1. Who we are and what this policy covers
This policy explains how zlit.ai, operated from the Republic of Cyprus (we, us), handles personal data about website visitors, account users, billing contacts and people who communicate with us. For these activities, zlit.ai acts as a data controller.
Privacy contact: support@zlit.ai.
General, billing and cancellation: support@zlit.ai.
When we process personal data from a customer's connected Meta advertising account on that customer's instructions, we act as a processor, or as a sub-processor where the customer acts for its own client. That processing is governed by our Data Processing Agreement (DPA).
Personal data is information relating to an identified or identifiable person. Business contact details, online identifiers and pseudonymous records may be personal data. Encryption does not by itself make data anonymous.
2. Information we collect
The information we process depends on how you interact with the website and Service and the features you use.
| Category | Information and sources |
|---|---|
| Account and business information | Name, business email, company information, user role, account preferences and authentication information supplied by you, the organisation inviting you or your sign-in provider. |
| Subscription and billing | Selected plan, payment status, transaction references, billing contact, address and tax details needed for the purchase. Payment credentials are collected through the payment provider's payment flow. |
| Connected Meta account information | Authorisation information, access tokens, granted permissions, account identifiers and related account metadata received from Meta when you connect an account. Customer-directed campaign processing is covered by the DPA. |
| Technical and security information | IP address, browser and device information, request timestamps, authentication events, errors and records needed to operate, troubleshoot and protect the Service. |
| Communications | Messages and attachments you provide when requesting support, a demo, cancellation or assistance with privacy rights. |
| Optional analytics and marketing information | Preferences, interaction events and device information collected for an optional activity only where that activity is offered and disclosed, with consent where required. |
Providing information necessary for registration, payment or a requested feature is required for that function. Optional marketing consent is not required to use the core Service.
The current Service is for Meta advertising rules. It is not intended to collect individual leads, customer mailing lists, sensitive personal records or data from customer backend databases. Do not send passwords, full payment-card details or unnecessary personal information through support.
3. Why we use personal data
Where the EU General Data Protection Regulation (GDPR) applies, we use the following legal bases, according to the actual activity and relationship.
| Purpose | Legal basis |
|---|---|
| Create and administer accounts, deliver requested features and provide support | Performance of a contract with you where you are the contracting customer; otherwise legitimate interests in administering the service for your business or employer. |
| Process purchases, manage subscriptions and maintain billing records | Contract where applicable, legitimate interests in business administration, and legal obligations concerning tax and accounting. |
| Protect accounts, investigate errors and prevent abuse | Legitimate interests in maintaining a secure, reliable service; legal obligation where a specific requirement applies. |
| Analyse necessary operational information and improve reliability | Legitimate interests, subject to necessity and a balancing of your rights; consent where required for the underlying tracking. Customer data processed under the DPA remains subject to its restrictions. |
| Provide optional analytics, advertising measurement or personalised marketing | Consent where required. The applicable purpose and choices are disclosed when the activity is offered. |
| Send promotional communications | Consent where required, or a legally permitted existing-customer marketing basis with an easy opt-out. |
| Comply with law and establish, exercise or defend legal claims | Legal obligation or legitimate interests, as applicable. |
Where we rely on legitimate interests, we consider the necessity of the processing and its effect on individuals. You may object as described in section 9. Accepting our Terms is not consent to optional tracking or promotional communications.
4. Anonymous information and product improvement
We may use genuinely anonymous, aggregated information to understand usage, improve reliability and develop the Service. Such information must not reasonably identify an individual, customer or agency client or expose confidential customer-level results.
Removing names, hashing or encrypting data is not necessarily anonymisation. Where personal data is processed to create anonymous information, that processing must have a valid legal basis and comply with any required customer instructions.
Customer advertising data is additionally subject to section 6 of the Terms of Service, the DPA and the applicable platform terms. This policy does not grant unrestricted permission to combine customer datasets, publish identifiable benchmarks or train general-purpose models.
Genuinely anonymous information lawfully created may be retained independently of the source records. The personal data used to produce it remains subject to applicable retention and deletion limits.
5. Cookies and marketing choices
Our Cookie Policy explains cookies and similar technologies and the distinction between essential functions and optional tracking.
Where we offer optional analytics, advertising, session recording or third-party widgets, we provide the relevant purpose, provider and control information before activation and obtain consent where required. Newsletter subscriptions and promotional messages are optional. You can unsubscribe using the mechanism in a promotional message or contact support@zlit.ai. Necessary account, payment and security communications are separate.
Customer data received through a connected Meta advertising account is not used to build zlit.ai's own advertising audiences or target that customer's end users.
We do not sell personal data for money. Where an advertising activity constitutes sale, sharing or targeted advertising under applicable law, we provide the required notice and opt-out before that activity starts. Legally required browser preference signals are treated as opt-out requests for the relevant activity. You may also contact support@zlit.ai to exercise an applicable opt-out.
