Privacy Policy

1. General Information

1. We are A. Dzans Zenith, a private company in Switzerland and have our office at Dangelweg 1, 8038 Zurich, Switzerland.

2. Your use of our Services is subject to your acceptance of our Terms of Service and this Privacy Policy. If you disagree with any provisions of either document, you must not use our Services.

3. We shall only process your personal data if:

• you have given us consent to do so for one or more specific purposes; you may withdraw your consent at any time;
• it is necessary for the performance of our contractual obligations towards you;
• the law requires us to do so; or
• we have a legitimate interest to do so. This includes processing your data for statistical purposes and direct marketing purposes, all of which are subject to additional safeguards.

4. We will let you know what kinds of data we process about you, and for what purposes and how we process it. This policy will also explain what are your specific rights regarding to your personal data, and how you can exercise those rights. For more information, refer to Article (5) of this policy.

5. If you have any questions or complaints about this policy or the ways in which we process your personal data, you can contact our Data Protection Officer by email support@zenithmastery.com.

If you find that your rights have been violated, you can lodge a complaint with the competent supervisory authority (Swiss Data Protection Inspectorate).

6. This privacy policy is effective as of the date written above.

We may revise this privacy policy from time to time. Revised policy will become effective on the date of the publication thereof on our website or at a later date if specified in the revised policy.

If we revise this policy, we will notify you about it (e.g. via email or when you use the Services again). If you do not agree with the revised policy, you may terminate your user account.

2. Definitions

• 'personal data' means any information relating to an identified or identifiable natural person ('data subject'); an identifiable natural person is one who can be identified, directly or indirectly, in particular by reference to an identifier such as a name, an identification number, location data, an online identifier or to one or more factors specific to the physical, physiological, genetic, mental, economic, cultural or social identity of that natural person;
• 'your personal data' means personal data relating to you;
• 'processing' means any operation or set of operations which is performed on personal data or on sets of personal data, whether or not by automated means, such as collection, recording, organisation, structuring, storage, adaptation or alteration, retrieval, consultation, use, disclosure by transmission, dissemination or otherwise making available, alignment or combination, restriction, erasure or destruction;
• 'restriction of processing' means the marking of stored personal data with the aim of limiting their processing in the future;
• 'profiling' means any form of automated processing of personal data consisting of the use of personal data to evaluate certain personal aspects relating to a natural person, in particular to analyse or predict aspects concerning that natural person's performance at work, economic situation, health, personal preferences, interests, reliability, behaviour, location or movements;
• 'pseudonymisation' means the processing of personal data in such a manner that the personal data can no longer be attributed to a specific data subject without the use of additional information, provided that such additional information is kept separately and is subject to technical and organisational measures to ensure that the personal data are not attributed to an identified or identifiable natural person;
• 'filing system' means any structured set of personal data which are accessible according to specific criteria, whether centralised, decentralised or dispersed on a functional or geographical basis;
• 'controller' means the natural or legal person, public authority, agency or other body which, alone or jointly with others, determines the purposes and means of the processing of personal data;
• 'processor' means a natural or legal person, public authority, agency or other body which processes personal data on behalf of the controller;
• 'recipient' means a natural or legal person, public authority, agency or another body, to which the personal data are disclosed, whether a third party or not.
• 'third party' means a natural or legal person, public authority, agency or body other than the data subject, controller, processor and persons who, under the direct authority of the controller or processor, are authorised to process personal data;
• 'consent' of the data subject means any freely given, specific, informed and unambiguous indication of the data subject's wishes by which he or she, by a statement or by a clear affirmative action, signifies agreement to the processing of personal data relating to him or her;
• 'personal data breach' means a breach of security leading to the accidental or unlawful destruction, loss, alteration, unauthorised disclosure of, or access to, personal data transmitted, stored or otherwise processed;
• 'genetic data' means personal data relating to the inherited or acquired genetic characteristics of a natural person which give unique information about the physiology or the health of that natural person and which result, in particular, from an analysis of a biological sample from the natural person in question;
• 'biometric data' means personal data resulting from specific technical processing relating to the physical, physiological or behavioural characteristics of a natural person, which allow or confirm the unique identification of that natural person, such as facial images or dactyloscopic data;
• 'data concerning health' means personal data related to the physical or mental health of a natural person, including the provision of health care services, which reveal information about his or her health status;

