Privacy Policy for Zack KI and Zack Typing

Last updated: 2 October 2026

This shared Privacy Policy covers the product websites, the Windows apps Zack KI and Zack Typing, the shared account and the Zack service. Chat and web search sections concern Zack KI; sections 8a–8d describe Zack Typing. Each app stores settings and histories separately on your device. This policy provides information under Article 13 GDPR for data collected directly from users and Article 14 GDPR for data obtained from other sources.

1. Controller

The controller responsible for processing personal data is:

Elias Friderici
c/o Online-Impressum.de #4680
Europaring 90
53757 Sankt Augustin
Germany

Email: hello@zack-ki.com

Zack Software operates as a sole proprietorship. No data protection officer has been appointed. Please send privacy enquiries directly to the email address above.

2. Website visits and app connections to the server

To deliver a page or response, the server must technically process the requesting device's IP address. This applies both to website visits and to every connection from the Windows app to the Zack KI server.

Purpose: Delivering requested content and maintaining technical operation.

Legal basis: Article 6(1)(f) GDPR. The legitimate interest is the secure, reliable operation of the website and service.

Data categories: IP address and technical connection information, such as the requested address, time and information about the program used.

Recipient: netcup GmbH, Germany, as the server infrastructure provider. A data processing agreement has been concluded with netcup.

Retention: Zack KI does not keep permanent access logs containing IP addresses. Raw IP addresses are not permanently stored in access logs. Typing trial access also produces the temporarily retained network hash described in section 8d. Server software may produce short-lived error logs during technical faults; these are not retained permanently. Independently, netcup may keep its own technical logs as part of operating its infrastructure.

To plan and improve the website, Zack KI also uses its own free operational statistics to count public HTML page views, installer download starts and first successful sign-ins. Only daily totals are retained. Stored fields are the shortened public page path, language, broad source category (direct, internal navigation, search engine, social network or another website), where applicable only the referrer hostname, and explicitly supplied UTM campaign fields restricted to safe characters. Full referrer URLs, user agents, page content and unique visitor identifiers are not stored. Order numbers and filenames are masked before storage. Daily totals are deleted after 90 days.

Within these operational statistics, visits, downloads and new accounts are counted separately. A visit or download is not linked to an account; there is no conversion cookie or IP-based attribution. Any zack_attribution cookie left by an older version is removed on the next recorded visit. Old attribution records expire no later than their previous seven-day limit. Do Not Track, Global Privacy Control and marked test requests continue to be respected for these statistics.

These statistics run only on the Zack KI server. No external analytics, advertising or tracking services are used for these operational statistics. Separate consent-based advertising measurement is described in section 4a. The legal basis is Article 6(1)(f) GDPR: the legitimate interest is reliable operation of the public pages, downloads and service entry points and a broad understanding of demand.

3. Browser storage

The browser settings in this section support your chosen functions. Advertising cookies are described in section 4a.

Data categories: Your advertising measurement choice (zk-ads-consent, yes or no), selected language (zk-lang), colour scheme (zk-theme), whether the Windows SmartScreen download notice has already been displayed (zk-notice-seen), and a demo session identifier if the try-out function is used.

Purpose: Remembering your consent or refusal without repeated prompts, retaining your display and language choices, avoiding repeated download notices and associating requests with an ongoing demo session.

Legal basis: These settings serve only functions you have initiated. Storage on your device falls within the exception to consent under section 25(2), point 2 TDDDG. Any associated personal data processing is based on Article 6(1)(f) GDPR.

Recipients: None. These settings remain in your browser.

Retention: Until you change them or clear browser storage.

4. Website session

When you place an order or manage your contract on the website, a technically necessary session cookie named zack_web is used. Scripts cannot read it and it is transmitted only over an encrypted connection.

Purpose: Recognising your signed-in session during orders, cancellation, withdrawal and contract management.

Legal basis: Section 25(2), point 2 TDDDG, because the cookie is strictly necessary for the service you expressly request, and Article 6(1)(b) GDPR for the underlying processing.

Data categories: A signed session key associating the session with an account and an expiry time.

Recipient: netcup GmbH for server operation.

Retention: Up to 30 days, after which the cookie expires. You can delete it through your browser settings at any time.

