Privacy Policy

Last updated: 1 October 2026

This Privacy Policy explains how Dimeris Ltd ("Dimeris", "we", "us" or "our") collects and processes personal data when you visit zencreator.pro, create an account, purchase credits, use ZenCreator’s AI tools, contact us or otherwise interact with the Services. It also explains your privacy rights and how to exercise them.

ZenCreator provides AI-assisted generation and editing of images, videos and other digital content. When you use these tools, prompts, uploads and generated results may contain personal data about you or other individuals. Please read Sections 3, 5, 6 and 8 in particular.

1. Who Is Responsible for Your Data?

Dimeris Ltd, registration number HE 486070, registered office: SOHO Embassy, Omonoias Avenue 13, Limassol 3052, Cyprus, operates ZenCreator and generally acts as the controller of personal data processed for the purposes described in this Policy.

Privacy enquiries and requests: [email protected]. Reports concerning non-consensual content or other abuse: [email protected].

Where an organisation uses ZenCreator on behalf of others, the allocation of controller and processor roles may depend on the particular arrangement.

2. Who This Policy Covers

This Policy covers visitors, registered users, people who contact us, and individuals whose personal data appears in content submitted to or generated using the Services, to the extent that we process their personal data. The Services are intended only for individuals who have reached the age of majority under the laws of their jurisdiction and are at least 18 years old. We do not knowingly permit individuals who do not meet these age requirements to hold accounts.

This Policy does not govern independent processing by third-party websites or platforms to which you publish or export content. Those parties may have their own privacy notices.

3. Personal Data We Process

3.1 Account and contact information

Email address, account identifiers, registration and verification information, profile details if provided, support correspondence, and any name, business details or contact information that you choose to supply.

3.2 AI Inputs and Outputs

Text prompts and instructions; images, videos, audio and other files you upload where supported; edited or generated content ("Outputs"); associated metadata, generation settings, timestamps, model/tool selections, generation status and content history. These materials may contain personal data of the user or other identifiable persons, including images, voices and likenesses.

3.3 Usage, technical and security data

IP address, device and browser information, operating system, log events, page views, interactions with features, usage and generation history, error logs, identifiers used for security and analytics, and moderation or abuse-related signals and records where applicable.

3.4 Purchase and transaction information

Credit purchases and balances, transaction identifiers, purchase amounts and status, payment service provider used, invoices and related support or dispute records where available. Payment card credentials are handled by third-party payment providers.

3.5 Information from others

We may receive payment confirmation and fraud-related information from payment providers, technical or moderation information from service providers, complaints from affected persons, and information submitted to us in support or rights requests. We may also process personal data relating to people who are not ZenCreator account holders where a user uploads content depicting them.

4. Purposes and Legal Bases

We process personal data only where a legal basis applies. The relevant basis depends on the purpose and circumstances.

Purpose	Data involved	Legal basis
Create and administer accounts; authenticate users; deliver requested AI generation, editing, download and related features	Account data, Inputs, Outputs, technical and usage data	Performance of a contract (Article 6(1)(b) GDPR), insofar as processing is objectively necessary to provide the requested service.
Process credit purchases, keep transaction records, handle refunds and billing questions	Transaction records, account details, support records	Contract (Article 6(1)(b)); legal obligation (Article 6(1)(c)) for applicable accounting and tax records.
Respond to support requests, troubleshoot failures and resolve complaints	Correspondence, relevant logs and, where necessary, selected Inputs/Outputs	Contract where necessary for requested support; otherwise legitimate interests (Article 6(1)(f)) in providing effective support.
Protect the Services, investigate abuse, enforce the Content Policy and respond to lawful requests	Inputs, Outputs, moderation results, logs, reports, account identifiers	Legitimate interests (Article 6(1)(f)) in security and preventing abuse, and legal obligation (Article 6(1)(c)) where a specific law requires processing.
Understand feature usage, performance and errors; improve usability	Usage events, diagnostics and limited content where justified	Legitimate interests (Article 6(1)(f)) where necessary and balanced; consent (Article 6(1)(a)) where required for non-essential tracking or other processing.
Send promotional communications	Contact information and marketing preferences	Consent where required; otherwise a lawful direct-marketing basis under applicable law, with opt-out rights.
Establish, exercise or defend legal claims; comply with law	Relevant account, content, transaction and incident records	Legal obligation (Article 6(1)(c)) or legitimate interests (Article 6(1)(f)), as applicable.

Where processing involves special categories of personal data under Article 9 GDPR, we will additionally require an applicable exception under Article 9(2) GDPR, as further described in Section 6.

