Privacy Policy

We are the controller of the personal data we collect to run our business: account, workspace, billing, support, security and website data.

When our business customers send content through the Services, such as prompts, files and the outputs generated from them, any personal data in that content is processed by us as a processor or service provider on the customer's behalf and under the customer's instructions, and our Data Processing Addendum applies. If you are a user of one of our customers' products, please contact that customer about your data; we will refer requests we receive to them.

2.1 Account and workspace data. Your email address, your name if you give it, workspace names, team membership and roles, and your settings. You sign in with one-time codes we email to you, so we do not store passwords.

2.2 API keys. Each key's name, prefix and limits. The full secret is shown to you once and stored by us only as a one-way hash.

2.3 Billing data. Your purchases, Credit balance and ledger, Promotional Credits, receipts and invoices, and identifiers from our payment processor. Card details are collected and stored by our payment processor; we never receive your full card number.

2.4 Usage data. For every request: the time, model, endpoint and API key used; token, image or video counts; cost and list price; status and error codes; latency; and which of our routes served it. We use this to bill you, show your request history, run and improve the Services and keep them secure.

2.5 Content you send through the Services.

• Chat and text requests through the API: we process prompts and responses in memory while serving the request and do not store them.
• Playground chats: chats you have in the Playground are saved to your account so you can reopen them. Only you can see them, and we keep your newest 300 in each workspace until you delete them. Files attached to a chat are not saved with it.
• Pictures you add in the Playground: images you upload, paste or drop in the Playground are kept in your workspace's Recent uploads so you can use them again. Everyone in the workspace can see them, and they are deleted after 30 days.
• Images: generated images and the prompts that produced them are stored so you can view and download them, and are deleted after 30 days.
• Videos: the prompt, settings and any reference images you send are stored to produce and deliver the video. The video, the prompt and the reference images are deleted after 30 days. A record of the job without that content (time, model, length, status and cost) stays with your billing history.
• Error details: when an attempt to serve a request fails, we keep the error message returned for up to 30 days to diagnose problems. Such messages can occasionally quote part of a request or response.
• Content is sent to Infrastructure Providers to generate outputs (see Section 4). We do not use your content to train artificial intelligence models and we do not sell it.

2.6 Communications. Support requests and messages you send us, including the name, email address and company you give on our Support page, and records of the emails we send you, such as sign-in and confirmation codes, receipts, account alerts and product news, including whether a product email was opened.

2.7 Device and log data. IP address, browser and device information, and timestamps and security events when you use the websites, the dashboard or the API, kept in our server logs. We also keep access records of the IP addresses and devices used to sign in, use the dashboard, save a card, make a payment and call the API, with when each was first and last seen, to prevent fraud and to answer payment disputes. We also note on your account the countries you use the dashboard from, as Cloudflare derives them from your IP address, with when each was first and last seen, so our support team can help you when you contact us. When you ask for a sign-in or sign-up code, Cloudflare Turnstile checks that a person, not an automated script, is asking, and receives your IP address and signals from your browser to do so. We also record the network each new account is created from, to limit automated sign-ups.

2.8 Cookies and local storage. Apart from Meta's, Google's and X's ad measurement cookies and our record of which of our ads you clicked (2.9), we use only what the Services need to work: keeping you signed in, which uses your browser's local storage and a cookie that lasts until you sign out (up to 400 days, renewed when you visit), remembering preferences such as your theme and the language you pick (a cookie that lasts a year), and, when you open someone's referral link or type in a referral code, that code (local storage, until it's added to your account, or for up to 90 days). Our own website analytics (2.10) set no cookies and store nothing on your device. Our website host also collects anonymous page view statistics, such as which pages are visited and how often, and may set a cookie to do so.

