Legal

Privacy Policy

Zora-Labs (zora-labs.com)

Effective from: 12 August 2026 · Version: 1.0

Polish version is binding. In case of any discrepancy, the Polish text of the Polityka prywatności prevails.

This Privacy Policy describes how Zora-Labs Sp. z o.o. collects, uses and protects the personal data of Users of the Zora-Labs Platform. The document supplements the Terms of Service and is compliant with the GDPR and the Polish Personal Data Protection Act.

1. Data controller

  1. The controller of your personal data is: Zora-Labs spółka z ograniczoną odpowiedzialnością, ul. Gospodarcza 26, 20-213 Lublin,

    • KRS: 0001254218
    • NIP: 9462770116
    • REGON: 545249855
    • Court of registration: District Court for Lublin-Wschód in Lublin with its seat in Świdnik, 6th Commercial Division of the National Court Register

  2. Privacy contact:

  3. We have not appointed a Data Protection Officer (DPO). For all matters concerning personal data, write to [email protected]. We respond without undue delay, no later than within one month (Art. 12(3) GDPR). In complex cases or where there are many requests, we may extend the deadline by a further two months — we will inform you of this.

2. Two roles: controller and processor

Zora-Labs acts in two roles.

2.1. We are the controller when we process

  • Account data (e-mail, hashed password, user ID),
  • billing data and subscription status received from LemonSqueezy,
  • technical logs, IP address, device identifiers and Platform usage data recorded in our own admin panel,
  • the content of support correspondence,
  • consents, statements and the history of their withdrawal.

2.2. We are the processor when third-party data is in the material

If you upload a recording containing the image, voice, name, statement or other data of third parties (podcast, interview, webinar, panel):

  • You are the controller of that data,
  • Zora-Labs is the processor (Art. 28 GDPR) and we process it only on your instructions, to provide the Service.

You must have a legal basis (consent of the person, contract, legitimate interest, licence). Details of the entrustment are set out in the Data Processing Agreement (DPA) — available on request.

We do not use third-party data from your materials for marketing or for model training.

3. What data we collect

We collect only what we need for the Service, billing, security and product maintenance.

3.1. Account and identification data

  1. E-mail address — from registration; for logging in, confirmations and contractual communication.
  2. Password — only as a cryptographic hash; for authentication.
  3. User ID / UID — assigned by the system (Firebase Auth); to associate projects, limits and events in the panel.
  4. Name, company name, tax ID, country — if you provide them in the profile, on an invoice or during onboarding; for billing, distinguishing creator from editor, and B2B.
  5. Phone number — if you provide it; for contact and account recovery.

We do not require a national ID number, ID document or special category data (Art. 9 GDPR) to open an Account.

3.2. Payment data

Payments are handled by LemonSqueezy (Sold through Link, LLC, USA) as Merchant of Record. LemonSqueezy is a separate controller of the data needed for payment, invoicing, taxes (VAT/GST/sales tax), fraud prevention and refunds. Zora-Labs does not store the full card number or CVV. We receive only operational data, including:

  • payment and subscription status,
  • customer / subscription identifier,
  • chosen Plan, amount, currency, renewal date,
  • country / tax jurisdiction,
  • billing e-mail.

Details: https://www.lemonsqueezy.com/privacy

3.3. Content you upload (Customer Content)

At your request we process:

  • video and audio files and URLs,
  • transcripts, speaker diarisation, timestamps,
  • project settings (SPF / Editor Mode, language, aspect ratio, subtitle preferences),
  • generated clips, raw fragments, subtitles, descriptions, tags, summaries (Results).

These may contain personal data of you or third parties. We process them only to perform the task you have commissioned.

3.4. Service usage data (own admin panel)

We do not use external product analytics tools (in particular we do not use Mixpanel, Google Analytics, Hotjar or similar SDKs). All usage measurement takes place in our own admin panel running on our infrastructure (GCP / Firebase).

Events are tied to the Account (UID / e-mail). They are not anonymous data. We do not pretend that analytics is anonymous where it can be linked to you.

We distinguish three layers.

A. Operational and billing data (always, because without them the Service does not work)

  • duration of the uploaded file (minutes / seconds) and the number and volume of jobs,
  • chosen mode (SPF / Editor Mode) and job parameters (format, language, quality),
  • processing status (queue, start, success, error, render time),
  • which Results were displayed, saved or downloaded (project / clip ID, date, file type),
  • Plan usage (limit percentage, top-up, reset date),
  • pipeline error logs needed to diagnose your job.

