Privacy notice.

Who controls your data

ZinXan AI Ltd is the controller for personal data described in this notice. We are registered in England and Wales under company number 12451101, at 22 Spenser Crescent, Daventry, England, NN11 9DX.

Contact us at hello@zxn.studio.

What we collect

• Account details such as your name, email address and verification status.
• If you choose Sign in with Apple, your Apple account identifier, the name and email address Apple shares with us, and an encrypted authorisation token used to manage that connection. You can choose Apple’s private relay email address.
• If you add a passkey, its public credential, the name you give it, and creation and last-used details. Your private key stays with your passkey provider. We do not receive your Face ID, Touch ID or other biometric data.
• Billing references, plan status and transaction events supplied by Stripe or Apple, including Apple purchase identifiers needed to verify and restore in-app purchases. We do not receive or store your full card number.
• Device names, hashed connection tokens, and connection, last-used and revocation times needed to authorise up to two Macs and two iPhones or iPads, and let you revoke them remotely.
• Messages and attachments you choose to send to support.
• Product feedback or testimonials you choose to submit, including any rating, name, role or publication permission you provide. In-app feedback also includes the app version, platform and a one-way hash of the request IP address for abuse prevention; it does not include your project or footage.
• App usage reports. Once a day the app notes that it was opened. After each export it reports whether the export succeeded, failed or was cancelled; its resolution, frame rate, format and length; how long it took; how many media files it used; whether you are on the free plan or Studio; and the identifiers of the filters, effects, transitions, text styles and features it used, such as background removal or text behind a subject. Each report also carries the app version and whether it came from a Mac or an iPhone or iPad. We do not put your account, device identifier, file name, footage or text you wrote in a usage report. Our service may process the request IP address in separate security logs.
• Error reports. When an export fails, the app sends the error message with the app version, the platform and the export details listed above. If you are signed in, the report is linked to your account so we can find it if you contact us about the problem; if you are not, it is linked to no one. The app removes your user name from file paths before sending, but a message can still include a file name.
• Technical logs such as request time, IP address, browser information and errors needed to secure and operate the service.
• Aggregate website usage information, such as visited pages, referrers, device type and country, collected through Umami analytics.
• Daily app-download totals by the two-letter country code supplied by Cloudflare. These totals are not linked to an account or stored with an IP address.
• Your marketing preference and the date you opted in, if you choose to receive product updates.

Your footage and editing projects stay on your Mac, iPhone or iPad during normal use of ZXN Studio. Usage and error reports describe how the app was used, never what you made. We receive your material when you deliberately upload it to your cloud library, send it to support or use a separately identified online service. Cloud upload is optional; recording and exporting alone do not upload anything.

Your cloud library

When you choose to upload, we store the recording files or exported video you select, its title and version information. Editable project assets are separate and private. We store comments, replies, timestamps and reactions with the video version they refer to and the account that posted them. We inspect uploaded videos for playback compatibility; exports are encoded locally on your device.

New videos are private. Unlisted videos can be viewed by anyone holding their link, including someone it is forwarded to. Public videos can be viewed by anyone. A viewer can save the bytes of any video they can play. Retained original recordings remain private after an export replaces them unless you explicitly allow original downloads. Share pages do not load website analytics.

Managed uploads use a dedicated private Cloudflare R2 bucket. If you connect your own R2 bucket, we encrypt its access credentials at rest and use them for the uploads and downloads you request. Disconnecting a bucket requires removing its library references first; deleting your account revokes its share links and removes our credentials, while completed files in your own bucket remain yours.

When monthly access ends, new managed uploads stop. Your existing files remain available for download and deletion. We have not enabled automatic deletion after cancellation. Deleting a cloud video removes its managed objects, retained versions and feedback; deleting your account also removes its managed library. Incomplete uploads expire after one day and their reserved capacity is released only after remote cleanup succeeds.

