Zesty AI ("we", "us", or "our") is committed to protecting your personal information. This Privacy Policy describes our practices regarding the collection, use, storage, disclosure, and safeguarding of information when you access or use the Zesty AI mobile application (distributed via Google Play), our official website, and all related functionalities (collectively referred to as the "Services").
By downloading, installing, accessing, or using the Services in any manner, you confirm that you have read, understood, and consent to the practices described in this Privacy Policy and our Terms of Service. If you do not agree with any part of this Policy, you must discontinue use of the Services immediately.
Definition of Personal Data: For the purposes of this Policy, "Personal Data" refers to any information that directly identifies an individual or can be reasonably linked to a specific person. Aggregated, anonymized, or de-identified data that cannot be traced back to an individual does not constitute Personal Data and may be utilized without restriction.
Our data-collection framework is built on three distinct channels: (a) information you actively submit to us, (b) media assets you elect to upload for AI-powered processing, and (c) technical metadata automatically produced during your interaction with the Services. Each channel is detailed in the sections that follow.
Voluntarily submitted information may encompass your email address, chosen display name, and profile details from linked social-network accounts when you register, communicate with our support team, or interact with the Services. For a granular breakdown, refer to Section 2 (Registration & Authentication Data) and Section 3 (Media Uploads & Processing Pipeline).
2.1 Certain interactive features (including content sharing and cloud synchronization) necessitate completion of an authentication flow.
2.2 When you establish an account through a federated identity provider (such as Google, Facebook, or Apple), we obtain the profile information associated with that provider — including your name, email address, public username, and any supplementary details you disclose during the sign-up process.
2.3 All authentication-related records are permanently erased at the same time your account is removed from our systems.
2.4 Account deletion and associated-data removal can be initiated at any moment through the in-app self-service portal or by reaching out to our support personnel. Comprehensive procedures are set forth in Section 14.
To leverage the AI image or video generation capabilities, you must select and upload photographs or video clips. The Application will explicitly prompt for permission to read your device's media library or file system. This permission can be revoked at any time through your operating-system settings.
Every uploaded asset travels over encrypted channels (SSL/TLS), and we implement industry-standard technical and organizational safeguards to protect data integrity throughout transmission and processing.
It is your sole responsibility to preserve generated deliverables to your device before they are automatically purged from our systems.
4.1 Depending on the selected generation model, our Services may execute body-silhouette detection, facial-region localization, facial-feature extraction, skeletal-key-point identification (e.g., head, neck, shoulders, torso, wrists), and apparel segmentation on submitted imagery or footage. This information is used strictly to render the requested output, is briefly held in server memory during computation, and is destroyed immediately upon completion.
4.2 Under no circumstances do we employ user photographs, videos, or generated artifacts to train, fine-tune, or enhance our AI models.
4.3 Facial key points and analogous biometric data are never harvested without the explicit prior consent of the individual depicted (manifested by granting media-library access).
4.4 Prior to destruction, such data is stored, transmitted, and defended using safeguards equivalent to or exceeding those applied to other confidential identifying information (including authentication data such as email addresses).
4.5 We do not deploy facial, skeletal, or body-detection data to identify, authenticate, or verify any individual, nor do we construct biometric templates or user profiles from such data.
4.6 All derived data exists solely to generate the requested AI output and is annihilated immediately after processing; zero replicas survive thereafter.
As you interact with the Services, certain device- and network-related information is generated automatically. We gather the following categories of technical telemetry:
The exclusive objective of collecting the foregoing telemetry is to guarantee secure, stable Service operation, fine-tune performance, and diagnose systemic anomalies.
Personal Data and Service Data are leveraged for the following legitimate purposes:
7.1 The photographs and videos you submit for AI processing are never divulged to external parties, save for instances where you voluntarily elect to share the generated results yourself.
7.2 We may disclose Personal Data (and non-personal information) to service providers operating on our behalf (such as data-management, hosting, and infrastructure vendors), and we may disseminate aggregated, non-personally-identifying Log Data for analytical and promotional purposes. The entities involved are enumerated in Section 8.
7.3 Personal Data may be disclosed exclusively under the following conditions:
We will not expose your uploaded imagery or footage to any external service unless you voluntarily share it (alongside the results) through the Services or a third-party platform.
We may incorporate third-party services to bolster analytics, advertising, or infrastructure resilience. These partners may collect limited technical data pursuant to their respective privacy policies.
