Privacy Policy

1. Who is responsible for your data

The data controller for the processing described here is Woobik di Silva Cordeiro Pedro Henrique, trading as Woobik Studio, Via Barberini 54, 61040 Monte Porzio (PU), Italy · VAT IT02692610419. You can reach us regarding privacy at privacy@zilowy.com.

2. Data we collect

• Account data — the email address and password (stored only as a salted hash) you use to sign in, and basic profile settings.
• Content you create or upload — images, videos, prompts, captions, titles, labels and related metadata you generate or manage inside the Service.
• Connected social accounts — when you connect a third-party account (for example Instagram, Facebook, Threads, Pinterest, TikTok, YouTube or Fanvue), we receive and store an account identifier, the public display name/handle, and the access and refresh tokens needed to act on your behalf. Tokens are encrypted at rest.
• Connected storage (BYOS) — if you connect your own cloud storage bucket, we store the encrypted credentials required to read and write to it.
• Billing data — subscription status and identifiers. Card and payment details are handled directly by our payment processor (Stripe); we do not store full card numbers.
• Technical data — a session cookie for authentication, and server logs (IP address, timestamps, error traces) needed to operate and secure the Service, and, only if you accept analytics cookies on www.zilowy.com or app.zilowy.com, usage data collected by Google Analytics (see sections 5 and 14).

3. How we use your data

• To provide the Service: store and organize your media, run the features you request, and publish or schedule content to the accounts you connect.
• To analyze media you add so we can offer search, tagging, colour and content understanding (see section 5).
• To operate billing and subscriptions.
• To secure the Service, prevent abuse, and comply with legal obligations.

We do not sell your personal data, and we do not use the data obtained from connected social accounts for advertising or profiling.

4. Legal bases (GDPR)

Because we are established in the EU, our processing relies on: performance of a contract (providing the Service you signed up for), legitimate interests (securing and improving the Service), consent (where you explicitly connect an account or storage provider, or accept analytics cookies), and legal obligation (accounting, responding to lawful requests).

5. Third-party processors and content analysis

To deliver the Service we rely on a small number of providers who process data on our behalf:

• Hosting — our servers, which store your account and application data.
• AI content understanding — to generate captions, tags, moderation signals and search embeddings, media you add is transmitted transiently to AI providers (currently Google Gemini, Voyage AI and AWS Rekognition). They process the content to return the analysis and do not receive your account credentials. We do not use your content to train AI models, and none of these providers may use it to train theirs: we use paid services that exclude it or have opted out of it where the provider offers that option.
• Website and app analytics — Google Analytics 4 (Google Ireland Limited), on www.zilowy.com and app.zilowy.com, only after you accept. It receives the pages you visit, the links you click, the referring site, device and browser details and an approximate location; Google does not store IP addresses. In the app it also receives a small set of product events — signing up, logging in, connecting a storage or social account, starting a checkout, a payment, and a publication going out (with the network and post type, never its content) — tagged with a pseudonymous identifier derived from your account that Google cannot link to your name or email. Some of these events happen with no browser open, such as a scheduled post or a subscription renewal: our server sends those directly to Google, and only if you had accepted analytics the last time you used Zilowy. If you reject, we delete the identifier we keep for this and send nothing more. Google Signals and advertising features are off, and event data is kept for 14 months.
• Payments — Stripe, which acts as merchant of record and processes your payment details under its own privacy policy.
• Social platforms — when you choose to publish, the content and caption you selected are sent to the destination platform (for example TikTok, Instagram, Facebook, Threads, Pinterest, YouTube or Fanvue) under that platform's terms.

6. Bring Your Own Storage (BYOS)

Zilowy is designed so that your media can live in your own cloud storage bucket, not ours. When you use BYOS, the content itself is stored under your control; we keep only the metadata and encrypted credentials needed to display and manage it for you. Analysis (section 5) still involves transmitting the relevant media transiently to the AI provider at the moment it is processed.

7. Data obtained through TikTok

When you connect a TikTok account, we use TikTok Login and the Content Posting API. Specifically:

• What we receive — your TikTok basic profile (open ID, display name and avatar, via the user.info.basic scope) and access/refresh tokens (via the video.publish scope).
• How we use it — solely to show which TikTok account is connected and to publish or schedule, to your own account and at your explicit request, the videos and photos you created in Zilowy. We do not read your feed, other users' content, or analytics.
• Storage and retention — tokens are stored encrypted and are deleted when you disconnect the account. We keep TikTok profile data only while the account remains connected.
• Sharing — TikTok data is never sold or shared with third parties, other than the infrastructure processors in section 5 that are strictly necessary to operate the Service.
• Revoking access — you can disconnect the account inside Zilowy at any time, which revokes the stored tokens. You may also revoke Zilowy's access from your TikTok account settings.

Our use of information received from TikTok APIs adheres to the TikTok Developer Terms of Service and applicable platform policies.

