HeyZenek
Sign in Sign up
Features Pricing

Privacy

Last updated: 19 September 2026

1. Data Controller

The controller of your personal data is:

  • Business: Tomasz Pielczyk Zen (sole proprietorship)
  • Tax ID (NIP): 6472477787
  • REGON: 528866972
  • Registered address: ul. Przyjaźni Polsko-Węgierskiej 4A/38, 30-644 Kraków, Poland
  • Electronic delivery address (e-Doręczenia): AE:PL-62024-63453-HBAED-19
  • Contact email for privacy matters: contact@heyzenek.com

2. Categories of Personal Data

We process the following categories of data:

  • Account data — email address, hashed password, account creation date
  • Usage data — text you submit to our AI tools, generated outputs, the tools you use
  • Payment data — billing details processed by Stripe (we do not store full card numbers)
  • Technical data — IP address, browser user agent, timestamps; used for security, abuse prevention and debugging

3. Purposes and Legal Bases of Processing

We process your data for the following purposes, based on the following legal grounds under Art. 6(1) GDPR:

  • Providing the Service (account, AI processing) — contract performance, Art. 6(1)(b)
  • Billing and accounting — legal obligation, Art. 6(1)(c), and contract performance, Art. 6(1)(b)
  • Security, abuse prevention, fraud detection — legitimate interest, Art. 6(1)(f)
  • Responding to your requests and support — legitimate interest, Art. 6(1)(f)
  • Sending transactional emails (activation, password reset) — contract performance, Art. 6(1)(b)

4. Recipients

To deliver the Service, we share necessary data with the following recipients:

  • OpenAI — text submitted to AI tools and the resulting output
  • Your browser’s speech recognition service — only if you use the “Speech to Text” tool: your browser sends the microphone audio to the speech service of its vendor (Google for Chrome, Microsoft for Edge) and returns the text; the audio never passes through our servers
  • Stripe (Link) — payment processing as the merchant of record: your name, email address, billing address and payment details, used to take the payment, calculate tax and issue receipts
  • Google LLC — only if you use the “Export to Google Forms” feature; see Section 6 below
  • Infrastructure providers — Hetzner Online GmbH, Cloudflare, Inc., Resend, Inc.

5. Transfer to Third Countries

Some of the recipients listed above process data outside the European Economic Area. Where such transfers occur, we rely on the safeguards required by Art. 46 GDPR, in particular Standard Contractual Clauses approved by the European Commission and, where applicable, the EU-U.S. Data Privacy Framework.

6. Google User Data (Export to Google Forms)

If you choose to export a quiz to Google Forms, we ask you to sign in with your Google account and grant the https://www.googleapis.com/auth/forms.body permission, which allows creating and editing forms in your Google account.

  • What we access: we use this permission solely to create a new form containing your quiz. We do not read, list or modify your existing forms, files or any other data in your Google account.
  • What we store: the Google access token is kept only in your browser session and is discarded when the session ends. We do not store the token or any Google account data in our database. The created form lives in your Google account, not on our servers.
  • What we share: we do not share Google user data with any third parties. In particular, it is never sent to AI models.
  • Limited Use: our use of information received from Google APIs adheres to the Google API Services User Data Policy, including the Limited Use requirements.
  • Revocation: you can revoke our access at any time in your Google account permissions.

7. Retention

  • Account data — stored as long as your account is active, and erased immediately when you delete your account.
  • Payment records — retained for 5 years as required by tax and accounting law.
  • Server logs (IP, technical data) — kept only as long as necessary for security and debugging, then deleted.
  • Backups — kept on a short rolling basis and overwritten over time.

8. Your Rights

Under GDPR you have the right to:

  • Access — request a copy of the data we hold about you.
  • Rectification — correct inaccurate or incomplete data.
  • Erasure (“right to be forgotten”) — request deletion of your data.
  • Restriction — request that we limit processing in certain situations.
  • Portability — receive your data in a structured, machine-readable format.
  • Object — object to processing based on our legitimate interest.
  • Withdraw consent — where processing is based on consent, you can withdraw it at any time without affecting prior processing.
  • Lodge a complaint with the supervisory authority — in Poland: Prezes Urzędu Ochrony Danych Osobowych (PUODO), ul. Stawki 2, 00-193 Warszawa.

To exercise any of these rights, email us at contact@heyzenek.com.

9. Automated Decision-Making and Profiling

We do not make automated decisions producing legal effects concerning you, and we do not profile you.

10. Storage on Your Device

We store on your device only what is necessary for the Service to work and to remember the settings you chose yourself.

11. Changes to This Policy

We may update this Policy as the Service evolves or as legal requirements change. The “Last updated” date at the top reflects the most recent revision. Material changes will be announced via email or in-app notice.