Privacy Policy
This Privacy Policy explains how Zylox AI LLC-FZ, a company incorporated in the United Arab Emirates (Free Zone) with its registered office at Meydan Grandstand, 6th floor, Meydan Road, Nad Al Sheba, Dubai, U.A.E (
1. Overview
Zylox provides an AI workspace that enables users to upload documents, ask questions, and receive cited answers using artificial intelligence.
The Service is built around:
- authenticated, permission-based workspace access - controlled sharing managed by workspace roles - no training on client data, client outputs, or client interactions
2. Data Controller and Processor Roles
Depending on how you use the Service:
- Zylox acts as a Data Controller for:
- account information
- usage and technical metadata
- Zylox acts as a Data Processor for:
- user-uploaded documents
- prompts and queries
- AI-generated outputs stored by the user
Zylox processes user content only to provide the Service and in accordance with user instructions.
3. Information We Collect
Account Information
When you create an account, we may collect:
- name
- email address
- authentication identifiers
Usage Information
We may collect metadata about platform usage, such as:
- timestamps of requests
- system performance metrics
- error logs
- feature usage analytics
User Content
Users may upload documents or prompts for AI processing.
These materials may be temporarily processed to generate responses.
4. How Information Is Used
We use collected information to:
- provide and operate the Service
- authenticate users
- process AI queries
- improve reliability and performance
- detect misuse or security threats
5. Legal Basis for Processing (GDPR/UK GDPR)
Where applicable, we rely on the following legal bases:
- Contract: to provide the Service you have requested - Legitimate Interests: for the security, reliability, and improvement of the Service - Consent: where applicable, for optional marketing cookies
- Legal Obligations: to comply with applicable law
6. AI Processing
When users submit queries or upload documents:
- uploaded content is processed to generate cited AI responses - relevant document fragments are retrieved to form answers - AI outputs are generated from the provided content
Content is processed to operate the Service and in accordance with user instructions.
7. Access to User Content
User content is processed to operate the Service. Zylox does not perform routine manual review of user content.
The Service applies access controls and workspace permissions to help limit unnecessary access to user content.
Zylox does not train on client data, client outputs, or client interactions.
For questions about data access, contact us at the details in section 19.
8. Permission-based Access and Workspace Isolation
The Service uses authenticated, permission-based workspaces to help keep your work separate and sharing controlled.
Access to a workspace is managed through authenticated users and workspace permissions. Content within a workspace is not accessible to users outside that workspace unless sharing is explicitly enabled by a workspace member.
Sharing is optional and requires an explicit invitation. Workspace roles determine what each invited user can see and do.
Zylox does not train on client data, client outputs, or client interactions.
9. Data Storage
Zylox stores user content to operate the Service, including to enable document retrieval for cited responses.
Content is retained until the user requests deletion or the account is terminated.
Limited metadata may be retained after deletion where needed for security, legal and audit purposes.
10. Security Measures
We implement technical safeguards including:
- encryption in transit
- encrypted storage systems
- workspace-level isolation
- strict access controls
Despite these safeguards, no system can guarantee absolute security.
11. Data Sharing and Subprocessors
Zylox does not sell user data.
We may share limited information with service providers that support our infrastructure and operations, including:
- AWS, including Amazon Bedrock where enabled (cloud infrastructure and AI processing) - Google Firebase/Firestore (authentication and database services) - Stripe (payment processing) - MailerSend (transactional email)
- Elastic, where enabled, for metadata-first observability
- Framer (website hosting)
- Google Tag Manager and Google Analytics (website analytics, landing pages only)
- Meta Pixel, X Pixel, TikTok Pixel, LinkedIn Insight Tag (marketing attribution, landing pages only)
- Microsoft Clarity (landing page behaviour analytics only, not used inside the authenticated product workspace)
These providers process data only to deliver services on our behalf and under appropriate contractual safeguards.
12. Data Retention
User content is retained to operate the Service and provide cited answers. Content may be retained until the user initiates deletion or the account is terminated.
Retention is based on:
- operational requirements
- legal obligations
- security considerations
You can initiate deletion of a file, chat or workspace from Zylox. Deletion is processed through a secure workflow; limited metadata may be retained where needed for security, legal and audit purposes.
Account data is retained while the account is active and for a reasonable period after closure to meet legal obligations.
To request deletion, contact us at the details in section 19.
13. User Rights
Depending on your jurisdiction, you may have rights to:
- access your data
- correct inaccurate information
- request deletion of your data
- restrict or object to certain processing
Requests may be submitted using the contact details below.
14. International Data Transfers
Zylox operates globally and may process data in jurisdictions outside your country of residence.
Where required, we ensure international transfers are subject to safeguards required by applicable law, including through appropriate contractual arrangements with service providers.
Transfers are subject to appropriate safeguards as required by applicable law.
15. Data Breach Notification
In the event of a data breach that affects your personal data, Zylox will take appropriate steps in accordance with applicable law, which may include notifying affected users and relevant authorities.
16. Cookies and Tracking Technologies
We use cookies and similar technologies on our website to:
- essential cookies for authentication and platform operation
- understand website usage
- analytics and marketing measurement technologies on our landing pages
On our marketing and landing pages we use: Google Tag Manager and Google Analytics (website usage); Meta Pixel, X Pixel, TikTok Pixel, and LinkedIn Insight Tag (marketing attribution); and Microsoft Clarity (page performance and bounce behaviour). These are used on landing pages only and not inside the authenticated product workspace.
We do not use third-party analytics or tracking inside the authenticated Zylox product workspace.
You can manage or disable non-essential cookies through your browser settings. Essential cookies are required for the platform to operate.
17. Children’s Privacy
Zylox is not intended for individuals under the age of 16.
We do not knowingly collect personal data from children under 16.
18. Changes to This Policy
We may update this Privacy Policy periodically.
Updates will be posted with a revised effective date.
19. Contact
For privacy-related questions or requests:
Zylox AI LLC-FZ
Meydan Grandstand, 6th floor
Meydan Road, Nad Al Sheba
Dubai, U.A.E
Email: hello@zylox.ai