6. Who may receive information
We disclose personal data only as needed for the purposes in this policy. Recipients may include providers of hosting, storage, authentication, payments, operational email, support and error monitoring; analytics or advertising providers for a disclosed optional activity; professional advisers under confidentiality; authorities where lawfully required; and a successor in a business transfer subject to appropriate safeguards.
Providers acting on our instructions are subject to appropriate contractual confidentiality, security and processing obligations. Payment providers, advertising platforms and other recipients may act as independent or joint controllers for particular activities under their applicable arrangements. We remain responsible for our own processing.
Information about relevant recipients and processing locations can be requested through support@zlit.ai. Sub-processors handling Customer Personal Data are subject to the disclosure, authorisation and change-notice requirements in the DPA.
7. International processing
zlit.ai is operated from Cyprus. Service providers or authorised personnel may process data in other countries. Our location does not imply that every system, backup or support operation is located in the European Economic Area (EEA).
For transfers subject to GDPR, we use an applicable lawful safeguard, such as a relevant adequacy decision or appropriate standard contractual clauses with additional measures where necessary. Corresponding safeguards apply where UK or other applicable data-protection law governs a transfer. A transfer is not made in reliance on a mechanism unless its conditions are met.
You can request information about relevant countries, safeguards and copies of applicable transfer arrangements from support@zlit.ai, subject to legitimate redactions that preserve an understanding of the safeguards.
8. How long we keep information
We retain personal data only for the time needed for its stated purpose or a valid legal requirement. Relevant criteria include the type of information, the duration of the relationship, the need to resolve a specific request or dispute, and applicable legal retention periods.
| Category | Retention approach |
|---|---|
| Account and business-contact information | During the active relationship. After account closure or a valid deletion request, ordinary account data is removed from active systems without undue delay and within 30 days, except for the limited records lawfully needed for compliance or a specific claim. |
| Billing and tax records | For the period required by applicable tax and accounting rules; retained separately from data no longer needed for the Service. |
| Technical and security logs | Only for the documented period reasonably necessary for reliability, security and incident investigation. A relevant subset may be preserved longer for a justified incident or claim. |
| Support communications | For as long as necessary to resolve the request and any associated compliance obligation or dispute. Unnecessary attachments are removed sooner. |
| Marketing preferences and consent records | While the permission is used and afterwards only as needed to demonstrate compliance or honour an objection. A minimal suppression record may be kept to prevent unwanted re-contact. |
| Customer Personal Data | According to the customer's instructions and the DPA, including its return and deletion provisions. |
Residual copies in backups are protected, excluded from ordinary use and removed within 90 days of the same account-closure or valid deletion-request date, unless applicable law requires retention. This is not an additional 90 days after removal from active systems. Deletion instructions are reapplied if a backup is restored. A shorter legal deadline takes priority.
Where retention is required, we retain only the necessary subset and limit its use to the justified purpose. Genuinely anonymous statistics may be retained without keeping identifiable source records.
Request deletion or information about the retention applicable to your data through support@zlit.ai.
9. Your rights
Depending on applicable law, you may have rights to access, correct, delete or receive a portable copy of your information; restrict or object to processing; withdraw consent; and opt out of sale, sharing or targeted advertising. Applicable law may also allow you to limit certain sensitive-information uses, appoint an authorised agent or appeal a refused request.
Contact support@zlit.ai to exercise your rights. We may request proportionate information to verify identity or authority. You do not need an active paid subscription, and we do not penalise the lawful exercise of privacy rights.
For GDPR requests, we respond without undue delay and within one month. Where a lawful extension is necessary because of complexity or the number of requests, we explain it within that month; the extension may be up to two additional months. Other applicable legal deadlines apply where relevant.
You may withdraw consent without affecting the lawfulness of earlier processing. You may object to direct marketing at any time, and we will stop that processing. Where we process information only for a customer, we direct the request to that customer and assist it under the DPA.
You may complain to a competent supervisory authority, including the Commissioner for Personal Data Protection in Cyprus or an authority available under the law of your residence or workplace. You are not required to contact us before making a complaint.
10. Security
We undertake to protect personal data using technical and organisational safeguards appropriate to the risks. These include encryption in transit and at rest, access limited to authorised people, protection of account credentials, separation of customer data, and incident-response procedures. The security commitments for Customer Personal Data are set out in the DPA.
No method of storage or transmission is completely secure. We notify affected customers, individuals and authorities as required by our role and applicable law.
11. Children and automated processing
The Service is intended for adult business users and is not directed to children. We do not intentionally solicit children's personal information for the rules service. Contact support@zlit.ai if such information has been submitted.
Advertising rules execute according to customer configuration. They are not offered as a service for determining an individual's eligibility for employment, credit, insurance or healthcare. Applicable rights concerning profiling or automated decisions remain unaffected.
12. Changes and contact
We update this policy when our practices change and provide material-change notices where required. A new purpose requiring consent or another authorisation is not enabled merely by posting a revised policy.
Privacy: support@zlit.ai.
General, billing and cancellation: support@zlit.ai.
Security: support@zlit.ai.
zlit.ai — Republic of Cyprus.