Where we rely on legitimate interests, those interests include service reliability, security, fraud and abuse prevention, customer support, and proportionate product improvement. We assess whether the processing is necessary and whether your rights and interests override those interests.

Where we rely on consent, you may withdraw it at any time, without affecting the lawfulness of processing before withdrawal. Withdrawing consent does not affect processing justified by a different applicable legal basis.

5. AI Content: How We Process Prompts, Uploads and Outputs

5.1 Generating and editing content

When you submit an Input, we process it and may transmit it to the AI model or technical service provider needed to carry out your request. The provider may return an Output or technical result, which we process and make available in your account or through the relevant interface. We may retain Inputs, Outputs and generation history as described in Section 8.

5.2 Human access to content

Authorised personnel may access relevant Inputs, Outputs or associated information when reasonably necessary to respond to support requests, troubleshoot technical issues, investigate suspected policy violations or understand specific product problems and user needs. Access is limited to the relevant purpose and subject to appropriate controls.

5.3 Model training and product improvement

Dimeris does not use users’ Inputs or Outputs to train or fine-tune its own AI models. We may analyse service usage and, in limited cases, review content to troubleshoot issues and improve the operation or user experience of ZenCreator, subject to applicable law.

5.4 Other people appearing in content

Users may upload material depicting or referring to other individuals. We may process those individuals’ personal data to deliver the requested functionality and for safety purposes. Users are responsible under the Terms and Conditions and Content Policy for having the necessary rights and permissions to submit materials. Such contractual obligations do not replace Dimeris’s independent duties under data protection law.

6. Sensitive Content, Face Analysis and Moderation

Inputs and Outputs may include intimate or adult-oriented content and information revealing sensitive aspects of an identifiable person’s private life. Depending on the content and processing, personal data may fall within special categories under Article 9 GDPR, including data concerning a person’s sex life or sexual orientation. We will process such data only where a valid legal basis under Article 6 GDPR and an applicable condition under Article 9(2) GDPR are satisfied. Where we rely on explicit consent under Article 9(2)(a) GDPR, such consent must be obtained from the relevant data subject before processing and may be withdrawn at any time. We may restrict or prohibit the processing of sensitive content relating to third parties where an appropriate legal basis cannot be established.

To help identify prohibited content and protect the Services, prompts and uploaded media may be analysed using automated moderation tools and, where necessary, human review. Depending on the tool and content, this may involve image or face-related analysis and automated classifications or flags. Such analysis is intended for content and safety screening, not to authenticate or identify a person by comparing biometric templates.

A moderation signal may result in a generation being blocked, content being restricted, or an account being referred for review or enforcement. We may preserve and disclose information where legally required or permitted, including in relation to suspected child sexual abuse material or credible complaints of non-consensual intimate content. See the Content Policy and abuse reporting procedures.

7. Sharing Personal Data

We share personal data only where relevant to the stated purposes and subject to applicable law. Recipient categories may include:

AI model and inference providers, including Alibaba, ByteDance, fal.ai, WaveSpeed and Google, which process prompts, uploaded materials and generated Outputs to provide the requested AI functionalities.
Hosting, storage and infrastructure providers, including Hetzner, Amazon Web Services (AWS) and Google, which support the hosting, storage and operation of the Services.
Content moderation and safety providers, including AWS Rekognition, Alibaba and OpenRouter, which assist in detecting prohibited content, preventing misuse and maintaining the safety of the Services.
Analytics and performance providers, including Amplitude and Google Analytics, which help us understand how the Services are used, monitor performance and improve functionality, subject to applicable consent requirements.
Payment service providers, which process payments and provide transaction confirmations, payment status information and fraud prevention services.
Professional advisers, insurers, regulatory authorities, courts and law enforcement agencies, where disclosure is necessary and legally justified.
Potential purchasers, successors or other parties involved in corporate transactions, including mergers, acquisitions or transfers of assets, subject to applicable legal requirements and appropriate safeguards.

Third-party providers may act as processors, independent controllers or, in limited cases, joint controllers depending on the processing.

We do not sell personal data to third parties.

8. How Long We Keep Personal Data

We retain personal data for no longer than necessary for the purposes described above, subject to applicable legal obligations, dispute resolution and security needs. Our current practices are:

Account details: generally while the account remains active and for a limited period afterwards where necessary for legitimate operational, legal or security purposes.
Inputs, Outputs and generation history: these materials remain stored until user deletion or account deletion, rather than being automatically deleted after a fixed period.
Deletion requests: the account interface allows users to delete their profile and associated content. Some information may need to be retained for legal, accounting, dispute, security or abuse-investigation purposes.
Transaction and accounting records: for the periods required by applicable tax, accounting and other legal obligations.
Support, security and moderation records: for periods proportionate to their purpose and any applicable legal requirements.
Analytics and marketing data: according to applicable cookie settings, consent/objection preferences, vendor configuration and documented retention schedules.