4a. Advertising measurement (ChatGPT Ads)

Current status: Advertising measurement is currently disabled. The following describes the prepared measurement, which may only be used after technical verification and with your separate consent.

If you reach a product website through a ChatGPT ad with an oppref click reference, we ask for consent. Without consent we neither load the OpenAI Pixel nor store the reference or associate it with an account. Refusal and Global Privacy Control prevent this measurement. Reading, downloading and signing in remain available without consent.

Purpose and data: We measure page views, installer downloads, new accounts and the first paid subscription to assess our ads. Zack KI and Zack Typing use separate ad campaigns and measurement data sources. After consent, the first successful sign-in for a new account associates the click reference with the product, campaign and time. Account and subscription events are sent to the data source for the attributed product. We send OpenAI the click reference, event type, time, a stable event identifier and the product website. Pixel requests also expose necessary connection information, such as IP address and browser information, and a browser reference created by the Pixel. Our own event reports do not contain email addresses or their hashes, names, order numbers, app content or credit-pack purchases. Repeated sign-ins, renewals and plan changes are not new conversions.

No advanced contact matching: OpenAI's Automatic Advanced Matching can automatically collect contact information from recognizable forms and other website sources and transmit SHA-256 hashes of it for ad matching. We do not intend to use this additional feature for our advertising measurement. As its deactivation has not yet been confirmed, all advertising measurement remains disabled. Activation requires verification that the Pixel also does not send such contact information or hashes for matching.

Legal basis: Consent under Article 6(1)(a) GDPR and section 25(1) TDDDG for storage or access on your device. Remembering your choice in zk-ads-consent falls under section 25(2), point 2 TDDDG as described in section 3.

Recipients and responsibility: OpenAI Ireland Ltd., 1st Floor, The Liffey Trust Centre, 117–126 Sheriff Street Upper, Dublin 1, D01 YC43, Ireland, under the Advertising Terms, Ad Tools Terms, Conversion Terms and Ad Tools DPA. Under these terms, we and OpenAI generally act as separate independent controllers; OpenAI acts as a processor only for processing expressly designated as Restricted Processing. Under these terms, OpenAI may use measurement data for reporting, measurement, ad optimization and delivery, and to develop, provide and improve its products and services. See OpenAI's Privacy Policy for further information. netcup processes our server-side data as our hosting provider.

Cookies and retention: zk_adref on the product website stores the click reference, campaign and time for up to 30 days. The download passes these to our service, which sets a signed HttpOnly zk_adref cookie on api.zack-ki.com or the zack-ki.com domain for the remaining click window. The OpenAI Pixel also sets __oppref (30 days after capturing a click reference) and __obref (a random browser reference, up to 365 days). Browser restrictions may shorten these periods. We remove click references and their delivery data within 90 days of account attribution, and each event within 90 days of creation. Source, product, campaign, attribution time and the fact of a first paid subscription remain without the click reference until account deletion. OpenAI's own processing follows its privacy information and the above terms; our 90-day period does not describe retention by OpenAI.

International transfers: Processing outside the EEA, including in the United States by OpenAI affiliates and subprocessors, may occur. The Ad Tools DPA states that OpenAI Ireland processes EEA data and uses a valid transfer mechanism for onward transfers to countries without adequate protection. See the Ad Tools Sub-Processor List. You may request information about applicable safeguards using our contact address above.

Withdrawal: Stop advertising measurement. This remembers refusal on this website, stops Pixel measurement and briefly navigates to the API host and both product websites to remember refusal there, clear their Pixel cookies and remove the API host's HttpOnly cookie and cancel pending events associated with that cookie's reference. A one-way suppression hash prevents re-attribution of the same reference for another 30 days. This does not undo transmissions already completed or affect the lawfulness of processing before withdrawal. If you use multiple browsers, withdraw there as well. If cookies have already been cleared and the reference can no longer be identified, contact us above to withdraw for your account.

5. Account and sign-in

An email address is processed for an account. Sign-in uses a single-use link sent to that address; no password is assigned. No name is stored for the account itself. A name supplied when withdrawing from a contract forms part of the contract records described in section 7.

Purpose: Creating and managing the account and secure sign-in.

Legal basis: Article 6(1)(b) GDPR for performance of the service agreement or pre-contractual steps.

Data categories: Email address, account identifier, creation time and technical sign-in information.

Recipients: Supabase for accounts, authentication and database services; netcup GmbH for server operation.

