Zestly - Privacy Policy

PRIVACY POLICYLast updated: May 2026This privacy policy (hereinafter the 'Policy') describes how DAPFOR SAS (hereinafter 'the Provider', 'we', 'us', or 'our') collects, uses, stores, and protects the personal data of users of the Zestly service (hereinafter 'the Service'), accessible via the website https://zestly.org (https://zestly.org) and mobile applications.This Policy is drafted in accordance with the General Data Protection Regulation (GDPR) (EU 2016/679), the French 'Data Protection Act', and the California Consumer Privacy Act (CCPA) where applicable.1. DATA CONTROLLERThe data controller is DAPFOR SAS, 26 rue Hector Berlioz, 92500 Rueil-Malmaison, France. For any questions regarding your data, contact us at: info@zestly.org2. DATA COLLECTED2.1 Data You Provide• Account data: name, email address, password (encrypted)• Profile data: preferences, settings• Educational content: documents and images you upload• Generated content: tests, quizzes, exams, summaries, and results• Communications: support requests and correspondence• Voice data: audio recordings transmitted via the voice input feature for transcription (processed in real time, not durably stored by Zestly)• Learning session data: flashcard session history, submitted answers, scores, and progress2.2 Data Collected Automatically• Device data: device type, operating system, browser type, unique device identifiers, push notification token (APNs or FCM) if you enable notifications• Usage data: features used, time spent, actions taken• Connection data: IP address, access times, pages viewed• Location data: approximate location based on IP address (country/region level only)2.3 Data from Third Parties• Authentication providers: if you sign in via Google or Apple, we receive your name and email• Payment providers: Stripe, Apple, or Google provide transaction confirmation (we do not receive or store your payment card details)3. PURPOSES OF PROCESSINGWe process your data to:• Provide, maintain, and improve the Service• Create and manage your account• Process subscriptions and payments• Generate personalized educational content• Enable sharing of tests and exams with other users• Send service-related communications• Respond to support requests• Ensure security and prevent fraud• Comply with legal obligations• Analyze usage and improve user experience (using anonymized/aggregated data)• Send push notifications to your devices (only with your explicit consent)• Optimize your flashcard learning experience (adaptive review of unmastered cards)• Enable group owners to track the progress of their members4. LEGAL BASIS FOR PROCESSINGWe process your data based on:• Contract performance: to provide the Service you requested• Legal obligations: to comply with applicable laws• Legitimate interests: to improve and secure the Service, prevent fraud• Consent: for optional communications or where specifically required5. DATA SHARING5.1 Service ProvidersWe share data with trusted service providers:• Hosting: Scaleway SAS (France/EU) — servers and data storage• Artificial intelligence — content generation: Google LLC (Google Gemini) — document analysis and generation of quizzes, exams, summaries, and flashcards; the contents of your documents are processed by their servers• Artificial intelligence — voice transcription: OpenAI, LLC — transcription of audio recordings via the Whisper service; audio data is transmitted in real time and is not retained by OpenAI beyond immediate processing (in accordance with their API privacy policy)• Payments: Stripe, Inc. — web payment processing• App Distribution: Apple Inc., Google LLC — app store services• Authentication: Google, Apple — if you use social sign-in• Push notifications: Apple Inc. (APNs) and Google LLC (Firebase Cloud Messaging / FCM) — push notification delivery; your device identification token is transmitted to them for this purpose• Analytics: anonymized usage data for service improvement5.2 Shared ContentWhen you share tests, exams, or flashcards:• Recipients can view the content and their results• You control who receives shared content• Public links make content accessible to anyone with the linkWithin collaborative groups:• The group owner and co-managers can view the results, scores, and progress of all group members• Group members can only see their own results• When sending an invitation, the recipient's email address is used to create or retrieve an account5.3 Legal RequirementsWe may disclose data if required by law, court order, or to protect our rights, safety, or property.5.4 Business TransfersIn case of merger, acquisition, or sale of assets, user data may be transferred to the successor entity.We never sell your personal data to third parties.6. INTERNATIONAL DATA TRANSFERSYour data is primarily stored in the European Union. When data is transferred outside the EU (e.g., to US-based service providers), we ensure appropriate safeguards:• EU Standard Contractual Clauses• Adequacy decisions by the European Commission• Binding Corporate Rules where applicable7. DATA RETENTION| Data Type | Retention Period | |-----------------------------------|---------------------------------------------------------| | Account data | Duration of account + 30 days after deletion | | Educational content | Until deletion by user or 24 months after last activity | | Generated content | Until deletion by user or 24 months after last activity | | Shared test results | Until deletion by content owner | | Connection logs | 12 months | | Billing information | 10 years (legal requirement) | | Support communications | 3 years | | Push notification tokens | Duration of account + 30 days after deletion | | Voice data (audio) | Not retained — real-time processing only | | Flashcard session history | Until deletion by user or 24 months after last activity |8. YOUR RIGHTS8.1 GDPR Rights (EU/EEA Residents)You have the right to:• Access your personal data• Rectify inaccurate data• Erase your data ('right to be forgotten')• Restrict processing• Data portability (receive your data in machine-readable format)• Object to processing based on legitimate interests• Withdraw consent at any time• Lodge a complaint with the CNIL (French Data Protection Authority): https://www.cnil.fr (https://www.cnil.fr)8.2 CCPA Rights (California Residents)California residents have the right to:• Know what personal information is collected• Request deletion of personal information• Opt-out of the sale of personal information (we do not sell data)• Non-discrimination for exercising privacy rights8.3 Exercising Your RightsTo exercise your rights, contact us at: info@zestly.orgWe will respond within 30 days (or as required by applicable law). We may request verification of your identity before processing requests.9. CHILDREN'S PRIVACYThe Service is not intended for children under 13. We do not knowingly collect data from children under 13. If you believe we have collected such data, please contact us immediately.For users aged 13-17, parental consent may be required depending on jurisdiction. Parents using the Service for their children are responsible for managing their children's data.10. DATA SECURITYWe implement appropriate technical and organizational measures:• Encryption of data in transit (TLS) and at rest• Secure password hashing• Access controls and authentication• Regular security assessments• Employee training on data protection• Incident response proceduresNo system is completely secure. If you discover a security vulnerability, please report it to: info@zestly.org11. COOKIES AND TRACKINGWe use essential cookies for:• Authentication and session management• Security and fraud prevention• Remembering your preferencesWe do not use advertising cookies or third-party tracking for advertising purposes.12. THIRD-PARTY LINKSThe Service may contain links to third-party websites. We are not responsible for their privacy practices. Please review their privacy policies before providing any personal data.13. CHANGES TO THIS POLICYWe may update this Policy periodically. Significant changes will be notified via email or in-app notification. Continued use after notification constitutes acceptance.The current version is always available at https://zestly.org/legal/privacy (https://zestly.org/legal/privacy)14. REFERENCE LANGUAGEThis Policy may be translated into several languages. In case of divergence, the French version prevails.15. CONTACT USFor privacy-related questions or to exercise your rights:DAPFOR SAS 26 rue Hector Berlioz 92500 Rueil-Malmaison, France Email: info@zestly.orgBy using the Service, you acknowledge that you have read and understood this Privacy Policy.

Zestly