3.1. Grounds for processing

We shall only process your personal data if and to the extent that at least one of the following applies:

• (a) you have given consent to the processing of your personal data for one or more specific purposes;
• (b) processing is necessary for the performance of a contract to which you are party or in order to take steps at your request prior to entering into a contract;
• (c) processing is necessary for compliance with a legal obligation to which we are subject;
• (d) processing is necessary for the purposes of the legitimate interests pursued by us or by a third party, except where such interests are overridden by your interests or fundamental rights and freedoms which require protection of personal data, in particular where you are a child.

Note that our legitimate interests include processing your data for statistical purposes, and for direct marketing purposes.

3.2. Conditions for consent

1. When we request your consent in the context of a written declaration which also concerns other matters, the request for consent shall be presented in a manner which is clearly distinguishable from the other matters.

2. You shall have the right to withdraw your consent at any time. The withdrawal of consent shall not affect the lawfulness of processing based on consent before its withdrawal. It shall be as easy to withdraw as to give consent.

3. If you are a child younger than 16 years, then the consent must be given or authorised by the holder of parental responsibility over you, and we shall make reasonable efforts to verify the identity of the person giving or authorising the consent.

3.3. Processing of special categories of personal data

1. We shall not process personal data revealing your racial or ethnic origin, political opinions, religious or philosophical beliefs, or trade union membership, your genetic data, your biometric data for the purpose of uniquely identifying you, or data concerning your health, sex life or sexual orientation.

2. Paragraph 1 shall not apply if one of the following applies:

• (a) you have given us explicit consent to the processing of those personal data for one or more specified purposes;
• (b) processing relates to personal data which you have manifestly made public; or
• (c) processing is necessary for the establishment, exercise or defence of legal claims.

3.4. Processing which does not require identification

Where we can to demonstrate that we are not or no longer in a position to identify the data subject, Articles 4.2 to 4.7 shall not apply except where you, for the purpose of exercising your rights under those articles, provide additional information enabling your identification.

3.5. International data transfers

1. We may transfer your personal data to a controller, processor or recipient in a third country or an international organisation where the Commission has decided, by means of implementing act, that the third country, a territory or one or more specified sectors within that third country, or the international organisation in question ensures an adequate level of protection.

2. We may also transfer your personal data to a third country or international organisation subject to appropriate safeguards.

3. We shall only recognise any judgment of court or tribunal or any decision of an administrative authority of a third country requiring us to transfer or disclose personal data if such judgment or decision is based on an international agreement in force between the requesting third country and the Union or a Member State.

4.1. Information to be provided

1. Where we collect or obtain your personal data, we shall provide you with all of the following information:

• (a) our identity and contact details;
• (b) the contact details of our data protection officer, where applicable;
• (c) the purposes of the processing for which the personal data are intended as well as the legal basis for the processing;
• (d) where the processing is based on the legitimate interests pursued by us or by a third party, these legitimate interests;
• (e) the recipients or categories of recipients of the personal data, if any;
• (f) where applicable, the fact that we intend to transfer personal data to a third country or international organisation and the existence or absence of an adequacy decision by the Commission;
• (g) the categories of personal data obtained from sources other than you.

4.2. Right of access

You shall have the right to obtain from us confirmation as to whether or not personal data concerning you are being processed, and, where that is the case, access to the personal data.

4.3. Right to rectification

You shall have the right to obtain from us without undue delay the rectification of inaccurate personal data concerning you. Taking into account the purposes of the processing, you shall have the right to have incomplete personal data completed, including by means of providing a supplementary statement.

4.4. Right to erasure

1. You shall have the right to obtain from us the erasure of your personal data without undue delay and we shall have the obligation to erase personal data without undue delay where one of the following grounds applies:

• (a) the personal data are no longer necessary in relation to the purposes for which they were collected or otherwise processed;
• (b) you withdraw consent on which the processing is based, and where there is no other legal ground for the processing;
• (c) you object to the processing and there are no overriding legitimate grounds for the processing;
• (d) the personal data have been unlawfully processed;
• (e) the personal data have to be erased for compliance with a legal obligation in Union or Member State law to which we are subject;
• (f) the personal data have been collected in relation to the offer of information society services directly to a child.

