Privacy Policy

Welcome to ZorgSocial.com ("ZorgSocial," "we," "our," or "us"). ZorgSocial.com, ZorgSocial, and the Zorg logo and character are copyrighted and owned by QUANTIMEDX COMPUTER SYSTEMS TRADING L.L.C, a Dubai-based company in the United Arab Emirates.

This Privacy Policy describes how we collect, use, disclose, and safeguard your information when you visit our website ZorgSocial.com, use our mobile applications, and use our AI-powered marketing strategy platform and services (collectively, the "Service").

By using our Service, you agree to the collection and use of information in accordance with this Privacy Policy. Certain processing activities — including the sharing of your content with third-party AI services described in Section 3 — occur only with your separate, explicit consent, which you may withdraw at any time. If you do not agree with the terms of this Privacy Policy, please do not access or use the Service.

IMPORTANT: This section specifically governs how we handle data obtained through Google API Services, including Google Analytics, YouTube and YouTube Analytics, Google Drive, Google Ads, Google My Business, and other Google services. ZorgSocial is a marketing suite in which you connect your own Google accounts to create, publish, and analyze marketing content. All access to your Google data is per-user, occurs only at your explicit request, and is never shared with third parties.

2.1 Limited Use Requirements

ZorgSocial's use and transfer of information received from Google APIs adheres to the Google API Services User Data Policy, including the Limited Use requirements.

Data obtained from Google APIs is used EXCLUSIVELY for the following purposes:

• Providing and maintaining the features you have explicitly requested within ZorgSocial
• Improving the user experience and functionality of features that directly interact with your Google-connected accounts
• Displaying your Google business information within your ZorgSocial dashboard
• Publishing content to your connected Google platforms as you specifically direct
• Providing analytics and performance insights for your Google-connected accounts

2.2 Prohibited Uses of Google API Data

We explicitly DO NOT and WILL NOT:

• Use Google API data for our own advertising purposes or to serve ads to you (creating and managing campaigns in your own Google Ads account at your direction, as described in Section 2.7, is your advertising, not ours)
• Use Google API data to train AI models or machine learning systems beyond direct improvement of your specific user experience
• Transfer Google API data to third parties except as necessary to provide the requested service to you
• Use Google API data for credit decisioning or lending purposes
• Allow humans to read Google API data unless: (a) you have explicitly consented, (b) it is necessary for security purposes, or (c) required to comply with applicable law
• Send you marketing communications using data obtained from Google APIs
• Send Google API data to the third-party AI services described in Section 3, except where a specific feature you invoke requires it and you have explicitly consented

2.3 Google Services We Connect To and the Access We Request

When you connect a Google account, we request only the minimum OAuth scopes needed for the feature you are enabling. You may connect each service independently, and you are shown the specific permissions in Google's consent screen before any access is granted. The table below summarizes each Google service, the level of access we request, and what we do with it.

We do not request any Google scope that is not listed above. If we add a new Google service or broaden an access level, we will update this table and ask you to grant the additional permission through Google's consent screen before it is used.

2.4 Google Analytics (Read-Only)

When you connect your Google Analytics properties, you authorize ZorgSocial's analytics agent to run read-only reports on those properties. The agent queries the Google Analytics API at your request to build dashboards, custom reports, and insights covering traffic, engagement, conversions, and audience metrics.

• Read-only access: we can only read reporting data; we cannot change your Google Analytics configuration, properties, or settings.
• Your own properties only: reports are run solely on the properties you connect and are visible only to you within your ZorgSocial account.
• No storage of Google Analytics data: the analytics agent queries your data live each time you request a report. We do not copy, cache, or store your raw Google Analytics data on ZorgSocial servers.
• Not used for any other purpose: Google Analytics data is never used for advertising, profiling, AI model training, or shared with the AI Providers in Section 3 beyond the read-only reporting request you make.

Note that this is different from our own use of analytics tools on the ZorgSocial website and apps, which is described in Section 11.2 and concerns how you use ZorgSocial, not your connected Google Analytics properties.

