← ZyloScore

Privacy Policy

Last updated: September 2026

This Privacy Policy explains how ZyloScore("we", "us", or "our") collects, uses, protects, and handles your personal data when you use the world's first presencemaxxing platform. We built ZyloScore on a foundational privacy principle: we only process what is strictly necessary to evaluate and improve your presence, we never sell your data, and we never store your biometric photos or voice recordings without explicit, revocable consent.

Our global compliance framework adheres to the Digital Personal Data Protection Act, 2023 (India DPDP Act), the General Data Protection Regulation (EU GDPR & UK GDPR), and the California Consumer Privacy Act as amended by the CPRA (US CCPA/CPRA).

1. Scope of the Service & What We Collect

ZyloScore is an AI-powered presencemaxxing system measuring three core pillars: Facial Aesthetics, Vocal Resonance, and Social Calibration. Depending on how you interact with the platform, we collect the following categories of information:

Account & Demographic Data

  • Authentication Data: Your email address, authentication method (Google OAuth or email/password), and timestamp of account creation.
  • Profile Information: Name/alias, date of birth, biological gender (used solely for norm-calibrated vocal frequency and aesthetic symmetry reference ranges), and improvement goals.
  • Geographic Region & IP Telemetry: Country and timezone detected via IP during account creation and onboarding. This is used exclusively to: (a) apply localized privacy protections (e.g. DPDP Act, GDPR, or CCPA rights), (b) deliver regionally compliant currency and pricing via Paddle, and (c) recommend skincare and grooming products available in your local market. We do not use your IP address for behavioral profiling or third-party ad tracking.

Multimodal Biometric & Analysis Data

  • Facial Aesthetics Photos:
    • Free, Starter & Guest Scans: Uploaded front and side profile photos are resized client-side, transmitted over encrypted TLS to our vision analysis pipeline, and permanently discarded immediately after your biometric scores are computed. Original images are never stored on our servers.
    • Pro & Elite Plan Longitudinal Tracking: With your explicit, affirmative opt-in consent, periodic progress photos are securely encrypted and stored in Cloudinary solely to generate week-over-week visual comparison sliders. You may revoke this consent and delete all stored photos with a single click in Settings.
    • Onboarding & Guest Face Scans: Scored numeric results (with no photos) are stored ephemerally for 3 days before automated permanent deletion unless claimed by a registered account.
  • Vocal Resonance Recordings:
    • Your 30-second audio reading sample is transmitted to our isolated, self-hosted acoustic analysis service (running open-source Librosa).
    • Raw audio files are never saved to disk or retained after analysis. Only the computed acoustic parameters (fundamental frequency pitch in Hz, pitch variability, harmonics-to-noise ratio, jitter, shimmer, words-per-minute speaking rate, and verbal fluency / filler pauses) are saved to your profile.
    • During onboarding speech calibration, audio is streamed to Deepgram (Nova-3) for real-time word highlighting. Deepgram operates under ephemeral processing terms; audio is not retained.
  • Social Calibration (Presence Practice) Data: Text and simulated speech turns during interactive communication roleplay with adaptive AI personas (Senior Colleague, Close Friend, New Acquaintance, Romantic Partner). We store the session transcript, rubric scoring (Warmth, Confidence, Situational Composure, Articulation), and the concise session summary in your private Firestore profile to allow Coach Zylo to track your conversational evolution.These transcripts are never used to train external public foundation models.
  • Composite Presence Index: Your scientific 0–100 score weighted across Appearance (40%), Vocal Resonance (30%), and Social Calibration (30%), alongside historical delta values and velocity indicators.

Billing & Transaction Data

  • All payment processing is handled by Paddle.com Market Ltd as Merchant of Record. We never see, collect, or store your debit/credit card numbers or UPI PINs. We store only your Paddle Customer ID, Subscription ID, plan status, and purchased Zylo Credit balances to provision access.

2. Purpose & Legal Basis for Processing

We process your personal data strictly for lawful, defined purposes:

  • Service Provision (Contract Performance): To compute biometric aesthetic scores, analyze vocal acoustic resonance, simulate interactive social scenarios, and render your 30-day presencemaxxing roadmap.
  • Explicit Consent (Biometric & Sensitive Processing): We process facial biometric observations and vocal acoustic frequencies solely upon your explicit instruction and affirmative action (uploading photos, granting microphone permissions, or toggling image comparison storage).
  • AI Coach Personalization: To provide Coach Zylo with rolling memory of your past goals, habit compliance, and communication milestones.
  • Platform Security & Fraud Prevention: To enforce server-side quota caps, rate limits, and defend against automated denial-of-service or scraping attacks.

We do not sell, rent, lease, or monetize your personal information or biometric data to third parties, advertising networks, or data brokers.