2.9 Ad measurement (Meta, Google and X). To measure our ads on Facebook and Instagram, our websites load the Meta Pixel, which sets Meta's cookies (_fbp, and _fbc when you arrive from a Meta ad) and tells Meta which of our pages you visit. When you sign up, first make a successful API request and buy credit, we also tell Meta directly from our servers, with your email address and account ID in hashed form, your IP address and browser, Meta's cookie values and, for a purchase, the amount. To measure our ads on Google, our websites also load the Google tag for Google Ads, which sets Google's cookies (_gcl_au, and _gcl_aw or _gcl_gb with the click ID, such as gclid, when you arrive from a Google ad) and tells Google which of our pages you visit. When you sign up, first make a successful API request and buy credit, your browser tells Google Ads, with an ID for the event, your email address in hashed form (Google's enhanced conversions), your IP address and browser, Google's cookie values and, for a purchase, the amount; the first API request and purchases are sent the next time you open our dashboard. We use Google Ads only to measure our ads, not to show you personalized ads. To measure our ads on X, our websites also load X's pixel, which sets X's cookies (_twpid and _twsid, and _twclid with the click ID, twclid, when you arrive from an X ad) and tells X which of our pages you visit; X may also read cookies it set on its own websites. When you sign up, your browser tells X, with an ID for the event, your IP address and browser, and X's click ID; we do not send X your email address. When you arrive from one of our Meta or Google ads, we also keep in your browser's local storage, for up to 90 days, the campaign tags in the ad's address (such as the names or IDs of the campaign and the ad) and when you clicked, so that if you create an account on a later day our website analytics (2.10) can tell which ad you came from; we do not send this record to Meta or Google. In the European Economic Area, the United Kingdom and Switzerland all of this happens only if you allow it on our banner. Elsewhere it is on unless you turn it off with Your privacy choices at the bottom of our pages, and we treat a Global Privacy Control signal from your browser as turning it off. Turning it off stops the Meta Pixel, the Google tag and X's pixel, deletes the cookies they set on our websites and our record of which ad you clicked from your browser, and deletes the identifiers we kept for them.

2.10 Website analytics. To understand how people find and use our websites, we record the pages you visit on zurelay.com (not the signed-in dashboard) and how long each is in view, the website or app that sent you, the campaign tags in the address (UTM parameters), whether you arrived from an ad click (the name of the ad's click parameter, such as gclid, not its value), the country we derive from your IP address, and your type of device, browser and operating system. We set no cookies and store nothing on your device for this. To count visitors without identifying them, we combine your IP address and browser details with a random value that is replaced every day and keep only the resulting code, so visits on different days can't be linked; we do not keep your IP address. When you create an account, we record the visit you signed up from that day and, where ad measurement (2.9) is on and you arrived from a Google or Meta ad on an earlier day, which platform and which ad (its campaign tags) that was, so we can tell which sources and ads bring customers. If you answer the optional question in your dashboard about how you heard about Zurelay, we keep your answer, and anything you add to it, with your account for the same purpose.

Where the GDPR, UK GDPR or similar laws apply, we rely on the legal bases shown in brackets.

• To create and run your account and workspaces, authenticate you, serve your requests and store your generated files (performance of our contract with you).
• To charge for the Services, process payments and promotions, prevent fraud and keep tax and accounting records (contract, legal obligation and our legitimate interest in being paid and preventing fraud).
• To secure the Services, monitor reliability, prevent abuse and enforce our Terms (legitimate interests).
• To provide support and send service messages, such as receipts, security notices and changes to our terms (contract and legitimate interests).
• To understand and improve the Services, mainly through aggregated or de-identified usage data (legitimate interests).
• To understand how people find and use our websites and which sources bring customers, as described in 2.10 (legitimate interests).
• To measure and improve our advertising on Meta, Google and X, as described in 2.9 (your consent where the law requires it, otherwise our legitimate interests; you can turn it off at any time).
• To send you news, tips and offers about our products, such as getting-started emails and a bonus on a first deposit, and to see which of them are opened, where the law allows. Every one has an unsubscribe link, and unsubscribing doesn't stop sign-in codes, receipts or other service messages (consent or legitimate interests).
• To comply with law, respond to lawful requests and establish, exercise or defend legal claims (legal obligation and legitimate interests).