This data is also visible in the admin panel, because we have to bill minutes, maintain limits and know whether a job succeeded.

B. First-party UI events

To know how the Platform is used and where it gets stuck, we store in our database events linked to the UID, including:

  • screens visited and the in-app path (e.g. registration → upload → result → download),
  • clicks and use of specific elements (buttons, mode switch, subtitle settings, cancellation, Plan change),
  • session time, return frequency, retention (activity in subsequent weeks),
  • the moment of path abandonment (where the user stopped using),
  • device type, browser, UI language,
  • approximate location at the country / region level (from the IP address, without the precise address),
  • entry source if you came from a link with UTM parameters — we store them with us, without sending them to an external analytics provider.

These events are not used to sell data or to advertise on other sites. They serve product development, UX error detection, support (when you write to support we see the context) and verification that the Service actually works (e.g. that clips are being downloaded).

We do not send this layer to any analytics provider. It stays in our database.

C. Infrastructure telemetry (after aggregation / anonymisation)

GPU cluster load, queue times, regional failure rates — with the UID removed. This can no longer be linked to you.

What we do not do in usage measurement:

  • we do not use Mixpanel, Google Analytics, Amplitude, Hotjar, FullStory, Clarity or similar third-party tools,
  • we do not record screen video or cursor movement (session replay),
  • we do not attach the content of your video, transcripts or audio samples to events,
  • we do not link the path on Zora-Labs with your activity on other sites (no cross-site tracking pixels).

3.5. Technical and security data

IP address, request date and time, user-agent, browser language, session identifiers and necessary cookies — to maintain login, billing and security.

3.6. Communication and support

The content of e-mails, tickets, Discord messages (if you use it) and voluntary surveys (e.g. for extra minutes).

3.7. Data we deliberately do not collect

  • special categories of data (health, biometrics for identification, opinions, religion, sex life),
  • data of children under 18,
  • browsing history on other sites,
  • full payment card data.

If your video material accidentally contains special category data — we do not use it for identification, psychological profiling or purposes other than the cut you requested.

We process data for the following purposes and on the following bases:

  1. Account registration, login, Service provision — Account data, Content, job status. Basis: Art. 6(1)(b) (performance of a contract).
  2. Limit calculation, delivery of Results, job diagnostics — layer A: minutes, status, downloads, errors. Basis: Art. 6(1)(b).
  3. Plan billing, renewal, Plan change — subscription status, e-mail. Basis: Art. 6(1)(b).
  4. Payment processing, invoicing, taxes — data at LemonSqueezy and status with us. LemonSqueezy: contract and legal obligation. Us: Art. 6(1)(b) and (c).
  5. Security, abuse, fraud, infrastructure protection — IP, logs, atypical usage patterns. Basis: Art. 6(1)(f).
  6. Complaints, withdrawal, digital service conformity — Account, order and job history. Basis: Art. 6(1)(c).
  7. Support handling — content of the request and the usage context from the panel. Basis: Art. 6(1)(b) or (f).
  8. Own product development, UX improvement, retention, abandonment detection — layer B: screen and click events in our own panel. Basis: Art. 6(1)(f) (legitimate interest: improving our own Service, without selling data and without advertisers). You may object (item 11.6).
  9. Pursuit and defence of claims — the minimum necessary. Basis: Art. 6(1)(f).
  10. Cluster statistics after anonymisation — layer C. After effective anonymisation, outside the scope of GDPR.
  11. Newsletter / marketing of own Services — e-mail. Basis: Art. 6(1)(a) or — for existing customers — Art. 10(2) of the Polish Act on Rendering Services by Electronic Means, always with the right to opt out.
  12. Voluntary surveys, affiliate programme — data you provide yourself. Basis: Art. 6(1)(a) or (b).
  13. Training AI models on your files — Content. Basis: only Art. 6(1)(a) (explicit, separate consent). We do not do this by default.

Legitimate interest (Art. 6(1)(f)). For each such purpose we balance our interest against your rights. You may object. We do not rely on this basis where law requires consent (marketing, non-essential device cookies).

Layer B is first-party and stays on our servers. If in the future we were to record on your device an analytics identifier going beyond the login session, we will ask for consent in the banner (Art. 399 of the Polish Electronic Communications Law). Today, usage measurement comes from requests to our API after login and from records in our database — without an external tracker.

