Privacy policy

This explains what personal data Zalmox collects, why, and what you can do about it. The controller is Theory Nexus LLC. Contact: support@zalmox.io.

What we collect

• Account: your email address, password (stored as a verifier by our sign-in provider, never in plain text) and your authenticator-app pairing. If you sign in with Google, we receive your email address and Google's identifier for your account from Google, and nothing else; we never see your Google password.
• What you create: images you upload, prompts and settings, generated assets, and job history.
• What is public: for a creation that is public (one made without paying, or one you chose to share), anyone can see its preview picture in the gallery, the kind of thing it is, when it was made, and the display name you chose, if any. Nothing else about you or the creation is shown, and you can make it private or delete it; see the Terms for which creations are public. If you report a creation, we keep the report and, when you are signed in, that it came from you.
• Credits and billing: your credit balance and history, your plan, and the identifiers Paddle gives us for your customer account and subscription. We never see or store your card details; Paddle collects them.
• Technical: IP address, browser details and request logs, kept for security and troubleshooting.
• Your machines (if you use the Zalmox Runner): the name you give each paired machine, its GPU model and memory, the runner version, its host name, its setup progress, when it was last online and its IP address. To run your jobs, the runner downloads their inputs to your machine and uploads the results to your library. It doesn't send us anything else from your computer.

Why we use it

• To provide the service: run your generations, store and show your assets, and keep track of credits (performance of our contract with you).
• To secure accounts and prevent abuse and fraud (our legitimate interests).
• To handle payments, taxes and accounting through Paddle (contract and legal obligations).
• To send you service emails: sign-in, security, billing and important changes. We don't send marketing without asking.
• To understand how the service is used and what it earns, we keep our own record of sign-ups, completed generations and purchases (the amount, tax and plan, never card details), tied to a scrambled account number, in a system we run ourselves. It never includes your prompts, files or contact details (our legitimate interests).

We don't sell your data, we don't use your uploads or outputs to train models, and we don't use advertising trackers.

Who processes it for us

• Amazon Web Services (United States): account sign-in (Cognito) and email delivery (SES).
• Google (United States): confirms who you are, only if you choose "Continue with Google". Google is an independent controller for your Google account.
• Hetzner Online (servers in the United States): hosting of the app, database and your files.
• Paddle.com (United Kingdom): payments, as merchant of record. Paddle is an independent controller for the payment data it collects; see Paddle's privacy policy.
• Our GPU provider, when generations run on rented GPUs: it processes your inputs only to produce the outputs.

Some of these providers are outside your country. Where the law requires it, transfers rely on safeguards such as the EU Standard Contractual Clauses.

How long we keep it

• Your assets and job history: until you delete them or close your account.
• Paired machines: until you remove them or close your account.
• Account data: while your account exists, then deleted within 30 days.
• Credit and billing records: as long as tax and accounting law requires (typically up to 10 years).
• Database backups: 14 days. Request logs: up to 90 days.

Your rights

Depending on where you live (for example under the GDPR or UK GDPR), you can ask to access, correct, delete or export your data, object to or restrict some processing, and complain to your data protection authority. Write to support@zalmox.io; we'll answer within a month.

Cookies and storage

We use only what the app needs to work: your sign-in session and a few preferences (such as the quality tier you chose) kept in your browser's storage. The checkout, provided by Paddle, sets its own strictly necessary cookies to process payments. There are no analytics or advertising cookies.

Children

Zalmox isn't meant for children under 16, and we don't knowingly collect their data.

Changes

We'll post changes here and update the date above, and email you about significant ones.