• Infrastructure Providers. The artificial intelligence model developers, cloud platforms, independent resellers and other model-capacity providers we choose and verify to serve requests receive the content and parameters needed to generate an output. They process it under their own terms and practices, which may include logging, retaining or reviewing it and using it to improve their services, and they may be located in the United States or in other countries. We do not send them your name, email address or billing details.
• Service providers. Companies that provide our hosting, databases, storage, payment processing, email delivery, bot protection and support tools, under contracts that limit their use of personal data to providing services to us.
• Your workspace. Members and administrators of a workspace can see workspace data according to their roles.
• The person who referred you. If you sign up with someone's referral link or code, they can see your first name, your email address with most of it hidden, when you signed up and first added funds, and the referral credit your deposits earn them.
• Legal and safety. Where we believe in good faith that disclosure is needed to comply with law or a lawful request, enforce our Terms, protect the rights, property or safety of anyone, or investigate fraud or abuse, including reporting child sexual abuse material to the authorities.
• Business transfers. In connection with a merger, acquisition, financing, reorganization or sale of assets, subject to this Policy.
• Meta (ad measurement). Meta Platforms receives the data described in 2.9 to measure our ads and to show them to people likely to find the Services useful. Meta uses it under its own terms and privacy policy, as an independent controller where the GDPR applies.
• Google (ad measurement). Google LLC receives the data described in 2.9 to measure our ads on Google. Google uses it under its own terms and privacy policy, and we tell Google not to use it to personalize ads.
• X (ad measurement). X Corp. receives the data described in 2.9 to measure our ads on X and to show them to people likely to find the Services useful. X uses it under its own terms and privacy policy.
• With your consent or at your direction.

We do not sell personal data for money. Sending data to Meta, Google and X for ad measurement (2.9) may count as 'sharing' for cross-context behavioral advertising, or as 'targeted advertising', under some United States state laws. You can opt out at any time with Your privacy choices at the bottom of our pages, and we honor Global Privacy Control.

Zurelay is based in the United States. We and our service and Infrastructure Providers process personal data in the United States and in other countries, which may have data protection laws different from those where you live. Where the law requires it, we use recognized safeguards, such as the European Commission's Standard Contractual Clauses, for transfers to us. Some Infrastructure Providers offer their services only on their own standard terms, so we may not be able to put such safeguards in place with them.

We may keep data longer where the law requires it, to resolve disputes, or to enforce our agreements. Backups are deleted on their normal schedule.

We protect personal data with measures appropriate to the risk, including encryption in transit, storing API keys only as one-way hashes, encryption at rest provided by our hosting providers, and limiting access to production systems to the people who need it. No system is perfectly secure, so we cannot guarantee the security of personal data. You are responsible for keeping your API keys and email account secure.

Depending on where you live, you may have the right to access, correct or delete your personal data, to receive a copy of it, to object to or restrict our processing of it, to withdraw consent, and to opt out of the sale or sharing of personal data or targeted advertising (we don't sell personal data; to opt out of sharing for ad measurement, use Your privacy choices at the bottom of our pages, or turn on Global Privacy Control in your browser). If you are in the European Economic Area, the United Kingdom or Switzerland, you may also complain to your data protection authority. To stop product news, use the unsubscribe link in any of those emails.

To exercise a right, email help@zurelay.com with “Privacy request” in the subject. We will verify your identity before acting, may ask an authorized agent for proof of authority, and will respond within the time the law requires. If we decline a request, you may appeal by replying to our response. We will not discriminate against you for exercising your rights. Requests about content our customers sent through the Services will be referred to the customer concerned.

The Services are for businesses and are not directed to children. We do not knowingly collect personal data from anyone under 18. If you believe a child has given us personal data, contact us and we will delete it.

We may update this Policy from time to time. We will post the updated Policy with a new date and, for material changes, notify you by email or in the Services.

Questions and requests about privacy can be sent to Zurelay LLC at help@zurelay.com. For help with your account or the Services, open a request on our Support page (zurelay.com/support).