Requirement to provide data. E-mail and acceptance of the documents are conditions for entering into the Agreement. Without them we cannot open an Account. Without payment data, a paid Plan is not possible.

5. What we will never do

  1. We do not sell personal data. Ever.
  2. We do not share data with data brokers or advertising networks for resale.
  3. We do not train our own or external AI models (including Grok / xAI) on your private video, audio, transcripts or Results without your explicit, separate consent.
  4. We do not use tracking pixels to monitor your activity on other sites and browser tabs.
  5. We do not build a psychological profile, social scoring or credit assessment.
  6. Voice emotion analysis is used solely to rank the usefulness of an editing fragment. It is not biometrics for identification and may not be used to evaluate employees, students or candidates.
  7. We do not pretend that usage measurement is anonymous where the event can be linked to your Account.
  8. We do not enable session recording (session replay) without separate notice and consent.
  9. We do not pass clicks, downloads or in-app paths to external analytics platforms.

6. Data recipients

We share data only where necessary for the Service, required by law, or based on your consent.

6.1. Processors acting on our instructions

  • a) Google LLC / Google Cloud / Firebase (Authentication, database, Cloud Storage, hosting). Role: Platform hosting, account, files, own admin panel and usage logs. Data: Account, Content, Results, layer A/B events, logs. Location: Google global infrastructure; Firebase Authentication — exclusively USA.
  • b) RunPod, Inc. Role: GPU processing (serverless / spot). Data: video/audio files for the duration of a job, processing artefacts. Location: EEA, USA, Republic of Korea, Japan and other instance regions.
  • c) X.AI LLC (xAI) — Grok API. Role: semantic analysis, transcription support, descriptions, tags. Data: text fragments / metadata needed for a specific request. Location: primarily USA.
  • d) E-mail provider (e.g. Resend or equivalent). Role: sending confirmations and support replies. Data: e-mail, message content. Location: EEA / USA.
  • e) Development tools necessary for operation (CI/CD, error monitoring). Role: stability and security. Data: technical logs, minimum scope. Location: EEA / USA.

Click, download and in-app path events are not sent to RunPod or xAI. They go only to our database on GCP. RunPod gets the file for the render duration. xAI gets only what is needed for the language layer of a given job.

The AI architecture is modular. In the event of an outage or a quality need we may switch the language component to another model (e.g. Anthropic Claude or Google Gemini). Before doing so on production data, we will update this list and — if the change is material — inform you.

6.2. Independent controller — payments

Sold through Link, LLC (formerly Lemon Squeezy LLC), USA — Merchant of Record. LemonSqueezy independently determines the purposes and means of processing card data, taxes, invoices, chargebacks and AML/fraud. We are not their processor in this respect and do not have access to full card data.

6.3. Other disclosure situations

  • state authorities, courts, law enforcement — only where required by law or a binding request,
  • legal advisors, accountants, auditors — under contractual confidentiality, minimisation,
  • business purchaser / legal successor — only to the extent necessary, with notice to you,
  • another entity — only with your consent.

We do not sell user lists.

7. Transfers outside the European Economic Area

The Service is cloud-based. Some processing must take place outside the EEA.

  1. USA. Firebase Authentication (login data), part of GCP (including the admin panel database), LemonSqueezy payments, the Grok (xAI) API and part of RunPod jobs go there. Mechanism: EU–US Data Privacy Framework for certified entities (incl. Google LLC); otherwise standard contractual clauses (Decision 2021/914) and supplementary measures (encryption in transit and at rest, access control, minimisation, retention).
  2. Japan. Possible RunPod instances. Mechanism: Commission adequacy decision (2019/419).
  3. Republic of Korea. Possible RunPod instances. Mechanism: Commission adequacy decision (2022/254).
  4. EEA. Preferred storage and computation regions where available. Intra-EU transfer — no additional mechanism required.

Particularly important: login (Firebase Authentication) is performed in data centres in the USA. By using the Platform you accept this transfer as necessary for the performance of the Agreement. We store Service usage data in the same GCP infrastructure as the Account — we do not send it to a separate analytics provider in the USA.

A copy of information about the SCCs applied or DPF certification confirmation is available on a justified request (to the extent it does not breach the provider's business secrets).

We do not base permanent, large-scale transfers on the exceptions in Art. 49 GDPR.

