Privacy Policy

1. Overview

This Privacy Policy explains how Project Z (“Project Z”, “we”, “us”), available at projectz-ai.com, collects, uses, discloses and protects personal data when you use our AI workspace, in accordance with the EU General Data Protection Regulation (GDPR), the UK GDPR and applicable US privacy laws (including the California Consumer Privacy Act, “CCPA”).

We apply a data-minimisation principle: we only collect the data strictly necessary to create your account, operate the service and comply with legal obligations.

2. Data We Collect

Project Z does not operate its own username-and-password database. Sign-in is handled exclusively through trusted third-party identity providers — Google and Microsoft. When you sign in, we receive the minimum set of identity data those providers share:

• Full name — to display and personalise your account.
• Email address — as your unique account identifier and for essential service communication.
• Profile photo — to render your avatar in the interface.
• Authentication metadata — provider user ID and sign-in timestamps, required to maintain a secure session.
• Chat content and uploaded files — stored locally on your device and, where a feature requires it (for example Secure Vaults or the Knowledge Vault), in our encrypted database. We do not use your content to train AI models.
• Usage counters — daily counts of answers, image generations and uploads, required to enforce the limits of your plan.
• Subscription data — plan status and billing cycle, processed by our payment provider Stripe. We never see or store your full card details.

3. How We Use Your Data

• To create and secure your account and authenticate you via Google or Microsoft.
• To provide the service: processing your prompts and files through AI models to generate responses.
• To enforce plan limits and manage subscriptions purchased through Stripe.
• To provide support and respond to your requests, including account or data deletion.
• To detect abuse, prevent fraud and keep the platform safe.
• To comply with legal and regulatory obligations.
• We do not sell your personal data, and we do not use it for behavioural advertising.

4. Data Sharing & Processors

We share personal data only with the processors necessary to operate the service, each bound by data-processing agreements:

• Identity providers (Google, Microsoft) — authentication only; they never receive your chat content from us.
• AI providers — your prompts, images and files are transmitted to the AI model powering the feature you are using, solely to generate your response. Prompts are not used to train third-party models under our provider agreements.
• Stripe — payment processing; Stripe acts as an independent controller for payment data under its own privacy policy.
• Hosting and database infrastructure — encrypted storage and delivery of the application.

5. Data Security

• All traffic is encrypted in transit with TLS; stored data is encrypted at rest.
• Row-level access control ensures an authenticated user can read and modify strictly their own data.
• Payment secrets, API keys and service credentials are kept exclusively server-side and are never exposed to the browser.
• Secure Vault conversations are encrypted and stored on your device only, with optional automatic self-destruction after a timer you choose.
• We review access rights regularly and apply the principle of least privilege.

6. Data Retention

Chat history is stored on your device and for as long as your account is active. Daily usage counters and subscription records are retained while your account exists or as required for accounting and tax purposes (typically up to 10 years for billing records). You can clear all locally stored data at any time from Settings, or delete your account entirely as described below.

7. Your Rights

Under the GDPR you have the right to access, rectify, erase, restrict and port your personal data, the right to object to processing, and the right to lodge a complaint with your supervisory authority. Under US state laws such as the CCPA, you have the right to know what personal information we collect, to delete it, to correct inaccurate information, and not to be discriminated against for exercising these rights. California residents may designate an authorised agent to submit requests on their behalf.

We do not sell or share personal information for cross-context behavioural advertising as defined by the CCPA.

8. Deleting Your Account & Data

You can delete your account at any time. Deleting your account erases your profile (name, email, profile photo), your stored vaults, personas and usage records. Data retained solely for legal accounting obligations is kept only for the statutory period and then deleted.

To request deletion, either use the account-deletion option in the app’s settings or email us at the address listed in the Contact section below. We will verify your identity and complete the deletion within 30 days, confirming in writing.

9. International Data Transfers

Your data may be processed in countries other than your own, including the United States. Where personal data leaves the EEA or UK, we rely on adequacy decisions or the European Commission’s Standard Contractual Clauses with our processors to ensure an equivalent level of protection.

10. Children’s Privacy

Project Z is not directed at children under 16 (or under 13 where a lower age is required by local law, in which case that lower age applies). We do not knowingly collect personal data from children below the applicable age. If you believe a child has created an account, contact us and we will delete it.

11. Changes to This Policy

We may update this Privacy Policy as the service evolves. Material changes will be announced in the app or by email before they take effect. The “Last updated” date above reflects the current version.

12. Contact

For any privacy question, data-access request or deletion request, contact us at support@projectz-ai.com. If you are in the EEA or UK and believe we have not resolved your concern, you may also contact your local data-protection authority.