2.5 YouTube and YouTube Analytics (Read-Only) and YouTube Upload

When you connect your YouTube channel, we request two kinds of access, each of which you may grant separately:

• Read-only (YouTube and YouTube Analytics): we view your own channel, video metadata (titles, descriptions, thumbnails, publish dates), and YouTube Analytics reports such as views, watch time, and subscribers. This data is used only to help you plan content and to display performance dashboards inside ZorgSocial. It is not stored on our servers beyond the current session.
• Upload: we publish marketing videos that you create in ZorgSocial directly to your own YouTube channel. Every upload is initiated by you, and the app shows you the video, title, and destination channel and asks for your approval before anything is published.

We never modify, delete, or comment on existing videos on your channel, change channel settings, or publish content without your express approval for that specific upload.

2.6 Google Drive

When you connect Google Drive, you can use your own files — logos, brand images, documents, and reference media — as inputs for AI content generation, and you can save the images, videos, audio, and other assets you produce in ZorgSocial back to your Drive.

• Reading files (drive.file): you explicitly select each file you want to use, and we read only those files. We do not scan, index, or browse your Drive, and we cannot read any file you have not chosen.
• Saving files (drive.file): we create new files in your Drive containing the productions you choose to export. This scope only allows us to access files that ZorgSocial itself created.
• You are always prompted: every retrieval from Drive and every save to Drive requires your approval in the app at the time of the action. Connecting your Drive account does not by itself allow any file to be read or written.
• We never modify or delete existing files: we do not edit, overwrite, move, share, or delete any file in your Drive that ZorgSocial did not create.
• AI processing of Drive files: if you use a file retrieved from Drive as an input to an AI feature, it is processed under the rules in Section 3 and only with the consent described in Section 3.4. The file is retained in your ZorgSocial job history only if you use it in a job, and you may delete it at any time.

2.7 Google Ads

When you connect your Google Ads account, ZorgSocial acts on that account only at your direction to:

• Create campaigns: build and launch campaigns in your own Google Ads account, including direct Demand Gen ads on YouTube using the videos and creatives you produce in ZorgSocial. The app shows you the campaign details, budget, and targeting and requires your approval before a campaign is created or changed.
• Retrieve keyword data: retrieve keyword-related data (such as keyword ideas, search volume, and competition metrics) to help you plan ad targeting. This data is used solely to provide you with recommendations inside ZorgSocial.
• View performance: read campaign, ad group, and ad performance metrics from your own account to display reporting and insights in your dashboard.

We never spend your advertising budget, change bids, or launch or pause campaigns without your explicit approval for that action. Google Ads data from your account is never used to advertise ZorgSocial, to target you or anyone else, or for any purpose other than the campaign management and reporting you request.

2.8 Per-User Access, Storage, and Sharing of Google Data

The following principles apply to every Google service listed in this section:

• Per-user, per-request access: your Google credentials are used only to act on your own accounts, only within your own ZorgSocial account, and only when you take an action that requires them. No other ZorgSocial user, and no ZorgSocial staff member, can access your Google data through your connection.
• Minimal storage: we store only the OAuth tokens needed to keep your connection active (encrypted at rest) and the specific files or videos you explicitly import or create. We do not store Google Analytics, YouTube Analytics, or Google Ads reporting data; it is queried live and displayed to you.
• No sharing with third parties: we do not sell, share, transfer, or disclose your Google data to any third party. Google data is sent to the AI Providers in Section 3 only when a specific feature you invoke requires it (for example, generating content from a Drive file you selected) and only with your consent.
• Disconnect at any time: you can disconnect any Google service in Settings → Connected Accounts, or revoke ZorgSocial's access from your Google Account permissions page at https://myaccount.google.com/permissions. Upon disconnection, we delete the associated tokens and any Google data held for that service, subject to Section 8.
• Limited Use: all of the above is subject to, and consistent with, the Google API Services User Data Policy Limited Use requirements in Section 2.1.

