Privacy Policy
1. Data controller
Zyllio, a SASU registered under SIREN number 994 131 274, with registered office at 24 rue des Fleurs, 91470 Limours, France, is the controller for the personal-data processing described in this policy.
For questions about your personal data or to exercise your rights, contact contact@zyllio.com or write to the above address.
2. Scope
This policy covers the Zyllio website, including https://zyllio.com, Zyllio Studio and related services, including https://www.zyllio.one, and communications with Zyllio such as sales, demonstration and support requests.
Applications created with Zyllio Studio may be operated by Zyllio customers. For personal data processed in those applications on a customer's behalf, that customer determines the purposes and means of processing and is generally the controller. Where applicable, Zyllio acts solely as a processor to provide the Platform and under the customer's documented instructions, as governed by the Data Processing Agreement.
3. Data processed, purposes and legal bases
| Context | Data | Purpose | Legal basis |
|---|---|---|---|
| Browsing the public website | The public website collects no personal data or technical browsing data. | Not applicable | Not applicable |
| Creating and managing a Zyllio Studio account | Email address | Create the account, authenticate the user, provide the service and send service communications. | Contract performance or pre-contractual steps |
| Using Zyllio Studio | Project data and content, including text, media, settings, configurations, technical identifiers, API keys or tokens. | Host, process and make projects and requested features available. | Contract performance; processing on the customer's behalf where Zyllio acts as processor |
| Subscription, billing and payment | Billing details, subscription history, invoices and payment status. Card data is processed by Stripe and is not stored by Zyllio. | Manage subscriptions, payment, billing, accounting and fraud prevention. | Contract performance, legal obligations and legitimate interests for fraud prevention |
| Contact and support | Name, email address, request content and attachments. | Respond, support users and follow incidents. | Legitimate interests or contract performance |
| Marketing communications | Email address and communication preferences. | Send news and offers about Zyllio services. | Consent where required, or legitimate interests where permitted. You may object at any time. |
Please do not enter sensitive data, secret keys or unnecessary personal data in fields not intended for that purpose. Users remain responsible for ensuring that they have a legal basis for data imported or configured in a project.
4. Required data
Data required to create or use an account is necessary to provide the service. Failure to provide it may prevent account creation or contract performance. Other data is optional, although its absence may limit our ability to answer a particular request.
5. Recipients and processors
Data is accessible only to authorised Zyllio personnel within their duties and to providers required to deliver the service. These providers may assist with hosting, email, support, billing, payment or security. Zyllio contracts with them using appropriate confidentiality and data-protection safeguards.
| Category | Provider | Data location | Role |
|---|---|---|---|
| Platform hosting | OVHcloud | France — Gravelines | Hosting and infrastructure |
| Payment | Stripe | European Economic Area | Payment processing |
| Email / support | Google Workspace | European Economic Area | Email and support |
Zyllio does not sell, rent, trade or transfer your personal data to third parties for commercial or advertising purposes. It discloses it only to authorised people and the providers above where necessary to provide, secure or improve the service, comply with a legal obligation or defend its rights.
6. Transfers outside the EEA
Data hosted in Zyllio Studio is stored in France with OVHcloud. Zyllio does not transfer that data outside the European Economic Area.
7. Retention
Zyllio retains data no longer than necessary for the purposes described above, subject to legal retention and limitation requirements.
| Data category | Retention period | Outcome |
|---|---|---|
| Account data | For the contractual relationship, then one month | Deletion or anonymisation, except legal archiving |
| Project data | For the subscription, then one month after account closure, including backups | Secure deletion, except legal obligations or Customer instructions |
| Invoices and accounting records | Ten years from the close of the financial year | Intermediate archiving then deletion |
| Contact / support requests | One month after the last interaction | Deletion or anonymisation |
| Prospects and marketing communications | Until consent is withdrawn or three years after the last contact | Deletion or unsubscribe |
| Security logs | One month | Deletion or anonymisation |
8. Cookies and other trackers
The public website uses no cookies or tracking, analytics or advertising technologies. No tracking cookie is placed on your device when you browse it.
Zyllio uses no marketing, advertising or analytics cookies or trackers. Zyllio Studio uses only cookies or tokens strictly necessary for its operation, including authentication, session security and storage of the user's language preference.
9. Security
Zyllio implements appropriate technical and organisational measures to protect data against destruction, loss, alteration, unauthorised disclosure or access. Browser-to-service communications are encrypted in transit using TLS. Measures include access controls, backups, logging and security reviews.
Despite these measures, no transmission or storage can be guaranteed completely risk-free.
10. Your rights
Subject to applicable law, you may access and obtain a copy of your data; request correction, erasure or restriction; object to certain processing based on legitimate interests, including marketing; receive data you provided in a structured, commonly used format where portability applies; and withdraw consent at any time where processing relies on consent.
To exercise these rights, contact contact@zyllio.com. We may request proof of identity only where we have reasonable doubt about your identity. You may also lodge a complaint with the CNIL: www.cnil.fr.
11. Children's data
Zyllio services are not intended for minors. Zyllio does not knowingly collect personal data about minors without the authorisation required by applicable law. If you believe a minor has sent us data without authorisation, contact us so that we can take appropriate steps.
12. Changes to this policy
Zyllio may update this policy to reflect changes in its services, practices or applicable law. The date at the top will be updated. For material changes, Zyllio will provide appropriate notice, for example by email or through the Platform where required.
13. Contact
For any question about this policy or personal-data processing:
Zyllio
24 rue des Fleurs
91470 Limours, France
contact@zyllio.com