8. Data obtained through YouTube (Google)

Zilowy uses YouTube API Services. When you connect a YouTube channel, you sign in with Google and grant Zilowy access through Google OAuth. By connecting a channel you also agree to be bound by the YouTube Terms of Service, and Google's handling of your data is described in the Google Privacy Policy. Specifically:

• What we access — with the youtube.readonly scope, your channel's identifier, title, handle, avatar and public statistics (subscriber and video counts), and the list of videos on your channel with their title, publication date, visibility and public counters (views, likes, comments). With the youtube.upload scope, the ability to upload videos to your channel. We cannot delete, edit or manage your existing videos, playlists or comments.
• How we use it — to show which channel is connected, to upload, at your explicit request and with the title, description, visibility and audience settings you choose, the videos you created in Zilowy to your own channel, and to show you the videos on your channel with their counters.
• What we store — the channel identifier and handle, the encrypted access and refresh tokens, and, for each video you publish through Zilowy, its YouTube video ID and the settings you chose. The channel's video list and statistics are fetched live when you view them and are not stored.
• Sharing — YouTube data is never sold, used for advertising, or shared with third parties, other than the infrastructure processors in section 5 that are strictly necessary to operate the Service. Humans do not read it except with your permission, for security purposes, or to comply with the law.
• Revoking access — disconnecting the channel inside Zilowy revokes Zilowy's access at Google and deletes the stored tokens. You can also revoke it at any time from your Google Account security settings at security.google.com/settings/security/permissions; Zilowy checks every connected channel daily and, once access is revoked, deletes the stored tokens and channel data. The record of the videos you published through Zilowy stays in your publication history until you delete it or close your account. You can ask us at privacy@zilowy.com to delete all of your YouTube data, and we do so within 7 days.

Zilowy's use and transfer of information received from Google APIs adheres to the Google API Services User Data Policy, including the Limited Use requirements.

9. Data obtained through Threads (Meta)

When you connect a Threads profile, you sign in with Threads and grant Zilowy access through Meta's Threads API. Meta's own handling of your data is described in the Meta Privacy Policy. Specifically:

• What we access — with threads_basic, your Threads user ID, username, name, profile picture and bio. With threads_content_publish, the ability to publish text, image, video and carousel posts to your profile. With threads_read_replies and threads_manage_replies, the replies to your posts and the ability to answer them and to hide or unhide them. With threads_manage_insights, your follower count and the views, likes, replies, reposts, quotes and shares of your profile and posts. With threads_delete, the ability to delete your posts and your own replies.
• How we use it — to show which profile is connected; to publish, schedule, reply, hide or delete on your own profile, only when you ask for it in Zilowy or through an API token you created; and to show you how your profile and posts perform over time. Zilowy never posts, replies or deletes on its own initiative.
• What we store — the profile ID and username; the encrypted access token; for each post you publish through Zilowy, its Threads post ID and the options you chose; the list of posts on your profile (text, link, media type, preview image address and date) with a daily snapshot of their counters; a daily snapshot of your follower count and views; and the replies to your posts, so the comment inbox works.
• Sharing — Threads data is never sold, used for advertising, or shared with third parties, other than the infrastructure processors in section 5 that are strictly necessary to operate the Service.
• Disconnecting and deletion — disconnecting the profile inside Zilowy, or removing Zilowy from the Threads app (Settings → Account → Website permissions), deletes the stored token and the cached list of posts straight away. The follower and post statistics already captured, and the cached replies, stay in your history until you ask us to delete them or close your account. If you ask Meta to delete the data Zilowy received from Threads, we delete the connection, the cached posts and replies, and every statistic we captured for that profile, and Meta gives you a confirmation code you can check on our data deletion page. You can also write to privacy@zilowy.com.

Our use of information received from the Threads API adheres to the Meta Platform Terms and the Meta Developer Policies.

10. International transfers

Some processors (for example Stripe and certain AI providers) may process data outside the European Economic Area. Where that happens, transfers are covered by appropriate safeguards such as the European Commission's Standard Contractual Clauses.

11. Retention

We keep your account and content data for as long as your account is active. When you delete content, or disconnect an account or storage provider, the associated data and credentials are removed. We may retain limited records where required for legal, accounting or security purposes. How to delete your data or your whole account is explained on our data deletion page.

12. Your rights

Under the GDPR you have the right to access, rectify, erase, restrict and port your personal data, and to object to certain processing. You can exercise these rights by contacting privacy@zilowy.com. You also have the right to lodge a complaint with your supervisory authority (in Italy, the Garante per la protezione dei dati personali).

13. Security

We apply technical and organizational measures appropriate to the risk, including encryption of third-party credentials and tokens at rest, hashed passwords, HTTPS-only cookies, and access controls. No method of transmission or storage is completely secure, but we work to protect your data.

14. Cookies

We use a strictly-necessary session cookie to keep you signed in to app.zilowy.com, and a zly_consent cookie, shared by www.zilowy.com and app.zilowy.com, that remembers your analytics choice for six months.

On both sites, Google Analytics sets the _ga and _ga_Y0PP2HFKNH cookies (13 months), only after you accept. If you reject or ignore the banner, no analytics cookie is set and nothing is sent to Google, from your browser or from our servers. You can change your choice at any time from “Cookie settings” in the footer of www.zilowy.com, on the login page, or in the account menu of the app. We do not use advertising cookies.

15. Children

The Service is intended for adults and is not directed to anyone under 18. We do not knowingly process the personal data of children.

16. Changes to this policy

We may update this policy from time to time. When we do, we will revise the “Last updated” date above and, where appropriate, notify you within the Service.

17. Contact

Woobik di Silva Cordeiro Pedro Henrique (Woobik Studio)
Via Barberini 54, 61040 Monte Porzio (PU), Italy · VAT IT02692610419
privacy@zilowy.com