Introduction
Zyloo, LLC (“Zyloo”, “we”, “us”), a Delaware limited liability company with its registered office at 131 Continental Dr, Suite 305, Newark, DE 19713, USA, operates a unified API gateway for third-party AI models. This policy explains what personal data we handle when you sign up, browse our site, or send requests through the API.
If anything below is unclear, write to us at privacy@zyloo.io and we will respond within seven days.
What we collect
We only collect what we need to run the service:
- Account information — name and email from your Google or GitHub sign-in.
- Usage metadata — request timestamps, model id, token counts, latency and HTTP status. We do not log prompt or completion content by default.
- Technical data — IP address, user agent and referrer, used for fraud prevention and rate limiting. The IP address you signed up from is also used to derive an approximate country for regional statistics and regional email targeting, and is retained for fraud prevention for the life of the account.
How we use it
- Operate, secure and improve the API gateway.
- Bill you for the tokens you consume and prevent abuse.
- Notify you about service-critical events such as outages or pricing changes.
- Send you product updates and new-model announcements by email — only with your consent; every email includes one-click unsubscribe.
- Comply with legal obligations and respond to lawful requests.
We do not sell, rent or share your personal data with advertisers. We do not use your prompts or completions to train models — ours or anyone else's.
Legal bases
Where the GDPR or a similar law applies, we rely on the following legal bases for processing your personal data:
- Contract — operating the service you signed up for and billing you for usage.
- Legitimate interests — fraud prevention, security, and service analytics.
- Consent — marketing emails such as product updates and new-model announcements.
- Legal obligation — tax and accounting records we are required to keep.
Data retention
- Request payloads (prompt + completion) — not stored. Discarded as soon as the response is sent.
- Request metadata — kept for 7 days, then automatically deleted. Only aggregated token totals are retained for statistics.
- Account and billing records — kept for the lifetime of the account, plus the period required by tax law.
If you need specific data-handling or retention arrangements, contact us at privacy@zyloo.io.
Zyloo Chat
Zyloo Chat (chat.zyloo.io) is a separate product that shares your Zyloo account. Because it is a chat application with history rather than a stateless API, the zero-retention rule described above does not apply to it — your conversations are stored so you can return to them. For anything you do on chat.zyloo.io, this section applies in place of the retention rules above.
- Conversations and messages — the prompts you send and the replies you receive are stored in your account until you delete them.
- Images — pictures you upload for editing and images generated for you are stored and served through our own domain, so the underlying file host is never exposed to your browser.
- Memory — the assistant automatically derives short notes about preferences you state, such as the language you write in, to make later replies more useful. It never records passwords, payment details or credentials. Your chat profile shows how much has been saved and clears all of it in one click.
- Usage counters — how many chat and image requests you have made in the current week, so free-tier limits can be enforced. They reset every week.
- Subscription records — which chat plan you hold, the period it covers, and a reference to the payment, which is held by Whop.
You can delete a single conversation or every conversation at once from inside the app; deletion is immediate and permanent. Deleting your Zyloo account removes your chat data with it. We do not use your conversations, uploads or generated images to train models — ours or anyone else's.
Third-party providers
When you call a model, we forward the request to the upstream provider you selected (OpenAI, Anthropic, Google, xAI, DeepSeek, Moonshot or Zhipu). Each provider has its own privacy policy that governs the request once it leaves our infrastructure. We negotiate zero-retention enterprise terms with every provider where they offer them.
International transfers
Our sub-processors and the model providers you call may be located outside your country, including in the United States (e.g. NOWPayments, Vercel, and the upstream model providers listed above). Where required, transfers of personal data rely on safeguards such as Standard Contractual Clauses or an applicable adequacy framework.
Sharing
We share personal data only with:
- Sub-processors that operate the service (cloud hosting, email, error tracking).
- Legal or regulatory bodies when compelled by a valid legal process.
- An acquirer in the unlikely event of a merger or acquisition, under equivalent privacy commitments.
Security
Data in transit is protected by TLS 1.3. Data at rest is encrypted with AES-256. Access to production systems is restricted and protected by multi-factor authentication, and we monitor for vulnerabilities. Despite our efforts, no system is invulnerable — if we discover a breach affecting you we will notify you without undue delay.
Your rights
Depending on where you live, you may have the right to access, correct, export, restrict or delete the personal data we hold about you. You can delete your account directly from the Profile page in your dashboard; for access or export requests, email privacy@zyloo.io.
Cookies
We use a small number of strictly necessary cookies for authentication and load balancing, and privacy-focused product analytics (PostHog) to understand how the service is used. We do not use third-party advertising cookies. You can disable cookies in your browser, but core features such as signing in will stop working.
Children
Zyloo is not directed to children under 13 (or under 16 in the EU). We do not knowingly collect data from children. If you believe a child has provided personal information, contact us and we will delete it.
Payment methods
We never hold your card or bank details. All payments are processed by our payment providers — NOWPayments for cryptocurrency and Whop for international cards, Apple Pay, Google Pay, Cash App and regional bank methods (SEPA Direct Debit, iDEAL, PSE and SPEI). Crypto checkouts show a one-time address and amount, and card details are entered only on the provider's secure page. If you choose to save a card for automatic top-ups or an auto-renewing subscription, the card itself is stored by Whop, not by us: we keep only a reference to it plus the brand, last four digits and expiry, so we can show you which card is on file and charge it when you have asked us to. You can remove it at any time from the Billing page. Otherwise we retain only the transaction reference and the amount credited, so your balance and receipts stay auditable.
Refund policy
- Credit purchased with crypto (USDT, Bitcoin or any other cryptocurrency) is non-refundable — no exceptions.
- Credit purchased by card, or by a bank method offered at the same checkout (SEPA Direct Debit, iDEAL, PSE or SPEI), can be refunded for the unused remainder of that top-up: email support@zyloo.io from your account address and we will return what is left of it. Credit already spent on requests cannot be returned.
- Subscription plan payments are non-refundable once the period has started, however they were paid.
- If a payment does not credit your balance, email support@zyloo.io with the transaction reference and we will investigate and correct it.
- By continuing to use the platform you agree to these refund terms.
Changes to this policy
When we make material changes we will post the new policy here and notify active users by email. Your continued use of the service after a change means you accept the updated policy.
Contact
Questions, complaints or data requests? Email privacy@zyloo.io. The data controller is Zyloo, LLC, 131 Continental Dr, Suite 305, Newark, DE 19713, USA. You may also escalate to your local data protection authority.