Privacy Policy

Zlayo is operated by Constantin Busuioc, an individual based in Moldova, not a registered company, who is responsible for your personal data (the “controller”). This policy explains what Zlayo collects when you use it, why, who receives it, and what you can do about it. You can reach us about anything here at support@zlayo.com.

Zlayo (“the app”, at zlayo.com) asks for access to your Google account in two optional features: Sign in with Google, and Post to YouTube, which uploads videos you made in Zlayo to your own YouTube channel. You can use Zlayo without either. The sections below describe exactly what Google user data Zlayo accesses, how it uses, stores and shares that data, how long it is kept, and how you can delete it.

Zlayo does not access your Gmail, Drive, contacts, calendar, YouTube watch history, subscriptions, comments, analytics or existing videos.

• Your Google email address is used only to identify your Zlayo account and to sign you in.
• The YouTube permission is used only when you press “Post to YouTube” on a video. Zlayo then uploads that one video to your channel with the title, description, privacy setting and schedule you chose. It never posts anything you did not ask it to.
• The channel name and ID are used only to show you where a video will be posted.
• Google user data is not used for advertising, is not used to build profiles, and is not used to develop, improve or train any artificial-intelligence or machine-learning model.

Zlayo does not sell, rent, trade or share Google user data with anyone. It is not given to advertisers, data brokers, information resellers or AI providers. The only transfers are:

• to Google itself: when you post, the video and the details you entered are sent to YouTube;
• to our hosting providers, who store it on our behalf only to run the Service;
• if the law requires it, or as part of a merger or sale of the Service, under this same policy.

• All data travels over encrypted connections (HTTPS/TLS), between your browser, Zlayo and Google.
• The YouTube refresh token and channel details are stored in Zlayo's database on our own server. The token is never sent to your browser, never shown to anyone and never passed to another service.
• Each upload uses a short-lived access token made from the refresh token; access tokens are not stored.
• Access to the server and database is limited to the operator and protected by key-based login.

• Your email address is kept while your account exists.
• The YouTube token and channel details are kept until you disconnect the channel inSettings → YouTube or delete your account.
• Disconnecting, or deleting your account on the account page, revokes Zlayo's access with Google straight away and erases the token and channel details. Database backups that contain them are overwritten within 30 days.
• You can remove Zlayo's access at any time from your Google Account atmyaccount.google.com/permissions(or security.google.com/settings/security/permissions).
• To have any Google user data deleted, email support@zlayo.com. We do it within 30 days.

Zlayo's use and transfer to any other app of information received from Google APIs will adhere to theGoogle API Services User Data Policy, including the Limited Use requirements. In particular:

• Google user data is used only to provide or improve the sign-in and posting features you can see in the app.
• It is not used for serving advertisements, including personalised, retargeted or interest-based ads.
• It is not sold, and not transferred to data brokers or information resellers.
• It is not used to determine creditworthiness or for lending purposes.
• It is not used to develop, improve or train generalised or non-personalised AI or machine-learning models.
• No person reads it, unless you give your consent, it is needed for security purposes (such as investigating abuse), it is needed to comply with the law, or it has been aggregated and anonymised for internal operations.

Post to YouTube uses YouTube API Services. By connecting a YouTube channel you agree to be bound by theYouTube Terms of Service. Google's own handling of your data is described in the Google Privacy Policy.

Account details. Your email address and password. Passwords are stored only as a salted hash, never as readable text. If you sign in with Google, we receive your email address from Google instead of a password (see Google user data). We also record when the account was created.

Your content. Videos and audio you upload; links you give us to fetch; text you type or upload, such as scripts, Reddit-style stories, fake-texting conversations and book files; reference clips and instruction images or documents; and everything the Service makes from these, including transcripts, clips, captions, titles, tags, voiceovers and audiobooks.

Voice recordings. Only if you use Voice Studio: the clips of a voice you record or upload to clone it (see Faces and voices).

A connected YouTube channel. If you connect one to post videos, its name and id and Google's upload permission for it (details in Google user data).

Your settings. Project rules and styles you configure, caption templates you save, the display name you choose, and defaults such as preferred voice, download quality, aspect ratio and notification choices.

Activity on the Service. A record of the jobs you run (which tool, when, how long they took and whether they succeeded) and any share links you create.

Error reports. When you choose to report a problem, we store what failed (the request, its status and the technical details of the error), the message you saw, some context about what you were doing, and any note you add.

Technical data. Your IP address and the time of your requests, which our servers see whenever you use the Service and which we use to limit abuse, keep the Service secure and fix problems.

We use your data only for these purposes, each with a legal basis:

• To provide the Service you signed up for: running your account, processing your content, producing and storing your output, and keeping your settings. We need this data to perform our agreement with you.
• To keep Zlayo secure and working: rate limiting, preventing abuse and fraud, investigating errors you report, and enforcing our Terms. This is in our legitimate interest in running a safe, reliable service, and we keep it proportionate.
• To handle copyright complaints and legal requests, and to meet legal obligations.
• To contact you about your account, security issues or material changes to our terms.

We don't sell your data, we don't show ads, we don't share your data for advertising, and we don't use your content or any Google user data to train AI models.

To frame clips around the person speaking, Zlayo finds where faces are in video frames. It works out where a face is, not who it belongs to: it doesn't recognise or identify people and doesn't build face profiles.

