Privacy Policy

ZynPost is operated by ZYNPOST LTD, a company registered in England and Wales (company number 17177491), registered office at Flat 6 Shaw House, 72 Quiller Avenue, Arborfield Green, Reading, England, RG2 9TZ.

Contact: support@zynpost.co.uk

ZYNPOST LTD is the data controller for personal data we process, under UK GDPR and, where applicable to you, other data protection frameworks described in Section 14.

• Account data: name, email, hashed password
• Business profile data: business name, type, model, contact details, logo, brand voice, content preferences, and business country/region
• Social media content: captions, images, videos, prompts and creative direction, and content generated on your behalf
• Usage data: how you interact with the platform, posts created, platforms published to, features used
• Payment data: billing details processed through Stripe (PCI DSS Level 1 provider); we do not store full card numbers
• Device and browser data: IP address, browser type, OS, device type
• Cookies: essential cookies for login and session security

Directly from you (signup, profile, posts, purchases); automatically (usage/device data via essential cookies and server logs); and from connected third-party platforms (Facebook, Instagram, TikTok, LinkedIn) when you authorise a connection.

We process personal data on the following legal bases: performance of a contract, legitimate interests, consent (where required), and legal obligation. We use data to provide and improve the service, process payments, publish content on your behalf, generate AI content, send service emails, and prevent fraud and abuse.

• Captions:generated by OpenAI's GPT models. Your prompt, creative direction, and relevant business context are sent to OpenAI.
• Images: generated by fal.ai (Nano Banana 2). Prompt text and reference images/logos are sent to fal.ai.
• Videos: generated by fal.ai (Kling v3 Pro). Prompt text and uploaded frames are sent to fal.ai.

These providers process data solely to return generated content and do not use your prompts or media to train their models under our agreements. We never send your name, email, password, or payment information to any AI provider.

Supabase, Cloudinary, Stripe, OpenAI, fal.ai, Vercel, Inngest, and the social platforms you connect (Facebook, Instagram, TikTok, LinkedIn), each processing data only on our instructions under a data processing agreement. Some are based outside the UK/EEA; where applicable we rely on the UK International Data Transfer Agreement, EU Standard Contractual Clauses, or an equivalent legal mechanism.

We only access connected accounts to publish content you've approved. We never post, delete, read, or modify anything else. Access tokens are encrypted at rest and only decrypted at time of publishing. You can disconnect any account at any time from the Analytics page, or from the platform's own settings.

Data is stored in a Supabase database hosted in the EU/UK region. We use TLS 1.2+ in transit, AES-256 at rest, bcrypt password hashing, encrypted access tokens, and row-level security. We never sell your personal data or share it for marketing purposes.

• Account data: retained while active, up to 30 days after deletion
• Media: retained 24 months from creation unless pinned; reminders sent 30/7 days before expiry
• Payment records: retained by Stripe for 7 years for tax/AML compliance
• Support emails: up to 2 years

Depending on your country of residence, you may have rights including access, rectification, erasure, restriction of processing, data portability, and objection to processing. This includes:

• UK/EEA residents: rights under UK GDPR / EU GDPR
• California residents: rights under the California Consumer Privacy Act (CCPA), including the right to know what personal information is collected and the right to request deletion. We do not sell personal information.
• Other jurisdictions: we will honour equivalent rights available to you under your local data protection law to the extent reasonably practicable.

To exercise any rights, email support@zynpost.co.uk. We will respond within 30 days (or the timeframe required by your local law if shorter) and may need to verify your identity.

Only essential cookies are used, required for login and session security. We do not use advertising cookies, tracking pixels, or third-party analytics cookies. Vercel Analytics/Speed Insights are used for performance monitoring and do not set cookies or track individuals.

ZynPost is not intended for anyone under 18, or under the age of majority in your jurisdiction if higher. We do not knowingly collect data from minors. Contact support@zynpost.co.uk if you believe we have.

Material changes will be notified to registered users by email at least 14 days before taking effect.

ZynPost is operated from the United Kingdom. Personal data is primarily processed under UK GDPR and the UK Data Protection Act 2018, with servers and sub-processors located primarily in the UK and EEA.

If you access ZynPost from outside the UK:

• Your data will be transferred to, stored in, and processed in the United Kingdom and/or the European Union.
• We rely on the UK International Data Transfer Agreement, EU Standard Contractual Clauses, or an equivalent legal mechanism for these transfers.
• Depending on your country, additional local data protection rights may apply to you (see Section 10), and we will make reasonable efforts to honour them alongside our UK GDPR obligations.
• Some countries maintain data localisation requirements that may restrict processing of certain data types (including biometric data — see Section 15) outside their borders. If your local law restricts this, please do not use the affected feature, or contact us before doing so.

By using ZynPost from outside the UK, you acknowledge this cross-border processing arrangement.

If you upload face reference photos, we collect and store this biometric data solely to generate AI images featuring your likeness.

• Purpose: AI image generation only
• Storage: Cloudinary servers
• Retention: deleted immediately on removal from Settings, account deletion, or automatically after 90 days of inactivity
• Consent: explicit consent required before upload; withdrawable at any time
• Sharing: never shared with third parties beyond the AI image generation service (fal.ai) as part of the generation request

Biometric data laws vary significantly by country and can carry strict consent, storage, or localisation requirements (for example, certain US states, and various other jurisdictions including the UAE). It is your responsibility to confirm you are legally able to consent to this processing under your local law before using this feature. If in doubt, do not upload face reference photos.

Email support@zynpost.co.uk for any questions or data requests. UK/EEA residents have the right to lodge a complaint with the UK Information Commissioner's Office (ico.org.uk, 0303 123 1113) or their relevant local supervisory authority.