8. How long we keep data

We follow the storage limitation principle (Art. 5(1)(e) GDPR).

  1. Account data — for the duration of the Agreement; after Account deletion, deletion or anonymisation without undue delay, no later than within 30 days, with the exceptions below.
  2. Original videos and Results — according to the active Plan's retention (Price List). After expiry, downgrade of the Plan or exceeding the retention, files are automatically deleted. We recommend keeping your own local copies.
  3. Working copies / cache at RunPod — for the duration of the job plus a short technical buffer (usually hours).
  4. Input/output sent to the xAI Grok API — per xAI's policy: by default up to 30 days (encrypted, for abuse audit, without training), then automatic deletion.
  5. Operational data (layer A) — for the duration of the Account and up to 24 months after deletion to the extent needed for complaints and billing, then anonymisation or deletion (invoices 5 years anyway).
  6. First-party UI events (layer B) — by default up to 24 months, then deletion or permanent anonymisation. After objection we stop recording new layer B events and remove or detach from the UID existing ones — on request (Art. 17 / 21).
  7. Security and IP logs — usually up to 90 days, longer only in the event of an incident.
  8. Billing data, invoices, complaints — for the period required by law (in PL generally 5 years from the end of the tax year) and the statute of limitations on claims.
  9. Consents and their withdrawal / objections — for as long as we must demonstrate accountability (usually up to 3 years from withdrawal / end of the Agreement).
  10. Support correspondence — up to 3 years from the closing of the ticket, unless a longer period follows from a dispute.
  11. Backups — rotational; after deletion from production systems they disappear from backup copies in the backup retention cycle (Google: deletion from Firebase Auth live and backup systems usually within 180 days of a user deletion request).
  12. Anonymised / aggregated data — may remain, as it is no longer personal data.

If we cease business, we will inform you with at least 30 days' notice so that you can download your files — where possible.

9. Artificial intelligence and automated processing

  1. The Service uses AI: a proprietary selection algorithm (silence, pace, transcription, diarisation, emotions, audio energy, stem separation) and the Grok (xAI) model for the language / descriptive layer.
  2. The decision "which 8–15 fragments to cut" is automated. It does not produce legal effects or similarly significant impact within the meaning of Art. 22 GDPR. It is an editing tool. You may reject a clip, choose another mode or not publish the Result.
  3. The measurement of which clips you download and which features you use is not an automated decision under Art. 22. It serves the maintenance and improvement of the Service.
  4. Results may contain errors. Always verify them before publication.
  5. xAI states that it does not train on API data without the customer's explicit consent. We do not give such consent on your behalf.
  6. We do not send your entire channel archive "just in case" to xAI. We send only what is needed for a specific request.
  7. Broader information about AI — in the Terms of Service (§ 9, AI Act).

10. Cookies and similar technologies

We use cookies, local storage and similar mechanisms on our own.

  1. Essential — login session, CSRF, language, checkout state, banner. No consent required.
  2. Third-party analytics / advertising pixels — not used.
  3. Marketing cross-site pixels — not used.

Usage events (layers A and B) are stored server-side after login, in our panel. We do not install an external analytics script for this purpose.

LemonSqueezy may set its own cookies at the payment stage. Its policy applies independently.

If in the future we add non-essential cookies on the device (e.g. a persistent analytics identifier or a campaign pixel), they will appear in the banner as a separate category and will be enabled only after consent.

11. Your rights

You have the rights under Art. 15–22 GDPR. You can exercise some of them yourself in the Account settings; the rest by e-mail: [email protected].

11.1. Access (Art. 15)

You can obtain confirmation as to whether we process your data and a copy — including information about which categories of usage events we record for your Account.

11.2. Rectification (Art. 16)

You can correct your e-mail and profile data in the panel or via support.

11.3. Erasure — "right to be forgotten" (Art. 17)

You can delete your Account in the panel. We will delete the Account data and layer A/B events linked to the UID, unless we must retain a fragment (accounting, claims, legal obligation). Videos and Results are deleted according to retention. Deletion is irreversible — download your materials first.

11.4. Restriction of processing (Art. 18)

E.g. when you contest the accuracy of data or have lodged an objection.

11.5. Portability (Art. 20)

Data you have provided to us and that we process on the basis of contract or consent, we will provide in a standard machine-readable format (e.g. JSON / file export), where technically feasible.