3. Third-Party Subprocessors

We partner with a limited set of vetted infrastructure subprocessors bound by strict data processing agreements:

  • Google Firebase (Google Cloud): Encrypted database (Cloud Firestore) and user authentication (Firebase Auth). Data resides in secure ISO 27001 / SOC 2 certified data centers.
  • Google Gemini API: Processes uploaded facial images and social roleplay prompts via enterprise stateless endpoints. Google does not use customer API inputs to train Gemini models.
  • Self-Hosted Acoustic Worker: Private container running Librosa algorithms for vocal feature extraction. Audio is processed in memory and discarded immediately.
  • Deepgram: Ephemeral speech-to-text streaming for live reading compliance during voice scans.
  • Cloudinary: Encrypted cloud storage for Pro/Elite subscribers who explicitly opt into visual progress tracking.
  • Paddle.com: Payment gateway, international tax compliance, and subscription life-cycle management.
  • Vercel Inc.: Application edge hosting and serverless compute infrastructure.

4. Regional Privacy Rights & Regulatory Addenda

Depending on your location, you hold statutory rights regarding your personal and biometric data. Our platform recognizes and honors rights across major jurisdictions:

A. India — Digital Personal Data Protection Act, 2023 (DPDP Act)

For users residing in India, ZyloScore acts as a Data Fiduciary. In accordance with the DPDP Act 2023:

  • Notice and Consent (Section 6): Processing is based on your itemized, informed consent. You may withdraw consent at any time from your account Settings.
  • Right to Access & Summary (Section 11): You may request a readable summary of all personal data, scores, and identity of third-party subprocessors.
  • Right to Correction and Erasure (Section 12): You may update outdated goals or request complete erasure of your profile and scan records.
  • Right of Grievance Redressal (Section 13): You have direct access to our Grievance Officer with guaranteed acknowledgment within 48 hours and final resolution within 30 days.
  • Right to Nominate (Section 14): You may nominate any individual to exercise your privacy rights in the event of your death or incapacity. To register a nominee, email us at support@zyloscore.app.
  • Breach Notification (Section 8(6)): In the unlikely event of a security breach affecting your data, we will notify you and the Data Protection Board of India without undue delay within 72 hours.
  • Protection of Minors:Users under 18 years of age may only participate with verifiable parental or legal guardian consent. We do not track children's behavior or serve targeted material.

B. European Union & United Kingdom — GDPR & UK GDPR

For data subjects located in the EEA and UK, ZyloScore complies with all statutory obligations:

  • Biometric Special Category Data (Article 9): Facial geometry scores are processed only under explicit Article 9(2)(a) consent, freely revocable at any time.
  • Data Subject Rights (Articles 15–22): You retain the Right of Access (Art. 15), Rectification (Art. 16), Erasure / Right to be Forgotten (Art. 17), Restriction of Processing (Art. 18), Data Portability (Art. 20), and Objection (Art. 21).
  • Supervisory Authority: You hold the right to lodge a complaint directly with your national Data Protection Authority (e.g. the ICO in the UK or relevant EU Member State DPA).

C. United States — California Consumer Privacy Act (CCPA / CPRA)

  • No Sale or Sharing: We do not sell your personal information or share it for cross-context behavioral advertising.
  • Right to Limit Sensitive Data: You have the right to limit the use of Sensitive Personal Information (biometric identifiers) strictly to the provision of the requested score and coaching.
  • Non-Discrimination: We will never deny service, charge different prices, or degrade quality if you choose to exercise any CCPA privacy right.

5. Data Retention & Permanent Deletion

We enforce automated lifecycle expiration policies:

  • Face Photos (Free/Starter): Discarded immediately after analysis execution (0-second persistence).
  • Voice Recordings: Discarded immediately after parameter extraction (0-second persistence).
  • Comparison Photos (Pro/Elite): Stored only until you revoke consent in Settings or delete your account.
  • Numeric Scores, Progress Metrics & Chat History: Retained for the lifetime of your active profile.
  • Account Deletion:Clicking "Delete Account" in Settings permanently wipes your user profile, scan metrics, chat summaries, and any stored Cloudinary photos within 60 seconds from our primary database.

6. Security Infrastructure

All data in transit is protected using TLS 1.3 encryption. Data at rest is encrypted using AES-256 within Google Cloud Firestore. Access to user documents is restricted by strict database rules requiring verified Firebase Auth JWT tokens. Server routes enforce memory-safe rate limiting, timing-safe cryptographic comparisons, and HMAC webhook authentication.

7. Grievance Officer & Privacy Contact

For privacy inquiries, data access requests, nominee registration under the DPDP Act, or to exercise your statutory rights:

Designation: Data Protection & Grievance Officer

Organization: ZyloScore Privacy Operations

Email: support@zyloscore.app

Response Timelines: Grievance acknowledgment within 48 hours; substantive resolution within 30 days (maximum statutory window not exceeding 90 days).