Core features of ZorgSocial — including Easy Zorg chat, image generation and editing, video generation and editing, audio, music, transcription, translation, and dubbing — are powered by third-party AI model providers. This section explains exactly what data is sent, who it is sent to, why, and how you control it.

privacy.section3.mobilePolicyNote

3.1 What Data Is Sent to Third-Party AI Services

When you use an AI-powered feature, the following data is transmitted to one or more of the third-party AI providers listed in Section 3.2, depending on the feature and model you select:

• Content you upload for processing: images and photographs (including photographs that may contain identifiable faces), videos, audio recordings, voice samples, music files, PDFs, and documents you attach as inputs or reference media
• Text you enter: prompts, instructions, chat messages, and editing directions
• Conversation context: relevant portions of your current chat session needed for the AI to understand your request, and summaries of prior turns
• Generated outputs you iterate on: previously generated images, videos, or audio that you feed back for further editing
• Technical processing metadata: file format, resolution, duration, and job parameters required to run the model

We do not send your name, email address, payment information, contacts, precise location, or connected social media account credentials to AI model providers. Requests are transmitted under ZorgSocial's own service credentials; providers do not receive your ZorgSocial account identity.

3.2 Who the Data Is Sent To

Depending on the feature and model you choose, your content is sent to one or more of the following providers ("AI Providers"):

We will update this table before adding any new AI Provider. Where the Easy Zorg agent recommends or you select a community model hosted on fal.ai, or a language model accessed through OpenRouter, your content passes through that platform's infrastructure to the operator of the selected model; the app identifies the specific model and, where known, its operator before the job runs and asks for your approval.

All providers and intermediaries in this table — including fal.ai, OpenRouter, and any model made available through either of them — are bound by the Zero Data Retention and Training standard in Section 3.7.

3.3 Why the Data Is Sent (Purposes)

Your content is sent to AI Providers solely to:

• Generate, edit, composite, upscale, extend, or transform the images, videos, audio, and text you request
• Analyze and describe reference media you attach so outputs match your intent
• Enable the AI agent to reason about your request, plan multi-step workflows, and select appropriate tools
• Transcribe, translate, or dub audio and video at your direction

We do not send your content to AI Providers for advertising, profiling, credit decisioning, or any purpose other than fulfilling the specific request you make.

3.4 Your Permission Is Required Before Any Data Is Sent

• Explicit prior consent: The first time you use an AI-powered feature in our mobile or web app, we display a consent notice identifying the data to be sent and the AI Providers involved. No content is transmitted to any AI Provider until you give your explicit, affirmative consent. Declining consent does not prevent you from using non-AI features of the Service.
• Just-in-time disclosure: When you attach media to a request, the app indicates that the file will be processed by a third-party AI Provider and, where the model is known, identifies it. Every meaningful generation action requires your approval before it runs.
• Withdrawal at any time: You can withdraw your consent in Settings → Privacy → Third-Party AI Processing in the app, or by contacting legal@zorgsocial.com. After withdrawal, no further content is transmitted to AI Providers. Withdrawal does not affect the lawfulness of processing carried out before withdrawal.
• Photos of people: If you upload photographs of identifiable individuals (including for portrait and face-editing features), you confirm that you have the necessary rights and, where required by law, the consent of those individuals. We do not use facial data to identify individuals, and we do not build facial recognition databases.

3.5 Equal Protection by AI Providers

We only engage AI Providers that are bound by contractual terms — including data processing agreements where applicable — requiring them to provide protection for your data that is the same as or equal to the protections in this Privacy Policy, including:

• Processing your content only to provide the requested service (not for their own advertising)
• Not using your content to train, fine-tune, or evaluate their generalized AI models, under the enterprise/API terms in place with each provider and the Zero Data Retention and Training standard in Section 3.7
• Applying encryption in transit and appropriate security measures
• Zero data retention: content is not retained after your request is processed, as set out in Section 3.7
• Complying with applicable data protection laws, including GDPR requirements for international transfers (Section 10)

If an AI Provider cannot meet these standards, we do not send your data to it.

3.6 How Long We Keep AI Content

Your uploads, prompts, and generated outputs are stored on ZorgSocial's own infrastructure so you can access your job history and reuse sessions. You may delete individual jobs, sessions, or your account at any time; deletion follows the retention rules in Section 8.

3.7 Zero Data Retention and No-Training Commitment

ZorgSocial applies a Zero Data Retention and Training ("ZDRT") standard to all third-party AI processing of your content.