11.6. Objection (Art. 21)

You may object to processing based on Art. 6(1)(f), including the recording of UI events (layer B) in our own panel. After the objection:

  • we stop recording new clicks / screen paths going beyond what is necessary for the operation of the Service,
  • layer A continues to operate (minutes, jobs, downloads, limits) — without it we do not provide the Service,
  • for direct marketing, the objection is absolute.

Send the objection to [email protected] or — when we provide a toggle — turn it off in Account settings → Privacy.

At any time, as easily as it was given. It does not affect the lawfulness of processing before withdrawal.

11.8. Complaint to the supervisory authority (Art. 77)

President of the Personal Data Protection Office · ul. Stawki 2, 00-193 Warsaw · https://uodo.gov.pl · helpline: 606 950 000

If you reside in another EEA state, you may lodge a complaint with your national authority.

We do not make decisions about you based solely on automated processing that produce legal effects within the meaning of Art. 22 GDPR.

The request is free. For clearly unfounded or excessive requests we may charge a fee or refuse — we will inform you of the reason. Before releasing data, we may ask you to confirm your identity (e.g. from the Account you are writing from).

12. Security

We apply measures appropriate to the risk (Art. 32 GDPR), in particular:

  • transmission encryption (TLS),
  • encryption of data at rest with major cloud providers,
  • passwords only as hashes,
  • access control: only authorised team members have access to production and the admin panel, for diagnostic, support and maintenance purposes,
  • GPU billing per actual seconds,
  • environment separation, API limits, abuse monitoring,
  • incident reporting procedure.

We do not guarantee absolute Internet security. Protect your password and device. Report suspected intrusion immediately to [email protected].

A personal data breach carrying a risk for individuals will be notified to the President of UODO within 72 hours of discovery, and we will notify you if the risk is high (Art. 33–34 GDPR).

13. Third-party data in your materials

If you upload someone else's image or voice:

  1. you declare that you have the right to do so,
  2. we will not use that data beyond performing your order,
  3. a third party's request ("remove my face / voice") is handled in cooperation with you; if you do not demonstrate a basis, we may delete the material or restrict processing,
  4. we cannot independently identify all individuals in a recording — we need your cooperation.

Do not use the Service as a tool for monitoring employees or students without meeting separate requirements. Emotion analysis is not intended for that and is prohibited for that purpose (Terms of Service).

14. Children

The Service is exclusively for persons aged 18 or over. We do not knowingly collect data of children. If we learn that an Account was opened by a minor, we will delete it along with the data. Parent / guardian: write to [email protected].

The Platform may contain links to YouTube, TikTok, Instagram, Discord, provider documentation. Their privacy policies are independent. LemonSqueezy operates under its own rules for payments.

16. Changes to this Policy

We may change this Policy when the law, the interpretation of an authority, the scope of the Services, the infrastructure or the recipients change.

For material changes, we will notify you by e-mail or in the panel at least 14 days in advance and publish a new dated version. Continued use after the changes take effect, notification and the real possibility to opt out constitutes acceptance of the new version. If you do not accept — delete the Account before the effective date of the changes.

If we enable external analytics or advertising pixels, we will update this document before deployment and — where required by law — ask for consent.

The latest version is always at https://zora-labs.com

17. Final provisions

  1. This Policy supplements the Terms of Service. In case of discrepancy concerning personal data protection, this Policy prevails; in other respects — the Terms.
  2. The binding language is Polish.
  3. Questions, requests, objections: [email protected].

Zora-Labs Sp. z o.o. · ul. Gospodarcza 26, 20-213 Lublin · KRS 0001254218 · NIP 9462770116 · REGON 545249855 · [email protected] · +48 794 346 536 · https://zora-labs.com

Last updated: 12 August 2026

Zora LabsZora Labs

Clips, captions, transcription, and dubbing. Tools that help you get more from every recording.

European Union — European Funds for Eastern Poland

„Project Zora-Labs“ „Unicorn Hub Start-Up Platform – Edition II“ co-financed by the European Union under the European Funds for Eastern Poland 2021–2027 programme, Priority FEPW.01 Entrepreneurship and Innovation, Measure FEPW.01.01 Start-Up Platforms for New Ideas, Component I Incubation – development of a new business idea.

ElevenLabs Grants

Zora Labs is supported by the ElevenLabs Grants Program.

© 2026 Zora-Labs

This site uses only strictly necessary cookies (session, security, language, payment). We do not use third-party analytics or advertising pixels. Cookie Policy.