Retention: For the account's lifetime. Following account deletion, data is deleted unless statutory retention requirements prevent this.

Each Windows app stores its own sign-in state separately in Windows Credential Manager on your computer. Zack KI does not additionally analyse this local state.

Alternatively, you can sign in using an existing Google account. Google sends Zack KI the email address associated with that account. A name or profile picture is not copied into the Zack account. If a verified identical email address already has an account created through a sign-in link, the existing account is continued; a second account is not created.

Purpose: Alternative secure authentication without a separate sign-in link.

Legal basis: Article 6(1)(b) GDPR for the service agreement or pre-contractual steps.

Data categories: Google account email address, marked as verified by Google, and required technical authentication information.

Recipients: Google to confirm identity for this sign-in method; Supabase for accounts, authentication and database services; netcup GmbH for server operation.

6. Balance, credits and usage billing

The shared Zack service records each account's plan, available credit balance and individual usage events relevant to billing.

Purpose: Providing the plan, calculating and managing credits and maintaining understandable billing records.

Legal basis: Article 6(1)(b) GDPR for the service agreement and, where accounting or retention duties apply, Article 6(1)(c) GDPR.

Data categories: Plan, balance and, for each request, its time, model, processed text units, number of web searches, transcription audio duration, app used and resulting costs.

AI request content and search query wording are expressly excluded from these usage events. The records show only that a request occurred and its extent.

Recipients: Supabase for the database; netcup GmbH for server operation.

Retention: For the account's lifetime and thereafter insofar as necessary for billing, statutory evidence requirements or the establishment, exercise or defence of legal claims.

Zack KI does not store payment details such as card or bank account information. Paddle processes those details exclusively.

7. Orders and contract management

Orders and management of paid plans involve processing the information needed to administer the contract.

Purpose: Concluding and performing contracts, assigning orders, billing, processing withdrawals and cancellations and meeting statutory evidence and retention duties.

Legal basis: Article 6(1)(b) GDPR for contract performance, Article 6(1)(c) GDPR for tax and commercial obligations and Article 6(1)(f) GDPR where documenting declarations provides legal certainty for both parties.

Data categories: Order number, email address, plan, amount, order status, checkout consents, withdrawal and cancellation declarations and their time, plus name and contract description where supplied in the form.

Recipients: Paddle for order and payment processing; Supabase for the database; netcup GmbH for server operation; Resend to send required confirmations.

Retention: Applicable tax and commercial retention periods. Data is then deleted unless still needed for legal defence.

8. AI requests in Zack KI

When you send a request, its content is transmitted to the AI provider used to produce the answer. The model route determines the recipient. Supported routes include OpenAI and mediation through OpenRouter to the respective model provider. Models may change; model information in the app relates to the individual request.

Purpose: Processing your request and generating the requested answer.

Legal basis: Article 6(1)(b) GDPR, because transmission is necessary to provide the requested service.

Data categories: Request content and all information it contains. You decide what to include. Avoid sending particularly sensitive information where it is not needed for the answer.

Recipients: The model provider used for the request, OpenRouter where used as intermediary, and netcup GmbH for forwarding through the Zack service. Section 18 lists providers and their privacy information.

Retention by Zack KI: No chat history is stored on Zack KI servers. Request content is processed only while handling the request and is not subsequently stored. Chat histories are stored only locally on your computer. Content you expressly submit with a report for review is an exception (section 14a).

OpenAI's own privacy information also applies to its processing. Zack KI does not make a statement about whether, or for how long, that provider retains transmitted data.

8a. Audio and transcription in Zack Typing

Zack Typing processes microphone recordings you start or audio files you select. In online mode, audio, language settings, transcription style and any selected dictionary entries are sent through the Zack service to the speech model. A configured fallback provider may receive the same necessary data if an error occurs. Supported routes include Microsoft MAI-Transcribe through OpenRouter and OpenAI as a direct or fallback provider. The service configuration determines the route used.

Purpose and legal basis: Producing the requested transcript and reliable billing, Article 6(1)(b) GDPR. Recordings may contain other people's voices and information. Record and transmit these only if you are entitled to do so.

Recipients: netcup for the Zack service, OpenRouter as intermediary when that route is used, and the model provider, particularly Microsoft or OpenAI. Section 11 applies when using your own API key.

