Privacy Policy

Summary of key points

This summary provides key points from our Privacy Notice, but you can find out more details about any of these topics below.

• What personal information do we process? Depending on how you interact with us, we may process names, email addresses, passwords, authentication data, and billing addresses.
• Do we process sensitive personal information? No. We do not process sensitive information such as racial or ethnic origin, sexual orientation, or religious beliefs.
• Do we collect information from third parties? Yes — if you sign in with Google, we receive basic profile information from Google as part of that flow.
• How do we process your information? To provide and improve the Services, communicate with you, generate AI-powered recommendation reasoning, prevent fraud, and comply with the law.
• How do we keep your information safe? Encryption in transit, database-level Row Level Security, and access controls — though no method of transmission is 100% secure.
• What are your rights? Depending on where you live, you may have rights to access, correct, delete, or restrict processing of your personal information.
• How do you exercise your rights? The easiest way is by visiting discoverzolo.com/contact, or emailing us.

1. What information do we collect?

Personal information you disclose to us

In short: we collect personal information that you voluntarily provide when you register, express interest in our Services, or otherwise contact us.

The personal information we collect may include:

• Names
• Email addresses
• Passwords
• Contact or authentication data (including your Google account identifier, if you sign in with Google)
• Billing addresses

Sensitive information. We do not process sensitive information (racial or ethnic origin, sexual orientation, religious beliefs, health data, or similar categories).

Payment data. If you subscribe to Premium, payment data (such as your card number) is collected and processed directly by Stripe, our payment processor — we never receive or store your full card number. See Stripe's Privacy Notice.

Social login data. If you register using your Google account, we receive certain profile information about you from Google, as described under How do we handle your social logins? below.

Information automatically collected

In short: some information — such as your IP address and browser/device characteristics — is collected automatically when you use the Services.

This information does not reveal your specific identity but may include device and usage information, your IP address, browser and device characteristics, operating system, and information about how and when you use the Services. We use this primarily to maintain security and operation of the Services, and for internal analytics.

• Log and usage data. Service-related, diagnostic, usage, and performance information our servers collect automatically, including your activity in the app (pages viewed, saves, dismissals, searches) and error reports.
• Location data. The city and coordinates you provide during onboarding, used to personalize nearby recommendations. We do not track continuous or background device location. You can decline to provide this, though some features (like nearby discovery) may not work as well.

Google API. Our use of information received from Google APIs adheres to the Google API Services User Data Policy, including the Limited Use requirements.

Information collected from other sources

In short: if you sign in with Google, we receive limited profile information from Google as part of that authentication flow.

If you register using your Google account, we receive certain profile information about you from Google — typically your name and email address. Any personal information we receive this way depends on your Google account's own privacy settings; Google's use of your information is governed by Google's own privacy notice, not this one.

2. How do we process your information?

In short: we process your information to provide, improve, and administer the Services, communicate with you, for security and fraud prevention, and to comply with the law.

• To create and manage your account. So you can create and log in to your account and keep it in working order.
• To deliver the Services. Including generating your personalized recommendations.
• To respond to inquiries and offer support. Including requests sent via our contact form or email.
• To send administrative information. Details about your account, transactions, or changes to our terms and policies.
• To fulfill and manage your orders. Including your Premium subscription, payments, and cancellations.
• To send marketing and promotional communications, if this is in accordance with your preferences. You can opt out at any time — see What are your privacy rights? below.
• To protect the Services, including fraud monitoring and prevention.
• To identify usage trends, so we can understand how the Services are used and improve them.
• AI-powered recommendation reasoning. We send relevant profile and context data (interests, budget, and location preferences) to our AI provider, Anthropic, to generate natural-language reasoning that explains why a specific experience was recommended to you.

3. What legal bases do we rely on to process your information?

In short: we only process your personal information when we have a valid legal reason to do so — such as your consent, to fulfill a contract, to comply with the law, or for our legitimate business interests.