All third-party vendors are contractually obligated to adhere to applicable data-protection legislation. Advertising-related partners may collect advertising identifiers solely for attribution and fraud mitigation. You may examine their data-processing protocols through their official policies or restrict collection via their opt-out mechanisms. We do not authorize any third party to exploit collected information for purposes unrelated to our Services.
10.1 When you authenticate via a third-party service (e.g., Google), you may be redirected to a web property operated by that provider.
10.2 The third-party provider may employ Cookies or analogous technologies to maintain your authenticated session and finalize identity verification.
10.3 We do not deploy Cookies for advertising, tracking, or analytics, nor do we independently access or archive these Cookies. Any Cookies utilized during federated authentication are governed by the relevant third party and its privacy policy.
10.4 Our Application does not use Cookies to track users across disparate applications or websites.
The Application may request the following permissions, each confined strictly to its declared purpose:
| Data Category | Retention Period |
|---|---|
| Account & authentication data | Until account deletion |
| Uploaded photos & videos | Deleted immediately post-processing |
| Generated results | Auto-deleted within 48 hours |
| Telemetry & operational logs | Only as long as operationally or legally necessary |
Depending on your jurisdiction of residence, you may be entitled to the following rights:
To exercise these rights, submit a written request to the contact listed in Section 21, including your name, registered email or account identifier, contact details, and the specific right you wish to invoke. Where applicable, include identity-verification documentation. We will respond within 15 working days; if we are unable to honor the request, we will furnish a written explanation of the rationale and legal basis.
You may initiate account and data deletion through any of the following channels:
Following deletion, all relevant Personal Data will be erased, subject to compliance with legal and technical obligations (e.g., backup archives).
We deploy technical and organizational measures designed to protect your privacy and forestall unauthorized access or misuse, continuously updating these measures as technology evolves. That said, we cannot guarantee that unauthorized third parties will never circumvent our security controls. If you utilize a password to access the Services, you bear responsibility for maintaining its confidentiality.
15.1 Transmission Security: All data (including uploaded media and Personal Data) is conveyed over TLS 1.2+ encrypted protocols.
15.2 Storage Security: Sensitive data resides on encrypted servers (AES-256), with access granted solely to authorized personnel on a need-to-know basis (requiring multi-factor authentication).
15.3 Access Governance: A stringent permission-classification regime constrains internal access to user data, with all access events recorded in immutable audit logs.
15.4 Incident Response: In the event of a data breach, we will notify affected users within 72 hours of discovery (where mandated by applicable law) and undertake remedial measures and reporting to the appropriate authorities.
Minors must obtain prior consent from a parent or legal guardian before using the Services. We strongly advise guardians to review this Policy carefully and counsel minors to seek guidance before submitting Personal Data.
If you are a guardian and discover that a minor (below the age of 13) has used the Services and submitted Personal Data without authorization, you may file a deletion request with the contact in Section 21. The request must include the guardian's government-issued identity document, proof of the guardianship relationship (e.g., household register, birth certificate), and the minor's account information (if available). We will expunge the relevant data within 15 working days of verifying the submitted materials.
COPPA Compliance: We honor children's privacy in accordance with the Children's Online Privacy Protection Act. We do not knowingly collect or solicit information from individuals under 13, nor permit such individuals to register. If we discover that we have collected Personal Data from a child under 13 without parental consent, we will delete it expeditiously. If you believe we may hold such information, please contact us at [email protected].
User data may be processed on servers situated outside your country of residence. We will implement appropriate safeguards (such as standard contractual clauses where required) to protect such transfers in compliance with applicable data-protection legislation.
For users located in the European Economic Area or the United Kingdom, we process Personal Data on the following legal bases:
This Privacy Policy is aligned with the declarations in the Google Play Data Safety section. All data-collection, usage, sharing, and retention practices conform to those disclosures, including the specification of the following data types and purposes:
We do not share user-provided photos, videos, or generated content with third parties except as described in Section 7 and Section 8.
We may revise this Privacy Policy periodically. For material changes (including expansion of the data-collection scope, alterations in usage purposes, or modifications to sharing recipients), we will notify you of the changes and their effective date at least 30 days in advance via in-app notices or email to your registered address. Immaterial changes will be communicated through in-app notifications. Your continued use of the Services following the effective date constitutes acceptance of the amended Policy; if you do not agree, you should cease using the Services and delete your account.
If you have any questions, concerns, or requests regarding this Privacy Policy, please reach out to us at:
Email: [email protected]
We endeavor to respond to all privacy-related inquiries within 15 working days.