Voice Studio (voice cloning). If you choose to clone a voice, you record or upload a short clip of it. We keep that clip, and a short preview made from it, so Zlayo can speak text in that voice for you. They are used only to make the audio you ask for in your own account: they are never shared with other users, never used to train any AI model, and never sent to an outside AI provider. The cloning model runs on our own servers.

You must only clone your own voice or a voice whose owner has given you permission; we record when you confirm this. Deleting a voice in Voice Studio, or deleting your account, deletes its recordings straight away. If you believe someone cloned your voice without permission, email support@zlayo.com and we will remove it.

By default, transcription, voice generation and face framing all run on the servers that host Zlayo, and your content stays there. Your data reaches others only in these cases:

• Hosting and infrastructure providers that store and run the Service for us, under obligations to protect it.
• AI providers, when a feature using them is switched on. To speed up transcription, audio extracted from your video may be sent to Groq, Cloudflare (Workers AI), Deepgram or OpenAI to produce a transcript. To score moments and write titles, captions and tags, transcript text and sampled video frames may be sent to Google (Gemini) or Anthropic (Claude). Each provider processes it under its own terms to return a result to us. This is only the video content you upload; no Google user data (your Google sign-in details or YouTube connection) is ever sent to any AI provider.
• Paddle, our payment provider and merchant of record, when you buy a plan. Paddle collects your payment details directly; we never see or store your card. Paddle tells us which plan you're on and gives us your customer and subscription ids.
• Resend, which sends our emails (confirming your address, password resets, a welcome note), receives your email address and the message.
• Cloudflare, which delivers the website and, if switched on, counts visits with Web Analytics: which pages are viewed and from where, without cookies or anything that identifies you.
• YouTube, when you paste a link: our server requests that link from the platform. The platform sees our server's request, not your account details.
• YouTube, when you post a video: the video and the title, description and settings you chose go to your own channel through YouTube API Services.
• People you share with: if you create a share link, anyone with the link can view that content until you turn sharing off.
• When the law requires it, to protect people's safety or rights, or as part of a sale or reorganisation of the Service, in which case this policy continues to protect your data.

The Service downloads AI model files from Hugging Face to run features locally; none of your content is sent there. We don't use advertising or tracking services, and the only analytics is the cookieless visit count above.

The servers and providers above may be in a different country from you, including outside the European Economic Area. Where the law requires safeguards for such transfers, we rely on those the provider offers, such as standard contractual clauses.

• Account and settings: until you delete your account.
• Videos you upload and videos you make: making them needs a paid plan, and they are kept while you pay. If your plan ends, your account goes back to the Free plan, which keeps no videos: they stay downloadable for 30 days, then are deleted automatically. A Free account holds only its account details and settings. You can delete your videos sooner yourself.
• Cloned voices: until you delete the voice in Voice Studio or delete your account.
• A connected YouTube channel: until you disconnect it or delete your account. Either one revokes the permission with Google and erases it here.
• Payment records: kept by Paddle as the seller, under its own terms. We keep only which plan you're on and Paddle's ids for your subscription.
• Temporary processing files made while a job runs: deleted when the job ends.
• Error reports: until the problem is dealt with, then deleted, or earlier if you delete your account.
• IP addresses and server logs: only as long as needed for security and troubleshooting.

We back up the account database (not your videos) once a day and keep each copy for up to 30 days, after which it's overwritten. We may keep specific data longer if the law requires it or to deal with an ongoing dispute or copyright complaint.

Zlayo doesn't set cookies and doesn't use tracking or advertising cookies. To keep you signed in, your browser stores a sign-in token in its local storage, which is strictly necessary for the Service to work. It may also store small conveniences on your device, such as your theme, favourite voices and remembered choices. These never leave your device except the sign-in token, which is sent to our servers to prove it's you. Clearing your browser's site data removes them.

We use encrypted connections, store passwords only as salted hashes, and limit access to your data to your own account. Google's permission to post to your YouTube channel stays on our server and is never sent to a browser or any other service. No system is perfectly secure, so we can't guarantee your data will never be accessed without permission. If a breach puts your rights at risk, we'll tell you and the relevant authorities as the law requires.

Depending on where you live, you have the right to:

• get a copy of your personal data, and have it given to you in a portable format;
• have inaccurate data corrected;
• have your data deleted;
• limit or object to how we use your data, including where we rely on our legitimate interests;
• withdraw consent at any time, where we rely on consent;
• complain to a data protection authority, for example the one in the country where you live.

You can do most of this yourself: your account page lets you export your data and delete your account. For anything else, email support@zlayo.com. We'll answer within one month, and may need to confirm it's really you first.

Zlayo is only for people aged 18 or over. We don't knowingly collect data from anyone younger. If we learn an account belongs to someone under 18, we'll delete it and its data. If you believe that has happened, contact us.

Zlayo uses automated systems to choose and score clips and to generate captions and other output. These shape your content, but they don't make decisions about you that have legal or similarly significant effects.

When we change this policy, we'll update the date above. If we change how we use Google user data, we'll tell you before the change applies. For material changes, such as a new kind of data collected or a new type of recipient, we'll let account holders know before the change applies.

Questions or requests about your privacy: support@zlayo.com. Zlayo is operated by Constantin Busuioc, an individual based in Moldova, not a registered company.