Retention: The service processes audio for the request without keeping a permanent audio archive. For signed-in requests, the completed transcript and response metadata are retained in the service database for seven days as a replay result. The cleanup process then removes the text; a repeated request no longer returns a transcript. Request identifiers, hashes, status and billing evidence remain to prevent duplicate processing or under section 6. This is separate from your local dictation history. The shorter period in section 8d applies to trials without an account. Providers may have their own retention rules; Zack's periods do not promise deletion from their systems.

8b. Local recordings, offline recognition and insertion

Dictation text, retained recordings and settings are stored in the respective app on your device. Your Zack Typing retention setting controls local cleanup of text and audio. You must delete exported files and your own backups separately. Uninstalling the app or deleting an account does not replace local cleanup.

A previously downloaded and activated speech model can transcribe recordings locally. This local recognition does not transmit audio to an AI provider. Model downloads require an internet connection and involve the connection data described in section 2. Local recognition does not make separate online functions, such as text actions, titles or dictionary checks, local.

For insertion, the app may inspect the previously active text field, selection and, when context adaptation is enabled, nearby text locally. This insertion check is not an additional model request. A handoff to Zack KI initiated by you transfers the selected text to the other local app. Section 8 applies if you subsequently send an online request there.

Purpose and legal basis: Recording, local management, recognition and insertion at your request, Article 6(1)(b) GDPR. Local data remains on the device until you delete it or your selected retention period expires.

8c. Dictionary, text actions and dictation titles

The personal dictionary is stored locally. Selected active terms may be transmitted with online transcription to assist recognition. Enabled dictionary learning processes corrections and their textual context. An AI check may send before-and-after excerpts, dictionary entries, pending or rejected suggestions and associated evidence to the configured text model. Checks may run automatically when learning is enabled. The dictionary therefore is not exclusively local in every function.

Actions such as Improve or Shorten send the relevant text and instructions to the text model. Automatic dictation naming uses a transcript excerpt. These are separate online requests and may consume credits or incur charges with your own provider. The original text, versions and dictionary decisions remain available locally insofar as you retain them.

Purpose and legal basis: The editing, learning and management functions selected, Article 6(1)(b) GDPR. Dictionary learning can be disabled in settings; entries and local learning data can be managed and deleted in the app.

Recipients and retention: The Zack service and configured text provider, possibly through OpenRouter, or your provider directly when using your own key. The service does not create a permanent dictation or dictionary history from these requests. Local retention follows your deletions and settings; providers' own rules apply to their processing.

8d. Dictation trial without an account

Where enabled, trial access allows up to three short recordings of no more than 20 seconds each. A shared trial budget may limit availability. Enforcement uses a hash of the app device identifier, a hash of the IP address or IPv6 network range, a token hash, request identifiers, content hashes, duration, status and usage. These hashes are pseudonymous data, not guaranteed anonymisation.

Purpose and legal basis: Providing the requested trial under Article 6(1)(b) GDPR; protection against repeated abusive use and duplicate model calls under Article 6(1)(f) GDPR.

Recipients and retention: The Zack service and, for recognition, the providers in section 8a. An access token is valid for 15 minutes. The cleanup process removes transcripts after 24 hours and network hashes after one day. Device hashes and content-free trial evidence are retained to enforce the one-time trial limit; no automatic expiry is currently configured for these records. You may request access or deletion using the contact in section 1. Applicable legal requirements and any overriding legitimate grounds are assessed.

9. Automatic chat titles

An excerpt from a conversation is sent to a separate AI model to generate a short title so the chat is recognisable in the app. The configured title-model route is used, with a fallback provider if configured. Supported providers include DeepSeek.

Purpose: Automatically generating a chat title.

Legal basis: Article 6(1)(f) GDPR. The legitimate interest is an organised, usable app.

Data categories: The chat excerpt used to generate the title.

Recipients: The configured title provider, potentially DeepSeek or OpenRouter and its model provider; netcup GmbH for server operation.

Retention by Zack KI: The generated title is stored only locally on your device. Neither the excerpt nor the title is stored on Zack KI servers.

When DeepSeek is used, data may be processed in the People's Republic of China. See section 19. DeepSeek's own privacy information also applies; Zack KI makes no statement about its retention practices.