Provider and intermediary obligations. Every AI Provider and every intermediary platform (such as fal.ai and OpenRouter) that processes your content is contractually and technically bound to:

• Process your content only for the duration of your request
• Not persist, log, or cache your content beyond completion of your request, except where retention is mandated by law
• Not use your content to train, fine-tune, or evaluate any AI or machine learning model
• Not disclose your content to any sub-processor that is not bound by the same obligations

Where a provider makes a zero-data-retention tier available, ZorgSocial uses that tier exclusively.

Automatic enforcement on every request. Every request ZorgSocial sends to an AI Provider includes the flags, headers, or opt-out parameters required to enforce the ZDRT standard, including the OpenRouter zero-data-retention routing parameter where applicable, and prompt logging is disabled. These settings cannot be disabled by any user, feature, or workflow, and no action is needed on your part.

Providers that cannot meet the ZDRT standard are not used: ZorgSocial will not route your content to them. The app identifies such providers before the job runs and requires your specific approval before any exception is considered.

Verification and updates: we periodically review each provider's ZDRT compliance. Before adding any provider to Section 3.2, we will update that Section and this Section 3.7.

4.1 Information You Provide Directly

• Account Information: Name, email address, company name, job title, phone number, and billing address — collected when you register or update your account
• Profile Information: Profile picture, bio, industry sector, and marketing preferences — collected when you complete your profile
• Payment Information: Credit card details and billing information — collected at purchase and processed securely by third-party payment processors; we do not store full card numbers
• Communication Data: Messages, feedback, support requests, and correspondence — collected when you contact us
• Uploaded Content: Images, photos, videos, audio, voice samples, documents, and other media you upload — collected when you attach them in the app (see Section 3 for AI processing)
• AI Interaction Data: Prompts, chat messages, instructions, and the outputs generated for you — collected as you use AI features

4.2 Information Collected Automatically

• Device Information: IP address, browser type, device type and model, operating system, app version, and unique device identifiers — collected via the app and our servers when you use the Service
• Usage Analytics: Pages and screens visited, features used, time spent, click patterns, and navigation paths — collected via first-party logging and analytics tools
• Performance Data: Platform performance metrics, error logs, crash reports, and system diagnostics — collected automatically by the app and our infrastructure
• Location Data: General geographic location derived from IP address (not precise GPS location) — collected from your connection metadata
• Cookies and Similar Technologies: As described in Section 11 — collected via your browser or device, subject to your cookie preferences

4.3 Information from Device Permissions (Mobile App)

With your permission granted through iOS or Android system prompts, the app may access:

• Photo library / camera: only to let you select or capture media you choose to upload
• Microphone: only to record audio you choose to use in AI features

The app accesses only the items you select; granting a permission never causes background collection of your media.

4.4 Information from Third Parties

• Connected social media accounts: account handles, page data, audience metrics, and content performance from platforms you connect
• Google API data: Google Analytics reports, YouTube channel and analytics data, Google Drive files you select, and Google Ads campaign and keyword data — accessed only from accounts you connect and as governed exclusively by Section 2
• Third-party marketing tools: data from integrations you enable

4.5 Content and Marketing Data

• Marketing Content: Social media posts, campaigns, images, and creative materials you create or upload
• Strategy Data: Marketing strategies, campaign performance data, and analytics insights
• Integration Data: Information from connected social media accounts and third-party marketing tools (including Google API data, governed by Section 2)

NOTE: The use limitations in Section 2 apply specifically to data obtained from Google APIs, and the limitations in Section 3 apply to data sent to AI Providers. The following describes all uses of the data we collect:

5.1 Service Provision

• Provide, operate, and maintain the ZorgSocial platform and mobile apps
• Process your AI generation requests by transmitting your content to the AI Providers identified in Section 3.2, with your consent
• Store your job history, sessions, and outputs so you can browse, reuse, and download them
• Process transactions and manage billing
• Create and manage user accounts
• Facilitate social media campaign management, scheduling, and publishing

5.2 Improvement and Analytics

• Analyze usage patterns to improve our services
• Develop new features and functionality
• Conduct research and analytics to enhance user experience
• Improve platform behavior (e.g., prompt routing, tool selection, personal preferences memory) solely to enhance your individual experience within the platform

IMPORTANT: We do not use your uploaded media, prompts, or outputs to train generalized AI models, and our contracts with AI Providers prohibit them from doing so, enforced by the zero-retention request settings described in Section 3.7 (Sections 3.5 and 3.7). Data obtained from Google APIs is NEVER used for AI model training.