If you are located in the EU or UK, the GDPR and UK GDPR require us to explain the legal bases we rely on:

• Consent. Where you have given us permission to use your information for a specific purpose. You can withdraw consent at any time.
• Performance of a contract. Where processing is necessary to provide the Services you signed up for.
• Legitimate interests. Where we believe it is reasonably necessary to achieve our legitimate business interests, and those interests do not outweigh your rights — for example, to:
  • Send information about special offers and discounts
  • Analyze how the Services are used so we can improve them
  • Diagnose problems and prevent fraudulent activity
  • Explain our recommendations transparently, so users understand why a suggestion fits them rather than receiving an unexplained black-box result
• Legal obligations. Where necessary for compliance with the law, or to exercise or defend our legal rights.
• Vital interests. Where necessary to protect someone's vital interests, such as preventing harm.

If you are located in Canada, we may process your information where you have given express or implied consent, or in certain legally permitted exceptions (e.g., fraud detection and prevention, or where required by a court order). You can withdraw consent at any time.

4. When and with whom do we share your personal information?

In short: we may share information with the specific third parties listed below, and in certain other situations described here.

We share your data with third-party vendors and service providers who perform services for us and require access to your information to do that work. We have contracts in place with each of them, which limit what they can do with your personal information.

The third parties we share personal information with are:

• AI service providers — Anthropic (generates recommendation reasoning; never receives your name, email, or payment details)
• Functionality and infrastructure — Supabase (database and authentication)
• Invoicing and billing — Stripe (subscription payments)
• User account registration and authentication — Google Sign-In
• Website hosting — Vercel
• Website performance monitoring — Sentry (error reports may include IP address and request context, never your password or payment details)
• Transactional email — Resend (account confirmation, password reset, and similar account-related messages)
• Location & places data — Google Maps Platform

We may also need to share your personal information in these situations:

• Business transfers. In connection with, or during negotiations of, a merger, sale of company assets, financing, or acquisition of all or part of our business.
• Google Maps Platform APIs. We share information with Google Maps Platform APIs (e.g., the Maps API, Places API) to provide location-based features. We store your provided location on our servers for personalization; you may revoke this at any time by contacting us.

5. Do we use cookies and other tracking technologies?

In short: we use cookies to keep you signed in and to maintain the security of the Services.

We use cookies for authentication and session management (via Supabase Auth), and similar technologies to maintain security, prevent crashes, and support basic site functionality. We do not use cookies for third-party advertising or retargeting.

6. Do we offer AI-based products?

In short: yes — features powered by AI are part of the Services.

We provide AI-powered features through a third-party AI service provider, Anthropic. Relevant profile and context data is shared with and processed by Anthropic to enable these features, for the purposes described under What legal bases do we rely on? above.

Our AI features are designed for:

• Personalized recommendations
• Content/text generation (the natural-language reasoning behind each recommendation)

7. How do we handle your social logins?

In short: if you register using your Google account, we may have access to certain information about you.

The Services let you register and log in using your Google account. Where you choose to do this, we receive certain profile information from Google — typically your name, email address, and profile picture. We use this information only for the purposes described in this Privacy Notice. We do not control, and are not responsible for, Google's own use of your information — review Google's privacy policy to understand how they handle your data.

8. Is your information transferred internationally?

In short: we may transfer, store, and process your information in countries other than your own.

Our servers, and the servers of the third parties we work with, are located in the United States. Regardless of your location, your information may be transferred to, stored, and processed in the US and other countries.

If you are located in the EEA, UK, or Switzerland, these countries may not have data protection laws as comprehensive as your own. We rely on the European Commission's Standard Contractual Clauses (SCCs) for transfers of personal information to our third-party providers, which require recipients to protect personal information originating from the EEA or UK in accordance with European data protection standards.

9. How long do we keep your information?

In short: we keep your information for as long as necessary to fulfill the purposes outlined in this notice, unless a longer period is required by law.

We retain your account and profile data for as long as your account is active. If you delete your account, we delete or anonymize your personal data within 30 days, except where retention is required for legal, tax, or fraud-prevention purposes.

10. How do we keep your information safe?

In short: we aim to protect your information through technical and organizational security measures.

We use encryption in transit, database-level Row Level Security, and access controls limiting who can view your data. However, no method of transmission over the internet or electronic storage is 100% secure, so we cannot guarantee absolute security.