4.5. Right to restriction of processing

You shall have the right to obtain from us restriction of processing where you contest the accuracy of the personal data, the processing is unlawful and you oppose the erasure of the personal data, or we no longer need the personal data for the purposes of the processing but you require them for the establishment, exercise or defence of legal claims.

4.7. Right to data portability

You shall have the right to receive your personal data, which you have provided to us, in a structured, commonly used and machine-readable format and have the right to transmit those data to another controller without hindrance from us.

4.8. Right to object

You shall have the right to object, on grounds relating to your particular situation, at any time to processing of your personal data which is based on the legitimate interests pursued by us or by a third party, including profiling based on those provisions. Where personal data are processed for direct marketing purposes, you shall have the right to object at any time to processing of your personal data for such marketing.

5.1. Cookies and local storage

1. Our website uses no cookies and stores nothing on your device. It measures how it is used without them, as described in Article 5.8. Pages that carry out an account action, such as confirming your e-mail address or resetting your password, connect to our sign-in provider to do so.

2. The Zenith app stores your routines, their schedules, your completion history and your settings on your device, separately for each account that signs in on it. We do not upload them to our servers, except for the parts of a request described in Article 5.3. If backup is turned on for your device, your device's backup service may include this data; you can manage this in your device settings.

5.2. Your account

1. To create an account, you sign in with your e-mail address and a password, or with a third-party sign-in such as your Google account. We use your account to keep your data separate from other users' on your device, to confirm your sign-in when you use our online features, and to send you account e-mails.

2. Your account record holds your e-mail address, how you sign in, and when your account was created and last used. Passwords are stored only in a protected (hashed) form by our sign-in provider; we never see your password.

3. If you sign in with a third-party account, that provider may share basic profile information with us, such as your name, e-mail address and profile picture. We only use your e-mail address, and we never receive the password of that account.

4. We send you e-mails about your account only, such as confirming your e-mail address, resetting your password and confirming that your account has been deleted. Apart from the launch notification some people signed up for (Article 5.6), we do not send newsletters or marketing e-mails.

5. We do not sell your personal data, and we do not show ads.

6. To prevent abuse, we may keep short-lived records of account requests (such as password resets), in a form that doesn't reveal your e-mail address where possible, and delete them once they are no longer needed for that purpose.

7. You can delete your account at any time in the app's settings. Your account is disabled immediately and deleted, usually within minutes and at the latest within 7 days, after which we e-mail you a confirmation. The routines and history stored on the device you delete it from are deleted at the same time. We keep no backups of your account.

5.3. Your routines and AI features

1. Some features of the app use artificial intelligence, for example to write a routine from a goal you type or to suggest routines that help you reach a goal. They only run when you ask for them.

2. When you use them, the app sends our servers what the feature needs to answer your request, such as the goal or routine title, which of Zenith's built-in routines you use, and when your routines are scheduled. The request is linked to your account so that we can confirm it comes from you.

3. We use third-party AI providers to generate the answers. They receive only the content needed for the request, such as your goal, and not your account or e-mail address. Do not include personal information you don't want to share, such as health details, in text you use with these features.

4. To answer similar requests quickly, we may store AI answers for a limited time, identified by what was asked rather than by who asked. They may be shown to other users who ask for the same thing.

5. To keep the service fair and to learn which routines people want most, we count requests. Counts linked to your account are used for usage limits and kept only briefly; counts used to find popular routines don't identify you and are deleted within days.

6. We may publish AI-written routines, for example as articles in the library on our website. We only publish the most popular routines, so that nobody's personal goal is published, and we never say who asked for them.

5.4. Your payment information

Subscriptions are bought and managed through the app store you installed Zenith from. The store processes your payment details under its own privacy policy; we never receive them.