Why we use it

• Contract: to create and manage your account, provide paid access, activate and remotely revoke devices, and answer support requests about your service.
• Legitimate interests: to secure and troubleshoot the service, prevent fraud and licensing abuse, understand aggregate demand for the app by country, answer other enquiries, and establish or defend legal claims.
• Legal obligation: to keep required accounting, tax, consent and regulatory records and respond to lawful requests.
• Consent: to send optional marketing and, separately, app usage and error reports. You can withdraw consent for marketing from Account & billing and turn each kind of app report off in the app’s settings, without affecting earlier processing.

Where we rely on legitimate interests, we consider whether the processing is necessary and whether your rights and interests override ours. Account and entitlement information is required to provide those services; marketing and support attachments are optional.

Device checks

ZXN Studio sends a device name and connection token when you connect a Mac, iPhone or iPad. We store only a hash of that token, together with connection, last-used and revocation times. The service checks these records to enforce the limit of two Macs and two iPhones or iPads and decide whether to issue a signed entitlement. A revoked device loses online paid access, although an entitlement already cached while offline can remain valid only until its signed expiry time.

App usage and error reports

When enabled, the Mac and iOS apps send the usage and error reports described above directly to our own service at zxn.studio. No analytics company receives them. Usage reports are sent without your connection token, even when you are signed in. Error reports may be linked to your account when you are signed in.

If you are offline, reports wait on your device and are sent the next time you open the app or finish an export. Reports that are still unsent after 30 days are discarded. Development and test builds send nothing.

On a Mac, the app tells you the first time you open it that reports are on, and records nothing before that. On an iPhone or iPad, it asks first and records nothing unless you allow it. You can turn usage reports and error reports off separately, at any time: on a Mac in Settings, under Privacy, and on an iPhone or iPad in the editor’s settings. Turning one off also deletes any of those reports still waiting on your device.

Who receives it

We use service providers only where needed to operate ZXN Studio: Stripe for website payments, invoices and subscription management; Apple for Sign in with Apple and App Store purchases; Laravel Cloud and its infrastructure providers for hosting; Cloudflare for DNS, security, storage and transactional email; and Umami for aggregate website analytics. Support providers receive only the information needed to answer your request.

Some providers process data outside the UK. Where this happens, we rely on an adequacy decision or appropriate contractual safeguards made available by the provider. You can ask us for more information about those safeguards.

Cookies and local storage

The site uses strictly necessary session and security cookies for sign-in, checkout protection and account access. Your colour-theme choice is stored locally in your browser. The apps keep unsent reports, the date of the last daily report and your choice about reports on your device. Umami measures aggregate site usage without advertising cookies or cross-site advertising profiles. We do not use advertising trackers. Stripe may set its own necessary checkout cookies under its privacy notice.

How long we keep it

We keep account and entitlement records while your account or paid access remains active. Billing and transaction records are kept for the period required by tax, accounting and dispute rules. Security logs are kept only as long as reasonably needed to investigate and prevent misuse. Support correspondence is kept while a request is active and then only as long as needed for follow-up or legal obligations.

Deleting your account removes its passkeys and Apple sign-in connection and revokes our Apple authorisation. Purchase records that we need to retain are no longer linked to the deleted account.

Daily app-download totals by country are retained as aggregate statistics and are not linked to accounts or IP addresses.

App usage reports are retained as statistics that are not linked to anyone. Error reports are deleted 12 months after we receive them. If your account is deleted sooner, its error reports remain until then but are no longer linked to you.

Feedback is kept while it remains useful for product improvement or follow-up. Unpublished testimonials are reviewed and deleted or anonymised when no longer needed; approved testimonials may remain published until permission is withdrawn.

When data is no longer needed, we delete or anonymise it unless the law requires us to retain it.

Your data protection rights

Depending on the circumstances, you may ask for access, correction, deletion, restriction, objection or portability of your personal data. Where processing depends on consent, you may withdraw it at any time. Email hello@zxn.studio to exercise a right; we may need to verify your identity first.

You can complain to the UK Information Commissioner’s Office at ico.org.uk. If you live elsewhere, you may also have the right to complain to your local data protection authority.

Children and changes

ZXN Studio is not directed to children under 13, and a purchaser must be able to enter a binding contract. We do not knowingly collect children’s data through the account service.

We may update this notice when our product or legal obligations change. The effective date at the top shows when the current notice began to apply.