclaimed within 7 days after the tool is deleted |
| Hosted-tool runtime logs | 3 days |
| Usage statistics (token consumption, tool-call counts, etc.) | 180 days |
| Logs | 90 days (rolling) |
| Violation records | 180 days (records from the most recent 30 days count toward the automatic-ban threshold) |
| Agreement acceptance records (which versions you accepted and when) | Kept after account deletion as evidence of consent |
As a data subject, you have the right to:
| Right | Description | How to Exercise |
|---|---|---|
| Access Art.15 | Get a copy of data we process about you | Contact support |
| Rectification Art.16 | Correct inaccurate data | Settings page / support |
| Erasure ("right to be forgotten") Art.17 | Delete your data (subject to legal retention: orders/tax records for 7 years) | Settings → Delete Account (self-service) |
| Restrict processing Art.18 | Pause certain processing | Support |
| Data portability Art.20 | Get structured data export (JSON) | Support |
| Object Art.21 | Object to legitimate interest processing | Support |
| Withdraw consent Art.7(3) | Applies only to optional consent-based processing (currently: location sharing). The Terms of Service constitute a contract and cannot be unilaterally withdrawn; to terminate the relationship, use Account Deletion | Location sharing: turn it off in Settings; any optional consent-based processing introduced later (e.g., marketing emails) will get its own toggle in Settings |
| Lodge complaint Art.77 | File complaint with DPA | Estonia Andmekaitse Inspektsioon (AKI) |
We commit to responding to reasonable requests within 30 days.
We do NOT use: advertising cookies, analytics cookies, cross-site tracking.
If we later introduce any cookie or similar technology that is not strictly necessary, we will ask for your consent first (EU ePrivacy requirement).
The Platform is not directed at users under 18. Accounts found to be minors will be deleted upon confirmation.
Guardians who discover unauthorized registration by a child should contact support for removal.
We implement industry-standard measures to protect your data:
However, no system is 100% secure. In the event of a data breach, we will notify regulators and affected users within 72 hours per GDPR Art.33/34.
The Platform uses AI / algorithms for:
If such decisions have significant impact on you (e.g., account ban), you have the right to:
13.1 We may modify this Policy in response to legal changes or business adjustments. Material changes will be communicated via login interception + email.
13.2 The current version of this Policy is always available in the app and on our website. In Settings you can see which versions of the Terms of Service and of this Policy you have accepted, and when.
End of Policy