So that your subscription belongs to your Zenith account, and works on any phone you sign in on, our servers check each purchase with the store and keep, with your account: the store's identifier for the purchase, which plan it is, its state (for example active, cancelled or expired), the date it is paid until and whether it renews. The store tells us when any of that changes. When you buy, the app also gives the store a code made from your account's identifier (not your name or email address), so a purchase can only be used with the account it was made in. We keep these while your account exists and delete them when you delete it; cancelling or refunding the subscription itself is done in the store.

5.5. Analytics and crash reports

1. When you first set up the app, we ask whether you agree to share usage analytics and crash reports. We only collect them if you agree, and your answer applies to the device.

2. With your consent, we record how the app is used, such as which screens you open and which actions you take, never the text you write, such as routine titles or your e-mail address. This includes information about your device and the app (such as its model, operating system version and an app instance identifier) and an approximate location (such as your country) derived from your IP address. We do not use it for advertising.

3. With your consent, we also record crashes and errors in the app, with information about your device and the app, to help us fix problems.

4. We keep analytics data only as long as it is useful for improving the app. To withdraw your consent, clear the app's storage in your device settings (you will be asked again the next time you open the app) or contact us.

5. Our servers keep technical logs (for example, which request was made and whether it succeeded) for a limited time to operate and secure the service. They may include your account identifier, but not the content of your routines.

5.6. Launch notifications

1. Before the Zenith app was available, you could sign up on our website to be told when it launched. For those sign-ups, we store the e-mail address you entered, whether you use an iPhone or an Android phone, and when you signed up. The website no longer takes new sign-ups.

2. We use them only to send you one e-mail when Zenith becomes available for the phone you chose, and delete them once we have sent it. We do not use them for anything else and do not share them, apart from the service providers that host our servers and send our e-mails (Article 5.7).

3. We process them because you asked us to (your consent). You can withdraw it at any time by e-mailing support@zenithmastery.com, and we will delete your sign-up.

4. To prevent abuse, we count sign-ups per IP address and delete these counters within a day.

5.7. External processors

We use carefully selected service providers to provide our services, and may change them over time. They process personal data only on our behalf and for the purposes described in this policy. They include providers of:

• account sign-in and account records;
• cloud hosting for our servers and website;
• sending account and launch notification e-mails, and our team's feedback e-mails;
• AI models that power the app's AI features;
• usage analytics and crash reporting, with your consent;
• app distribution, subscriptions and payments.

Some of them may process data outside Switzerland and the European Economic Area, including in the United States; see Article 3.5 on international data transfers. You can ask us for the current list of providers at any time.

In certain cases, we may act as a processor of your personal data. This means that some other service provider or our cooperation partner or business client is the controller of your personal data.

5.8. Website statistics

1. To learn which pages of our website are useful and how people find it, the website tells our servers when you open a page, how long the page was visible and how far down you scrolled, when you follow a link to an app store or to e-mail us, and when you follow a link to another website (only that website's name). For the first page you open, it also sends the name of the website you came from and the campaign tags in the link you followed (such as utm_source), but never the rest of the address or anything you type.

2. We do not use cookies or store anything on your device for this, and we do not keep your IP address or your browser's full identification (its user agent). To count how many different people visit each day, our servers combine your IP address and browser identification with a random value that changes every day and is then deleted, and keep only the result, which cannot be traced back to you or linked from one day to another. We also keep the names of your browser and operating system, such as Chrome and Android.

3. We process this data based on our legitimate interest in statistics about our website. If your browser sends a Global Privacy Control or Do Not Track signal, the website sends none of it.

4. We keep these statistics for 13 months.

5.9. Feedback

1. When you send feedback or contact support from the Zenith app, we store your message with your account's name, e-mail address and user ID, the app version, your phone model, its Android version and time zone setting, what kind of feedback you said it is (a problem, an idea or a question) or, when you contact support, its topic (a bug, your account, billing or something else), the app screen you sent it from, and when you sent it.

2. We use them only to read and answer your feedback and to improve Zenith: once a day, the day's feedback is e-mailed to our team. We process this data to handle your request and based on our legitimate interest in improving our services.

3. We keep your feedback on our servers for 12 months. Copies in our team's e-mail may be kept longer, for as long as we need them to follow up on it.