5.3 Communication

• Send service-related notifications and updates (e.g., job completion, security alerts)
• Provide customer support and respond to inquiries
• Send marketing communications about ZorgSocial services (with your explicit consent, and NEVER using data from Google APIs or content sent to AI Providers)

5.4 Legal and Security

• Comply with legal obligations and regulatory requirements
• Protect against fraud, security threats, abuse, and misuse of AI features (including content-safety screening of uploads and prompts)
• Enforce our Terms of Service and other policies
• Resolve disputes and investigate potential violations

We do not sell, trade, or rent your personal information to third parties. We share your information only in the following circumstances:

6.1 Third-Party AI Providers

With your explicit consent, we share the content described in Section 3.1 with the AI Providers listed in Section 3.2, solely to fulfill your generation and editing requests, under the protections described in Sections 3.5 and 3.7.

6.2 Service Providers

We share information with trusted third-party service providers who assist us with:

• Payment processing and billing services
• Cloud hosting and data storage
• Analytics and performance monitoring (excluding Google API data)
• Email delivery and communication services
• Customer support and help desk services

All service providers are bound by contracts requiring confidentiality, security, and use of your data only on our instructions.

6.3 Social Media Platforms

• Information necessary to publish content to connected social media accounts, as you direct
• Analytics data to provide campaign performance insights
• Data required for social media platform integrations and APIs

6.4 Legal Requirements

• When required by law, regulation, or court order
• To protect the rights, property, or safety of ZorgSocial, our users, or the public
• In connection with legal proceedings or investigations
• To enforce our Terms of Service or other agreements

6.5 Business Transfers

In the event of a merger, acquisition, or sale of business assets, user information may be transferred as part of the transaction, subject to appropriate confidentiality protections, continued compliance with the Google API Services User Data Policy, and continuation of the consent-based protections in Section 3.

We implement appropriate technical and organizational security measures to protect your personal information:

• Encryption: Data is encrypted in transit and at rest using industry-standard protocols (TLS 1.3, AES-256), including all transmissions to AI Providers
• Access Controls: Strict access controls and authentication mechanisms; human access to your uploaded content is limited to what is necessary for support (at your request), security, or legal compliance
• Regular Audits: Regular security audits and vulnerability assessments
• Secure Infrastructure: Hosting on secure, certified cloud infrastructure
• Employee Training: Regular security and privacy training for all team members
• Incident Response: Comprehensive incident response and breach notification procedures, including notification to affected users and authorities where required by law

Note: While we strive to protect your personal information, no method of transmission over the internet or electronic storage is 100% secure. We cannot guarantee absolute security but are committed to using industry best practices.

We retain your personal information for as long as necessary to provide our services and fulfill the purposes outlined in this Privacy Policy:

• Account Data: Retained while your account is active and for a reasonable period after account deletion
• Uploaded Content, Prompts, and AI Outputs: Retained in your job history until you delete the job, session, or your account
• AI Provider Copies: Not retained. AI Providers and intermediaries process your content under the Zero Data Retention and Training standard in Section 3.7 and do not store it after your request completes
• Marketing Content: Retained as long as necessary to provide campaign management services
• Usage Analytics: Aggregated and anonymized data may be retained indefinitely for product improvement
• Legal Requirements: Some data may be retained longer to comply with legal obligations
• Backup Systems: Data in backup systems is deleted in accordance with our backup retention policies
• Google API Data: Google Analytics, YouTube Analytics, and Google Ads reporting data is queried live and not stored; files and videos you explicitly import from or publish to Google are kept in your job history until you delete them; connection tokens are deleted when you disconnect your Google account or delete your ZorgSocial account (Section 2.8)

Upon account deletion, we will delete or anonymize your personal information within 90 days, except where longer retention is required by law.

