Privacy Policy

Last updated: July 26, 2026

1. Introduction

This privacy policy describes how Félix-Olivier Cloutier, operator of the zelios service (the "Service"), available at zelios.app, collects, uses, retains, and protects users' personal information ("you", "your").

This policy applies to anyone who uses zelios. By using the Service, you consent to the practices described below, with the understanding that certain uses (notably promotional communications, see section 4.4) require a separate, explicit consent from you.

This policy is written in accordance with Quebec's Act Respecting the Protection of Personal Information in the Private Sector ("Law 25") and, where applicable, Canada's Anti-Spam Legislation (CASL).

2. Person responsible for the protection of personal information

In accordance with Law 25, a person is designated as responsible for the protection of personal information within zelios:

Responsible person: Félix-Olivier Cloutier Email: support@zelios.app

Any question, request for access, rectification, or complaint regarding your personal information may be addressed to this person. We acknowledge receipt of any request within 5 business days and respond within the timeframe required by law (30 days).

3. Information we collect

3.1 Information provided directly

• Email address (when creating an account)
• Password (encrypted — we never have access to it in plain text)
• Profile information provided by Google if you sign in via Google (name, email address, profile picture)

3.2 Uploaded photos

You upload photos so they can be automatically classified using labels. These photos are never permanently stored on our servers. They are processed transiently, for the following purposes only:

• Transmission to a third-party AI provider (Anthropic) to perform automatic classification
• Returning the classification result to your device

Once processing is complete, photos are not retained by zelios. The third-party AI provider may have its own short-term retention practices as part of processing the request — see its privacy policy for details.

3.3 Billing information

Payments are processed by Stripe. We never store your credit card information on our servers. Stripe may collect and process billing information in accordance with its own privacy policy, available at stripe.com/privacy.

3.4 Technical and analytics information

We use Vercel Web Analytics to understand general Service usage. This tool:

• Uses no cookies
• Identifies visitors using an anonymous hash generated from the request, not tied to an identifiable individual
• Retains data in aggregated form for a short period (24 hours for raw data)

No prior cookie-banner consent is required for this tool, since it does not collect personal information within the meaning of the law.

4. Purposes of collection

We use your personal information to:

• Create and manage your user account
• Provide the photo classification service
• Process your payments and manage your subscription
• Communicate with you regarding your account or the Service (transactional communications)
• Improve and secure the Service
• Comply with our legal obligations

4.4 Promotional communications

If you have explicitly consented to receive promotional or marketing emails at sign-up, we may occasionally send you communications about new features or offers. This consent is separate and optional — you can unsubscribe at any time via the link in each email, without affecting your access to the Service.

We never sell your personal information to third parties.

5. Subcontractors and data transfers

To operate the Service, we rely on the following providers, who may process your personal information on our behalf:

| Provider | Function | Server location | |---|---|---| | Supabase | Authentication and database | Currently United States; migration to a Canadian region planned | | Stripe | Payment processing | United States / international | | Google | Authentication (Google sign-in) | International | | Anthropic | Automatic photo identification (transient processing, not stored) | International | | Vercel | Hosting and anonymized analytics | International |

Transfers outside Quebec: some of these providers retain or process data outside Quebec, including in the United States. In accordance with Law 25, we ensure that these providers offer an adequate level of protection for your personal information before entrusting them with this data, and a privacy impact factor assessment is carried out for these transfers.

6. Retention of information

• Account information (email, password): retained for as long as your account is active, and deleted within a reasonable period following account deletion.
• Uploaded photos: never retained — transient processing only (see section 3.2).
• Billing information: retained by Stripe in accordance with its own legal obligations (generally required for tax and accounting purposes).

You may request the deletion of your account and data at any time (see section 8).

7. Security

We implement reasonable measures to protect your personal information against loss, theft, and unauthorized access, use, or disclosure, including:

• Password encryption
• Secure connections (HTTPS)
• Restricted access to personal information
• Non-retention of uploaded photos, reducing the risk surface in the event of an incident

However, no system is completely infallible. In the event of a privacy incident presenting a risk of serious harm, we will notify you as well as the Commission d'accès à l'information, in accordance with our legal obligations.

8. Your rights

In accordance with Law 25, you have the following rights regarding your personal information:

• Right of access: obtain a copy of the personal information we hold about you
• Right of rectification: have inaccurate, incomplete, or ambiguous information corrected
• Right to withdraw consent: withdraw your consent to the collection or use of your information, including consent to promotional communications
• Right to portability: in certain cases, obtain your information in a structured, commonly used technological format
• Right to erasure: request deletion of your account and associated information

To exercise these rights, contact us at support@zelios.app. We acknowledge your request within 5 business days and respond within 30 days.

If you believe your rights have not been respected, you may file a complaint with the Commission d'accès à l'information du Québec (CAI).

9. Cookies

The Service uses essential cookies to maintain your login session. These cookies are necessary for the Service to function and do not require separate consent. Our analytics tool (Vercel Web Analytics) uses no cookies (see section 3.4).

10. Minors

The Service is not directed at individuals under the age of 14. We do not knowingly collect personal information from minors under 14 without the consent of a parent or guardian.

11. Changes to this policy

We may update this privacy policy from time to time. Any material changes will be communicated to you by email or through a notice on the Service. The date of the last update appears at the top of this document.

12. Contact us

For any questions regarding this privacy policy or your personal information:

Email: support@zelios.app