# Privacy Policy

> How Zuzana AI handles personal data across its website and Chrome extension.
> Last updated 4 August 2025. This summary is for quick reference; the full
> policy at zuzana.ai/privacy-policy is authoritative.

## Scope

This policy applies to individual website visitors and Chrome extension end
users. Business customers are covered by a separate Data Processing Agreement.

## Data controller and DPO

- **Zuzana AI ApS**, Vejlevangen 6, 2840 Holte, Denmark. CVR: 45761398.
- Privacy contact: privacy@zuzana.ai
- Data Protection Officer: Line Madsen (dpo@zuzana.ai, +45 78 77 50 10)

## Data we collect

- Basic identifiers: email and support messages
- Usage data: IP, device type, pages visited, cookies
- Extension diagnostics: install/uninstall events, error logs, feature usage
- Optional sync data: personal presets, only if you opt in

We do not scrape page content. The extension only sends minimal prompts over
encrypted channels.

## Legal basis (GDPR Art. 6)

- Operating the site: legitimate interests
- Delivering extension features and handling support requests: contract
- Newsletters: consent
- Product improvement: legitimate interests

## Cookies and local storage

- Essential cookies for login and preferences
- Analytics cookies (Matomo, first-party, IP-anonymized, opt-in only)
- The extension stores settings in browser local storage, which you can delete

## Data sharing and transfers

We never sell personal data. Data is shared only with cloud hosting (EU), email
delivery (EU/US with Standard Contractual Clauses), and error tracking (EU).
Transfers outside the EEA use Standard Contractual Clauses plus encryption.

## Security

HTTPS/TLS 1.3 encryption, encrypted secrets management, least-privilege access
with MFA, and routine vulnerability scans and penetration tests.

## Your rights

You can access, rectify, erase, restrict, object to, and port your data, and
withdraw consent. Contact dpo@zuzana.ai or privacy@zuzana.ai; we respond within
30 days.

## Data retention

- Newsletter subscribers: until unsubscribe
- Support emails: 2 years after ticket closure
- Site analytics: 12 months, then aggregated
- Extension diagnostics: 30 days
- Backups: rolling 35-day purge schedule

## Changes

Material updates are announced via a site banner or extension release notes 14
days before taking effect.