1. Who we are and what this covers
Zopix AI (“we”, “us”) operates Zopix AI, a content workspace for brands and agencies. This policy covers the public website, the workspace at /app and the platform console at /admin. It does not cover the social networks, payment gateways or AI providers you connect to; their own policies apply to what they do with your data.
When a master administrator creates a client account on behalf of a business, that business is responsible for telling its team members that their details are processed here under this policy.
2. Information we collect
Account and team
- Name, email address and a password. Passwords are stored only as a salted Argon2 hash and are never readable by us.
- Your role in each workspace, invitations you send or accept, and the time and IP-derived request identifiers of sign-ins.
Workspace content
- Brand profiles: descriptions, audiences, tone and the facts you mark as approved.
- Briefs, drafts, captions, slides, images, video and other media you create, upload or generate, with every revision and approval.
- Campaigns, schedules, leads and enquiries you record.
Connected accounts and keys
- When you authorise a social account we store the account identifier, display name, granted permissions and the access and refresh tokens the platform issues. Tokens are encrypted at rest with a key held only on our servers.
- Provider app keys and AI keys entered for a client are encrypted the same way, scoped to that client and never shown again in full.
Billing
- Order identifiers, plan, amount in INR, payment status, refund status and the gateway’s payment identifier.
- Card, UPI and bank details are entered on the gateway’s hosted checkout and never reach our servers. A mobile number required by Cashfree is sent directly to Cashfree for that transaction and is not kept in our order records.
Usage and security logs
- Audit events (who did what, to which item, when), background job records, credit ledger entries and request identifiers. Logs do not contain request bodies, reset tokens or passwords.
Cookies
- One session cookie that keeps you signed in. It is HTTP-only, marked SameSite and, in production, secure-only.
- Optional Google Analytics cookies, set only after you choose “Allow analytics”. See section 7.
3. How we use it
- To run the service: sign you in, keep workspaces separate, generate drafts from your briefs and brand facts, store your media and publish approved content on the schedule you set.
- To bill you: create orders, verify payments with the gateway, grant credits once and keep the records tax and accounting law require.
- To keep the service safe: rate limiting, fraud and abuse prevention, audit trails, and time-limited, audited support access when you ask for help.
- To support you: respond to requests sent to [email protected] and notify you about security, billing or service changes.
- To improve the product, using aggregated usage figures and, only with your consent, Google Analytics.
We do not sell personal data, and we do not use your content, briefs or media to train AI models.
4. AI generation providers
When you ask the AI Studio to write or rewrite a prompt, or to generate an image or video, the brief, the selected brand’s profile and approved facts, your chosen settings and the prompt text are sent to the provider configured for your client: OpenAI for prompt rewriting and images, and fal.ai for images and video. Caption and carousel drafts that use the built-in template generator are produced on our servers and are not sent to any provider.
Providers process this data to return the result and under their own terms. We request that it is not used to train their models where the provider offers that option. Every paid request is quoted in credits and confirmed by you before it is sent.
5. Social platforms you connect
You decide which accounts to connect and what gets published. We publish only content that has been approved and scheduled by someone with that permission in your workspace, and we record the post identifier and link the platform returns.
- Meta (Facebook Pages and Instagram professional accounts): we store Page and account identifiers, names and the encrypted Page and user tokens needed to publish. Disconnect at any time from Connections, or remove the app under your Facebook settings; stored tokens are deleted on disconnect.
- YouTube: Zopix AI uses YouTube API Services to upload videos you schedule. Google’s Privacy Policy applies to the data Google processes. You can revoke our access at any time from your Google security settings. We store only the channel identifier, channel title and encrypted tokens; we do not read your subscribers, comments or analytics.
- X: we store the account identifier, handle and encrypted tokens needed to post text on your behalf. Revoke access in Connections or from your X settings.
Platform data is used only to publish and to show you the status of what was published. It is not combined with other data for advertising, and it is not shared with anyone except as described in section 8.
6. Payments
Plans are one-time 30-day purchases paid through Razorpay or Cashfree. The gateway processes your payment instrument under its own privacy policy and sends us the order and payment identifiers, amount, currency and status. Refunds are recorded from the gateway’s own records. We keep billing records for as long as Indian tax and accounting law requires.
9. How long we keep data
- Account and workspace data: for as long as the workspace exists. When a workspace is closed, its content and media are deleted within 30 days.
- Connected-account tokens: until you disconnect the account, revoke access at the platform, or the workspace is closed, whichever is first.
- Audit events and security logs: up to 12 months after the related workspace is closed, so that disputes and security incidents can be investigated.
- Billing records: for the period required by Indian tax and accounting law, currently eight years.
- Analytics data: according to the retention setting in our Google Analytics property, which is set to the shortest available option.
10. How we protect it
- Each client’s data, keys and connected accounts are isolated. Every request is checked against your membership and role on the server.
- Passwords are hashed with Argon2. Social tokens and provider keys are encrypted at rest with a key that is never stored in the database.
- Sessions use HTTP-only cookies with CSRF protection. Secrets are never written to logs.
- Support access to a client account is possible only with a stated reason, lasts at most 30 minutes, is shown in a banner to everyone involved and is recorded in the audit trail.
- Payments are verified server-side with the gateway before credits are granted.
No system is perfectly secure. If we become aware of a breach that affects your personal data we will notify you and the relevant authority as the law requires.
11. Your rights and choices
Depending on where you live you may have the right to access, correct, update or delete your personal data, to receive a copy of it, to withdraw consent, to nominate a person to exercise your rights if you are unable to, and to complain to a supervisory authority. In India these rights are set out in the Digital Personal Data Protection Act, 2023.
- Update your name, email and password from Settings. Workspace owners can remove members and delete brands, content and media.
- Disconnect social accounts from Connections at any time.
- Withdraw analytics consent with the “Analytics” control on any page.
- For anything else, including deleting your account or a whole workspace, email [email protected]. We verify the request and respond within 30 days.
12. Children
Zopix AI is a business tool for people aged 18 and over. We do not knowingly collect data from children. If you believe a child has created an account, contact us and we will delete it.
13. International processing
Our servers are located in India. AI providers, social platforms, payment gateways and analytics providers may process data in other countries, including the United States. We send them only what the request needs and rely on their published safeguards and our contracts with them.
14. Changes to this policy
We will post changes here and update the date at the top. If a change materially reduces your rights we will tell you by email or in the workspace before it takes effect.
15. Contact and grievance officer
Privacy questions and requests: [email protected].
Grievance Officer under the Information Technology Act, 2000 and the Digital Personal Data Protection Act, 2023: Grievance Officer, [email protected]. We acknowledge grievances within 24 hours and aim to resolve them within 15 days.
Zopix AI, Registered office address, City, State, India.