Depending on your location, you have the following rights regarding your personal information:

9.1 Access and Portability

• Request access to your personal information
• Receive a copy of your data in a portable format
• Request information about how your data is processed, including which AI Providers have processed your content

9.2 Correction and Updates

• Correct inaccurate or incomplete personal information
• Update your account and profile information

9.3 Deletion and Restriction

• Request deletion of your personal information, including uploaded media, prompts, and generated outputs
• Restrict or limit processing of your data
• Object to certain types of data processing
• Revoke access to your Google account at any time through your account settings

9.4 Consent Management

• Withdraw your consent to third-party AI processing at any time in Settings → Privacy → Third-Party AI Processing or by contacting us
• Opt out of marketing emails and communications
• Manage communication and cookie preferences

How to Exercise Your Rights: Contact us at legal@zorgsocial.com, or use the in-app controls described above. We will respond within 30 days (or sooner where required by law).

ZorgSocial is operated by QUANTIMEDX COMPUTER SYSTEMS TRADING L.L.C, based in Dubai, United Arab Emirates. Your information may be transferred to, stored, and processed in the UAE, the United States, Singapore, Germany, and other countries where we, our AI Providers (Section 3.2), or our service providers operate.

When transferring data internationally, we ensure appropriate safeguards are in place:

• Standard Contractual Clauses (SCCs) with data processors and AI Providers, supplemented where necessary by additional technical measures (encryption in transit and at rest)
• The EU–U.S. Data Privacy Framework, where the receiving U.S. provider is certified
• Adequacy decisions from relevant data protection authorities
• Certification schemes and codes of conduct
• Other legally recognized transfer mechanisms

You may request a copy of the relevant safeguards by contacting legal@zorgsocial.com.

We use cookies and similar tracking technologies to enhance your experience:

11.1 Types of Cookies

• Essential Cookies: Necessary for platform functionality and security
• Performance Cookies: Help us understand how users interact with our platform
• Functional Cookies: Remember your preferences and settings
• Marketing Cookies: Used to deliver relevant advertisements (with consent)

11.2 Third-Party Analytics

We may use third-party analytics services like Google Analytics to understand how you use the ZorgSocial website and apps and to improve our services. These services may use cookies and similar technologies. This is separate from, and does not involve, the Google Analytics properties you connect to ZorgSocial for reporting, which are governed by Section 2.4.

11.3 Cookie Management

You can control cookies through your browser settings or our cookie preference center. Note that disabling certain cookies may affect platform functionality. In our mobile apps, tracking (as defined by Apple's App Tracking Transparency framework) occurs only if you grant permission through the system prompt; we do not track you across other companies' apps and websites without it.

ZorgSocial is not intended for use by children under the age of 18. We do not knowingly collect personal information from children under 18. If you believe we have inadvertently collected information from a child under 18, please contact us immediately at legal@zorgsocial.com, and we will take steps to delete such information promptly.

If you are a California resident, you have additional rights under the California Consumer Privacy Act, as amended by the California Privacy Rights Act:

13.1 Your California Rights

• Right to Know: What personal information we collect, use, disclose, and share
• Right to Delete: Request deletion of your personal information
• Right to Correct: Request correction of inaccurate personal information
• Right to Opt-Out: Opt out of the sale or sharing of personal information — we do not sell personal information, and we do not share it for cross-context behavioral advertising
• Right to Limit Use of Sensitive Personal Information: Uploaded media that may reveal sensitive characteristics is used only to provide the features you request
• Right to Non-Discrimination: Not be discriminated against for exercising your rights

13.2 Categories of Personal Information Collected

• Identifiers (name, email, IP address, device identifiers)
• Commercial information (purchase history, billing)
• Internet or network activity (usage data, feature interactions)
• Geolocation data (general location based on IP)
• Audio, electronic, and visual information (media you upload, including photos and voice recordings)
• Professional or employment-related information (job title, company)
• Inferences limited to your in-platform preferences

Disclosure for a business purpose: identifiers and internet activity to service providers; audio/visual/user content to AI Providers with your consent (Section 3).

13.3 How to Exercise Your California Rights

Contact us at legal@zorgsocial.com. We will verify your identity before processing your request. You may designate an authorized agent to act on your behalf.

If you are in the European Economic Area (EEA), United Kingdom, or Switzerland, you have rights under the General Data Protection Regulation (GDPR), the UK GDPR, and the Swiss FADP.