10. Web search

Zack KI may initiate a web search to answer a request. The generated search query is sent to Serper, which obtains results through Google; the query therefore also reaches Google.

Purpose: Obtaining current information needed to answer your request.

Legal basis: Article 6(1)(b) GDPR, because web search is part of the function you request.

Data categories: Search query wording, which may contain personal information depending on your original request.

Recipients: Serper as search provider, Google as the search engine it uses, and netcup GmbH for server operation.

Retention by Zack KI: Search query wording is not stored on Zack KI servers. Billing records contain only the number of searches, not their content. Serper's and Google's own privacy information also applies to their processing.

11. Using your own API key

You may save an AI provider's API key in the app settings.

Purpose: Using a provider you have engaged yourself without consuming Zack KI credits.

Legal basis: Article 6(1)(b) GDPR for provision of the app.

Key storage: The key is stored only locally in Windows Credential Manager. It is not transmitted to Zack KI and is not known to Zack KI.

Recipient: The app contacts your selected provider directly. The request does not pass through Zack KI servers. This processing is governed by your separate agreement with that provider and its privacy information.

12. Website try-out

The website may offer a one-time Zack KI trial without an account.

Purpose: Trying the functionality before registering, without obligation.

Legal basis: Article 6(1)(b) GDPR for pre-contractual steps at your request and Article 6(1)(f) GDPR for limiting abusive use.

Data categories: Your question, limited to 200 characters; accompanying context, either text you select on the website or a website screenshot area you draw yourself; a demo session identifier in browser storage and technical information needed to limit questions per session.

Recipients: The demo's AI provider and netcup GmbH for server operation.

Retention: Your question is processed only to answer it and is not permanently stored. The demo session identifier expires after a short time.

13. Email delivery

Zack KI sends sign-in links and confirmations of orders, withdrawals and cancellations using Resend. It does not send an advertising newsletter.

Purpose: Account sign-in and contractually or legally required communication.

Legal basis: Article 6(1)(b) GDPR for contract performance and Article 6(1)(c) GDPR where statutory confirmation or documentation duties apply.

Data categories: Email address and the order, contract, withdrawal or cancellation details needed for the message.

Recipients: Resend for email delivery; netcup GmbH for server operation.

Retention: Delivery evidence is retained with the underlying transaction for its applicable retention period.

14. Windows app diagnostics

The apps keep local technical diagnostic logs. Transmission to the Zack service is disabled by default and can be configured separately in each app. Logs help investigate technical problems.

Purpose: Identifying and resolving technical faults and improving stability.

Legal basis: Article 6(1)(f) GDPR. The legitimate interest is fault analysis and reliable operation. You may object to transmission at any time by disabling it in settings.

Data categories: Hashed device identifier, session identifier, time, event severity and category, affected component, app version, platform and a technical message with additional technical fields. Chat content is not transmitted. Detected credentials are automatically redacted before storage.

Recipients: Supabase, where diagnostic data is stored in the database, and netcup GmbH for server operation.

Retention: 30 days, followed by automatic deletion. Oldest entries are also removed when a technical storage limit is reached.

14a. Reporting problematic AI content and support

In Zack KI you can report a problematic chat or answer. Reports contain your account identifier, a message identifier, time and model information. Content is included only if you expressly select it in the reporting dialog; it is limited to 32,000 characters. Reports are stored on the Zack service and reviewed in the protected administration area.

Purpose and legal basis: Reviewing reported content and complaints, Article 6(1)(f) GDPR. The legitimate interest is safe operation and handling problematic AI outputs. Voluntary submission of content is based on Article 6(1)(a) GDPR. You may withdraw this consent using the contact in section 1.

Recipients and retention: Reports are processed in the service database by us and the infrastructure and database providers in section 18. No automatic deletion period is currently configured for app reports; they are removed upon account deletion. You may request earlier deletion using the contact in section 1.

Both apps also offer email contact. Zack Typing includes a dedicated link for reporting AI content. It opens your email program without attaching dictation text, audio or credentials. You choose what to send. We process your email address and message to handle your enquiry: Article 6(1)(b) GDPR for contract matters, otherwise Article 6(1)(f) GDPR for support and complaints. Send only necessary excerpts and remove information about uninvolved people. Support messages are needed only while handling the matter and, where applicable, meeting statutory duties or defending legal claims.