11. Do we collect information from minors?

We do not knowingly collect data from, or market to, children under 16. By using the Services, you represent that you are at least 16, or that you are the parent/guardian of a minor and consent to their use of the Services. If we learn we have collected personal information from someone under 16, we will deactivate the account and delete the data. Contact us at team@discoverzolo.com if you become aware of any such data.

12. What are your privacy rights?

Depending on where you live, you may have rights that give you greater access to and control over your personal information, including the right to access, correct, delete, or restrict processing of your information, and to data portability. You can make such a request by visiting discoverzolo.com/contact or emailing team@discoverzolo.com.

Withdrawing consent. Where we rely on your consent to process your information, you can withdraw it at any time using the contact details above.

Opting out of marketing. Unsubscribe at any time via the link in our marketing emails, or by contacting us. We may still send service-related messages necessary for your account.

Account information. You can review or change your account information anytime from your Profile settings, or request full account deletion by contacting us. Upon deletion, we deactivate your account and remove your information from active use, though we may retain limited data to prevent fraud, comply with legal obligations, or resolve disputes.

If you are in the UK and unhappy with how we've handled your information, you may also complain to the Information Commissioner's Office. If you are in the EEA, you may complain to your local data protection authority. If you are in Switzerland, you may contact the Federal Data Protection and Information Commissioner.

13. Controls for Do-Not-Track features

There is currently no uniform technology standard for recognizing Do-Not-Track (“DNT”) signals, so we do not currently respond to DNT browser signals or similar mechanisms. If a standard is adopted that we must follow, we will update this notice.

14. Do United States residents have specific privacy rights?

In short: if you are a resident of California, Colorado, Connecticut, Delaware, Florida, Indiana, Iowa, Kentucky, Maryland, Minnesota, Montana, Nebraska, New Hampshire, New Jersey, Oregon, Rhode Island, Tennessee, Texas, Utah, or Virginia, you may have rights to access, correct, delete, or obtain a copy of your personal information.

Categories of personal information we collect

We retain each of these categories for as long as you have an account with us. We have not sold personal information to third parties for a business or commercial purpose in the preceding twelve months. We have disclosed Identifiers, California Customer Records information, Commercial information, Internet/network activity, and Geolocation data to our service providers (see When and with whom do we share your personal information?) for a business purpose in that time.

Your rights

• Right to know whether we are processing your personal data
• Right to access your personal data
• Right to correct inaccuracies in your personal data
• Right to request deletion of your personal data
• Right to obtain a copy of the personal data you previously shared with us
• Right to non-discrimination for exercising your rights
• Right to opt out of processing for targeted advertising, sale, or certain profiling (not applicable — we do not engage in these practices)

To exercise these rights, contact us via discoverzolo.com/contact or team@discoverzolo.com. We will need to verify your identity before acting on your request. If we decline to act on your request, you may appeal by emailing us; we will respond in writing, and if your appeal is denied you may complain to your state attorney general.

California “Shine the Light” law

California residents may request, once a year and free of charge, information about categories of personal information (if any) we've disclosed to third parties for their own direct marketing purposes. We do not share personal information with third parties for their own direct marketing purposes, but if you'd like to submit such a request, contact us using the details above.

15. Do other regions have specific privacy rights?

Australia and New Zealand

We collect and process personal information under Australia's Privacy Act 1988 and New Zealand's Privacy Act 2020. You have the right to request access to or correction of your personal information at any time by contacting us. If you believe we are unlawfully processing your information, you may complain to the Office of the Australian Information Commissioner or the Office of the New Zealand Privacy Commissioner.

Republic of South Africa

You have the right to request access to or correction of your personal information at any time by contacting us. If unsatisfied with our response, you can contact The Information Regulator (South Africa) at enquiries@inforegulator.org.za.

16. Do we make updates to this notice?

Yes — we will update this notice as necessary to stay compliant with relevant laws. The updated version will be indicated by a revised “Last updated” date. If we make material changes, we will notify you by posting a notice or contacting you directly.

17. How can you contact us about this notice?

If you have questions or comments about this notice, email us at team@discoverzolo.com.

18. How can you review, update, or delete the data we collect from you?

Based on the laws of your country or state of residence, you may have the right to request access to the personal information we collect from you, details about how we've processed it, correct inaccuracies, or delete your personal information. To make such a request, visit discoverzolo.com/contact.