14.1 Controller

The data controller of your personal information is:

QUANTIMEDX COMPUTER SYSTEMS TRADING L.L.C, Dubai, United Arab Emirates. Email: legal@zorgsocial.com

14.2 Legal Bases for Processing

Where uploaded photographs could constitute special-category data (e.g., images revealing health, religious, or biometric characteristics), we process them only on the basis of your explicit consent (Art. 9(2)(a)) and solely to perform the editing or generation task you request. We do not use your images for identification purposes.

14.3 Your GDPR Rights

• Right of access (Art. 15) and right to data portability (Art. 20)
• Right to rectification (Art. 16)
• Right to erasure / "right to be forgotten" (Art. 17)
• Right to restriction of processing (Art. 18)
• Right to object to processing based on legitimate interests (Art. 21)
• Right to withdraw consent at any time, without affecting prior processing (Art. 7(3))
• Right not to be subject to solely automated decisions producing legal or similarly significant effects (Art. 22) — we do not make such decisions about you
• Right to lodge a complaint with a supervisory authority in your EU member state, or with the UK Information Commissioner's Office (ICO) or Swiss FDPIC

To exercise these rights, contact legal@zorgsocial.com or our EU/UK representatives below. We respond within one month, extendable by two months for complex requests as permitted by Art. 12(3).

14.4 International Transfers from the EEA/UK/Switzerland

Because we and several AI Providers are located outside the EEA, transfers of your data are protected by the safeguards in Section 10, principally the European Commission's Standard Contractual Clauses (Module 2: controller-to-processor) with supplementary measures, and the EU–U.S. Data Privacy Framework for certified U.S. providers.

14.5 EU Representative (Article 27 GDPR)

As we are not established in the European Union, we have appointed the following representative in the EU pursuant to Article 27 GDPR. EU data subjects and supervisory authorities may address the representative, in addition to or instead of us, on all issues related to the processing of their personal data:

When contacting our EU representative, please reference QUANTIMEDX COMPUTER SYSTEMS TRADING L.L.C / ZorgSocial.

14.6 UK Representative (Article 27 UK GDPR)

For data subjects in the United Kingdom, our appointed UK representative is:

14.7 Data Protection Officer

For GDPR-related inquiries, you may contact our Data Protection Officer:

Email: legal@zorgsocial.com

Mailing Address: QUANTIMEDX COMPUTER SYSTEMS TRADING L.L.C, Dubai, United Arab Emirates

15.1 UAE Data Protection Law

We comply with the UAE Federal Decree-Law No. 45 of 2021 on the Protection of Personal Data. UAE residents have the right to access, correct, and delete their personal data, and to object to certain processing activities. Cross-border transfers, including to the AI Providers in Section 3.2, are conducted in accordance with the Decree-Law's transfer provisions.

15.2 Other Jurisdictions

If you reside in other jurisdictions with privacy laws (such as Brazil's LGPD, Canada's PIPEDA, or Australia's Privacy Act), you may have additional rights. Contact us at legal@zorgsocial.com to learn more.

For transparency and consistency with our App Store privacy disclosures:

• Data collected and linked to you: account information, purchase/billing information, user content (media, prompts, outputs), usage data, device identifiers
• Data shared with third parties: user content and prompts with the AI Providers in Section 3.2 (only with your consent, and under the Zero Data Retention and Training standard in Section 3.7); analytics identifiers with our analytics providers; publishing data with the social platforms you connect, including videos you approve for upload to your own YouTube channel, assets you save to your own Google Drive, and campaigns you approve in your own Google Ads account (Section 2)
• Data not collected: precise location, contacts, browsing history outside our Service, health data
• Tracking: we do not track you across other companies' apps and websites without your permission via the system tracking prompt
• On-device permissions (photos, camera, microphone) are used solely to let you select or capture content you choose to process

We may update this Privacy Policy from time to time to reflect changes in our practices, technology, legal requirements, or the list of AI Providers in Section 3.2. We will notify you of any material changes by:

• Posting the updated Privacy Policy on our website
• Sending an email notification to registered users
• Displaying a prominent notice in our platform and mobile apps
• Where a change involves sending your data to a new AI Provider or a new purpose, requesting your fresh consent in-app before any such transmission

Your continued use of our services after the effective date of non-material changes constitutes acceptance of the updated Privacy Policy. We encourage you to review it periodically.