15. Zack KI reminders, engagement measurement and reminder emails

The Windows app may occasionally show a reminder about the Alt+1 context workflow for longer text you have copied yourself. This decision is made entirely locally. Clipboard content is not permanently stored for this purpose or sent to Zack KI servers, and is not included in the reminder. Clicking the reminder copies that specific text locally into a new chat as context. Only when you send a request is it processed like manually added chat context. Reminders appear only during the first 14 days after first launch or after at least 30 days without use, and have fixed time and frequency limits.

To understand whether users return after registration and whether reminders make Alt+1 easier to understand, Zack KI records a small set of content-free product events.

Purpose: Improving usability and engagement, identifying one-time use and measuring whether a reminder is followed shortly by use of the context shortcut.

Legal basis: Article 6(1)(f) GDPR. The legitimate interest is keeping the provided, possibly paid app understandable and limiting unnecessary or ineffective reminders using aggregate measurements.

Data categories: Account, time and only one of the predefined events: app opened, clipboard reminder shown, clipboard reminder opened, context shortcut used, pinning hint shown, pinning clicked or pinning successful. Clipboard or chat content, screenshots, filenames, visited websites, open programs and window titles are not recorded.

Recipients: Supabase for database storage and netcup GmbH for server operation.

Retention: At most 13 months, after which individual events are automatically deleted. Aggregate metrics that can no longer be traced to individual accounts may be retained longer.

If you use Zack KI during the first days and then stop opening it, Zack KI may also send at most two short reminder emails, but only if you selected the voluntary checkbox during sign-in. The first email is sent no earlier than three complete days without a successful request and only within the first seven days after account creation. A second, final email is sent no earlier than day 14 if there is still no usage. No further emails are sent for this occasion. These emails contain no clipboard, chat, screenshot, file, window or visited website content. Their button only opens the registered zackki:// protocol on your device.

Purpose: Reminding consenting users of a function already provided.

Legal basis: Article 6(1)(a) GDPR (consent). When sign-in is successfully completed, the time, consent version and displayed wording are recorded. You may withdraw consent prospectively through the unsubscribe link in each reminder email. Clicking it immediately blocks further reminders. Earlier lawful processing remains unaffected.

Data categories: Email address, account creation time, successful request times, language from the latest order, consent time, version and wording, delivery status, unsubscribe time and the times of the two possible messages. The reminder table contains no usage or communication content.

Recipients: Resend for email delivery and netcup GmbH for server operation.

Retention: Content-free delivery status and corresponding general Zack KI mail-log entries are automatically deleted after no more than 13 months. Evidence of consent and withdrawal is kept only as long as needed to establish or defend legal claims. Statutorily required delivery records for other messages follow their own applicable periods. The email itself is processed only in the email provider's normal delivery log.

16. App updates

Directly installed Windows apps regularly check for new versions by requesting a version-information file from the Zack server. Microsoft Store installations are updated by the Store; the app's direct updater is disabled. Microsoft's processing follows its Privacy Statement. The details below concern direct-installation update checks.

Purpose: Providing bug fixes, security updates and new versions.

Legal basis: Article 6(1)(b) GDPR for software provision and Article 6(1)(f) GDPR for secure operation of current versions.

Data categories: Technical connection data, especially the IP address. No usage profile is created.

Recipient: netcup GmbH as the server infrastructure operator.

Retention: Section 2 applies. Permanent access logs containing IP addresses or other personal data are not kept. Technical access logs without a personal link are kept for operational security and troubleshooting with limited retention.

17. Abuse prevention

Zack KI limits requests per account or device to prevent excessive or abusive load.

Purpose: Maintaining availability and protecting against abuse.

Legal basis: Article 6(1)(f) GDPR. The legitimate interest is protecting the service and its users.

Data categories: Counters associated with an account or device identifier.

Retention: Short-term rate limits usually expire within one hour. Records enforcing one-time starting credits and the account-free dictation trial have separate, longer retention (section 8d).

18. Service providers

Further provider information: OpenRouter, Microsoft, OpenAI API data processing. Their information does not replace our responsibility for processing we initiate.

19. Transfers to third countries

Some providers process data outside the European Union and European Economic Area.

For transfers to countries without a European Commission adequacy decision, Zack KI relies on the Commission's standard contractual clauses under Article 46(2)(c) GDPR, included in the relevant data processing or service agreements. Where a provider is certified under an adequacy decision, that decision takes precedence as the basis for transfer.