9. International Transfers

We are established in Cyprus, but our service providers may process personal data in other countries, including outside the European Economic Area. Where a transfer is subject to Chapter V GDPR, we rely on an applicable European Commission adequacy decision or appropriate safeguards such as Standard Contractual Clauses, together with supplementary measures where required. We can provide information about applicable transfer safeguards upon request, subject to lawful redactions.

10. Cookies and Analytics

We use necessary technologies for website functionality, account security and service operation. We also use analytics technologies to understand use of the website and platform. Where applicable law requires consent for non-essential cookies or similar technologies, we will seek it before placing or accessing them and allow you to change your preferences.

For more information about the cookies and similar technologies we use, their purposes, providers and lifetimes, please see our Cookie Policy and available cookie settings.

11. Marketing Communications

We may send product news, offers and other marketing communications where permitted by applicable law. You can unsubscribe using the link in a marketing message or contact [email protected]. Service-related and transactional communications may still be sent where necessary.

12. Your Data Protection Rights

Subject to applicable law, you may request access to your personal data, correction, deletion, restriction, portability, and object to processing based on legitimate interests. You have an unconditional right to object to processing for direct marketing. Where processing is based on consent, you may withdraw it. You may also have rights in relation to certain automated decisions, where the relevant legal requirements apply.

To exercise these rights, contact [email protected]. We may need to verify your identity before responding. We normally respond within one month, subject to lawful extensions and exceptions. If a request concerns a person appearing in an uploaded or generated image, please provide information sufficient to help us identify the relevant content without unnecessarily disclosing further sensitive information.

Where a request concerns personal data contained in User Content or Outputs, we may request information reasonably necessary to verify the requester's identity, establish their connection to the relevant content and locate the material concerned. We will seek to minimise the collection of additional sensitive information when handling such requests.

You may complain to the Office of the Commissioner for Personal Data Protection in Cyprus (dataprotection.gov.cy), or another competent supervisory authority where applicable.

13. Additional Privacy Rights for U.S. Residents

If you reside in the United States, you may have additional rights under the privacy laws of your state, depending on the applicable law and whether Dimeris Ltd is subject to that law.

Your Privacy Rights

Subject to applicable legal requirements and exceptions, these rights may include the right to:

Confirm whether we process your personal data and access that data;
Request correction of inaccurate personal data;
Request deletion of personal data;
Obtain a copy of certain personal data in a portable format;
Opt out of the sale of personal data, targeted advertising or certain profiling activities, where applicable;
Withdraw consent to the processing of sensitive personal data, or request that such processing be limited, where applicable law provides these rights.

Exercising Your Rights

You may submit a privacy request by contacting us at [email protected]. We may request information reasonably necessary to verify your identity and process your request. We will respond within the period required by applicable law.

Where required by applicable state law, you may authorise another person to submit a request on your behalf, subject to appropriate verification.

If we deny your request, you may have the right to appeal our decision. Where applicable, we will explain how to submit an appeal and respond within the legally required timeframe.

We will not unlawfully discriminate against you for exercising your privacy rights.

Sensitive Personal Data

User Content and Outputs may contain sensitive personal data, including information concerning an identifiable person's sex life or sexual orientation. We process such information only for the purposes described in this Privacy Policy and subject to applicable legal requirements, including any consent or other conditions required by relevant U.S. state privacy laws.

14. Security

We use technical and organisational measures designed to protect personal data against unauthorised access, alteration, disclosure and loss, taking into account the nature and risks of the processing. No online system can guarantee absolute security.

15. Children

ZenCreator is intended only for individuals who have reached the age of majority under the laws of their jurisdiction and are at least 18 years old. If we discover that an account belongs to a person who does not meet these age requirements, we may suspend access and take steps to delete or otherwise lawfully handle the associated personal data. The separate prohibition on sexualised depictions of minors applies regardless of the account holder’s age. If you believe a person who does not meet these age requirements has provided data to us, contact [email protected] or [email protected] as appropriate.

16. Changes to This Policy

We may update this Privacy Policy to reflect changes in the Services, processing practices or applicable law. We will publish the revised Policy with an updated date and provide additional notice where required by law. If a new purpose requires consent or other steps before processing, we will take those steps first.