Privacy Policy

We collect the following information when you use ZNORVA AI:

• Account information — email address and name provided during sign-up
• Usage data — number of analyses performed per day, plan type, timestamps
• Analysis history — assets analyzed, timeframes, results
• Technical identifiers — browser ID and hashed IP address for usage limit enforcement
• Country — the country you connect from, looked up from your IP address when you sign up and when you sign in; we store only the country, not the IP address
• Payment data — processed by third-party payment providers; we do not store card numbers or crypto wallet details

We use collected information to:

• Provide and operate the ZNORVA AI service
• Enforce daily analysis limits per subscription plan
• Process subscription payments and manage billing
• Offer the payment methods available in your country and produce country-level usage statistics
• Display your analysis history in your dashboard
• Send transactional emails (account confirmation, payment receipts)
• Detect and prevent abuse or fraudulent activity
• Improve and maintain the platform

We do not sell your personal information to third parties.

Your data is stored securely using encrypted cloud database infrastructure with row-level security. Account authentication is managed by a trusted third-party authentication provider.

Data is stored on servers located in Germany (Frankfurt). By using the Service, you consent to your data being stored in this location.

ZNORVA AI uses third-party service providers to operate the platform. These include providers for:

• Authentication and user management
• Database and cloud storage
• AI analysis generation — your asset queries are processed to generate analysis
• Market data — price and chart data
• Fiat payment processing
• Cryptocurrency payment processing
• Cloud hosting and infrastructure

The providers we use, and the personal data each one receives:

• Clerk — sign-up, sign-in and account management: your email address, name and sign-in details
• Supabase — database and file storage, in Germany (Frankfurt): your account records, usage, analysis history, orders and Whish receipts
• Hostinger — website hosting and email delivery: your requests to the site (including your IP address) and the emails we send you
• Stripe (card payments; Stripe may act as the seller of record and processes your card details; we never see or store full card numbers)
• NOWPayments — crypto payments: the order reference, plan and amount in USD; you pay on the NOWPayments invoice page
• Whish Money — manual transfers in Lebanon: you pay through Whish; we receive the Whish number you paid from and your receipt image, which we store for review
• Dodo — earlier subscriptions only, no new purchases: payment and subscription events for those subscriptions
• PostHog — site analytics, on servers in the United States (see section 5)
• Meta — advertising measurement (see section 5)
• X Corp. — advertising measurement through X Pixel and, when enabled, X Conversions API (see section 5)
• Reddit — advertising measurement (see section 5)
• Tawk.to — live chat, loaded only when you open it: the messages and details you send in the chat
• OpenAI — AI analysis: the asset, market, timeframe and market data of each request; no name, email address or account ID
• Telegram — internal alerts to our team: the order reference, plan and amount of crypto payments; no name or email address

Each provider operates under their own privacy policy and data processing terms. We only share the minimum data necessary for each service to function.

ZNORVA AI uses minimal cookies for essential functionality:

• Session cookies for authentication
• Browser ID stored in localStorage for usage tracking
• Ambassador referral cookies (znorva_ref and znorva_ref_at): the ambassador code from a referral link and the time of the click, kept for 30 days so a sign-up and first payment within that time can be credited to the ambassador

Analytics and advertising measurement depend on your choice in the privacy banner. In the European Union, the European Economic Area, the United Kingdom and Switzerland, and whenever your country is unknown, they run only after you click Accept; in other countries they run unless you click Decline tracking. You can change your choice at any time with the Privacy button. Your choice is kept in your browser (localStorage and the znorva_meta_consent_v1 cookie) and, when you are signed in, with your account.

• PostHog — site analytics: pages viewed, clicks, approximate location derived from your IP address, campaign parameters, and recordings of a sample of visits with all text and inputs masked; no recordings on checkout, dashboard, history, inbox, sign-in or sign-up pages
• Meta Pixel and Meta Conversions API — advertising measurement of page views, sign-ups, checkouts, trials and purchases, with your IP address, browser user agent, Meta's cookies and, when you are signed in with a verified email address, your email address hashed (SHA-256)
• X Pixel and X Conversions API — advertising measurement for X Corp. through page visits, sign-ups, checkout starts, payment-info steps (not card details) and verified purchases, with conversion IDs and plan/value/currency where applicable. Pixel requests include your IP address and browser user agent. The _twclid cookie stores your X ad click ID for 90 days. We pass your normalized verified signed-in email (or guest checkout email) to the browser pixel, whose SDK hashes it with SHA-256 before transmission. X Conversions API is prepared but awaits X approval; when enabled, our server sends verified purchase events with SHA-256-hashed email and, for Whish where available, hashed phone number, plus the X click ID; its current payload does not include IP address or user agent. Both follow the same regional consent rules above.
• Reddit Pixel and Reddit Conversions API — advertising measurement of page visits (when you are signed out) and sign-ups, with your email address hashed (SHA-256), account ID, IP address, browser user agent, screen size and Reddit click ID
• Campaign attribution — the campaign parameters of the link you arrived from (such as utm_source, fbclid or gclid), the referring page and the landing page, kept in localStorage and saved with your account when you sign in

When a payment through NOWPayments or Dodo is completed, our server also reports the purchase to Reddit (account ID, amount and currency). This report does not depend on your choice in the privacy banner.

We retain your data for as long as your account is active. If you delete your account, your personal data will be removed within 30 days, except where retention is required by law or for fraud prevention purposes.

Analysis history is retained to power your history dashboard. You may request deletion of your history by contacting support.

Depending on your location, you may have the right to:

• Access the personal data we hold about you
• Request correction of inaccurate data
• Request deletion of your data
• Object to processing of your data
• Request a portable copy of your data

To exercise any of these rights, contact us at support@znorva.com.

We implement industry-standard security measures including:

• HTTPS encryption for all data in transit
• Hashed IP addresses — raw IPs are never stored
• Row-level security on the database
• Security headers on all API routes

No system is completely secure. We cannot guarantee the absolute security of your data.

ZNORVA AI is not intended for users under the age of 18. We do not knowingly collect personal information from minors. If you believe a minor has created an account, contact us at support@znorva.com and we will remove the account.

We may update this Privacy Policy from time to time. We will notify users of significant changes by updating the "Last updated" date at the top of this page. Continued use of the Service after changes constitutes acceptance.

For privacy-related questions or requests, contact us at:

support@znorva.com