In particular, a title route using DeepSeek may involve processing in the People's Republic of China, which has no European Commission adequacy decision. Despite contractual safeguards, access by public authorities under local law cannot be entirely excluded. Only the chat excerpt sent for title generation is affected, not the rest of the chat history.

The relevant providers' privacy information contains additional details about their international processing.

20. Sources of data under Article 14 GDPR

Most personal data is supplied directly by users, for example when creating an account, sending AI requests or declaring withdrawal or cancellation.

Data not collected directly from users comes from Paddle in connection with orders and payment processing. This includes order number, email address, plan, amount and order or subscription status. It is processed for the purposes in section 7.

21. Whether provision is required

There is no statutory or contractual obligation to supply personal data. However, some functions cannot be provided without certain information:

• An account cannot be created and sign-in cannot take place without an email address.
• A paid plan cannot be purchased without required order and payment information. Payment details must be provided to Paddle.
• An AI answer cannot be generated without transmitting a request.
• Search queries are sent to Serper only when a web search is initiated.
• Consent to advertising measurement is voluntary and is not required to download, create an account, purchase or use the service. Refusal or withdrawal does not affect these options.
• Diagnostic transmission is voluntary and can be disabled in app settings.
• Local assessment of suitable clipboard reminders does not require transmission of copied content. Content-free product events are associated with the signed-in account.

22. Automated decisions and profiling

Zack KI does not make solely automated decisions under Article 22 GDPR that produce legal or similarly significant effects on users. The prepared advertising measurement in section 4a is currently disabled. If later enabled with consent, measurement data may be used to attribute events to ads and for ad optimization by OpenAI; see section 4a for details. The events in section 15 are analysed for statistical usage and engagement metrics, contain no user content and do not lead to decisions with legal or similarly significant effects.

AI answers are generated automatically but do not constitute a decision about the data subject.

23. Your rights

Subject to the statutory conditions, you have the following rights:

• Access, Article 15 GDPR: Information about whether and which personal data is processed.
• Rectification, Article 16 GDPR: Correction of inaccurate data and completion of incomplete data.
• Erasure, Article 17 GDPR: Deletion where the statutory conditions apply.
• Restriction, Article 18 GDPR: Restriction of processing where the statutory conditions apply.
• Portability, Article 20 GDPR: Receiving data in a structured, commonly used, machine-readable format or having it transmitted to another controller.
• Objection, Article 21 GDPR: Objecting, on grounds relating to your particular situation, to processing based on Article 6(1)(f) GDPR. This concerns diagnostics, automatic chat naming, engagement measurement and abuse prevention in particular.
• Withdrawal of consent: Withdrawing consent at any time for the future. Earlier lawful processing remains unaffected.

To exercise these rights, email hello@zack-ki.com.

24. Account deletion

You can request account deletion at the bottom of the Account section in the Windows app after explicit confirmation. An active, pending, paused or cancelling subscription must first have ended. If the app is unavailable, you can still request deletion by emailing hello@zack-ki.com.

Associated personal data is deleted unless statutory retention duties, particularly for orders and invoices, require continued storage. These records are restricted for the retention period and then deleted.

Technical backups are not used for ongoing operations and expire in the normal backup cycle. The primary backup is kept for at most 14 days and the separate secondary backup for at most 30 days.

On request, the app first provides a machine-readable export of the account's server data. Local chat and dictation histories, attachments, recordings and dictionaries are not covered by account deletion. Deletion affects the shared access for both apps and also removes account-related cached transcription results from the service. You can delete local data in the respective app.

25. Complaints to a supervisory authority

Under Article 77 GDPR, you may complain to a data protection supervisory authority if you believe your data is processed in breach of the GDPR. You may complain particularly to an authority at your habitual residence, workplace or the place of the alleged infringement.

The authority responsible for the controller is the North Rhine-Westphalia Commissioner for Data Protection and Freedom of Information (Landesbeauftragte für Datenschutz und Informationsfreiheit Nordrhein-Westfalen), Kavalleriestraße 2–4, 40213 Düsseldorf, Germany.

26. Changes to this policy

This policy is updated when app or service functions, providers or legal requirements change. The current version is available on the Zack KI website.