Privacy Policy

This Privacy Policy (“Policy”) applies to the processing of your personal data by ZEN AI PTE. LTD. (“ZEN AI”, “we” or “us”) in accordance with applicable laws when you use our services subject to the Terms of Service (“Services”).

1. Data Controller and Data Protection Officer

The Data Controller is ZEN AI PTE. LTD., 91 Bencoolen Street #12-03, Sunshine Plaza, Singapore 189652 (Registration No.: 202621526G). Our Data Protection Officer can be contacted for any requests relating to the processing of your personal data or this Policy by contacting us at support@cocoai.com.

2. Personal Data We Process

During our Services, we may collect, use, store and transfer (collectively, “process”) different types of personal data, including:

2.1 Personal data you provide us

  • Account Information: including username, date of birth, and contact information (such as email address).
  • Billing and Purchase Data: including bank account, billing address, purchase history.
  • User Content: including files, images, photos, videos and other documents you input during the use of Services.
  • Communication Information: including your name, contact information, and the contents of the messages you send.

2.2 Personal data we receive from your use of Services

  • Log Data: including your IP address, browser type and settings, the date and time of your request, and how you interact with our Services.
  • Usage Data and Preference: including your choices regarding cookies and similar technologies, languages and other expressed preferences.
  • Device Information: including the name of the device, operating system, device identifiers, and browser you are using.

2.3 Personal data we collect from third parties

  • Payment Information: We collect payment information from third party when you choose to use a third-party payment processing service.

3. Purposes and Legal Bases

We use personal data only for the purposes for which the information was collected. In principle, we generally refrain from using your personal data for public disclosure, commercial promotion or AI model training purposes. Below, we describe our purposes and legal bases for processing personal information.

PurposeLegal BasisCategories of Processed Data
To create an account Your consent
Our legitimate interests to operate and secure your account
Performance of our contract with you		 Account Information
Log Data
Device Information
To provide, process, maintain, improve and develop our Services Your consent
Performance of our contract with you
Our legitimate interests to
(1) operate, troubleshoot, and improve the Services and our business;
(2) Understand our users and how they interact with Services;
(3) Perform internal analytics concerning the Services;
(4) Comply with legal requirements or defend our legal rights;
(5) Fulfillment of our legal obligations related to providing the Services		 Account Information
Log Data
Device Information
Usage Data and Preference
User Content
To proceed your purchase and subscription Your consent
Our legitimate interests to facilitate payments and prevent fraud
Performance of our contract with you		 Account Information
Billing and Purchase Data
Communication Information
Log Data
Payment information
To carry out marketing activities and send you information about our Services, and provide service-related operational communications (such as payment reminders and account notifications) Your consent
Our legitimate interests to improve and promote our Services and manage our relationships with you		 Account Information
Communication Information
Usage Data and Preference
Log Data
To handle your inquiries and requests you submitted to us Performance of our contract with you Account Information
Billing and Purchase Data
Communication Information
User Content
Log Data
Usage data and preference
Device Information
Payment information
To fulfil our legal obligations, to establish, exercise or defend our rights and those of our employees, and to carry out corporate transactions or operations Compliance with a legal obligation to which we are subject
Our legitimate interests to comply with legal requirements or defend our legal rights		 Any information necessary to ensure the performance of these purposes.

4. Data Retention

Personal data may be stored at our premises and on our service providers’ servers. We adopt technical and organizational measures designed to prevent the loss, improper use and alteration of your personal data. However, transmissions over the Internet are never 100% secure, and you should not provide any personal data if you want to avoid any risk.

Personal data processed will be kept for a period not exceeding the one necessary for the said purposes, unless other provided by applicable laws.

5. Sharing Your Personal Data

We may share or disclose your personal data to the following categories of recipients:

  • External service providers who act as written appointed outsourced data processors or independent data controllers to assist our daily business and operational arrangements in compliance with privacy laws.
  • In the event of corporate restructuring, merger, acquisition, asset sale, insolvency or other corporate dealings as well as relevant due diligence procedures, your personal information may be shared with internal and external professional consultants and potential transaction parties, and may be transferred as part of business assets.
  • Public, judicial or police authorities, within the limits set by applicable laws.

6. Cross-border Transfers of Personal Data

Our service providers and partners are located in various countries around the world. Your personal information may be transferred to, and processed in, these countries, which may be different from the territory in which you reside. These countries may have data protection laws that are different from those of your jurisdiction.

7. Your Rights

At any time and free of charge, you can exercise the following rights, as specified and subject to certain limitations and exceptions under Applicable Privacy Laws.

Your privacy rights are namely:

  • Right of access. You have the right to obtain information about the processing of your personal data and to access it.
  • Right to rectification. You have the right to ask for the updating, rectification or integration of your personal data.
  • Right to erasure. You have the right to request the deletion of your personal data.
  • Right to restriction of processing. You have the right to request the restriction of the processing of your personal data.
  • Right to data portability. You have the right to obtain a portable electronic copy of your personal data.
  • Right to object. You have the right to object to such processing in accordance of applicable laws, wholly or partly, on grounds related to your particular situation.
  • Right to withdraw your consent. Where we rely on your consent to process your personal data, you have the right to withdraw your consent, although the processing carried out before your withdrawal of consent will remain valid.

You also have the right to lodge a complaint before the competent national Data Protection Authority where applicable.

To exercise your rights, please contact us at: support@cocoai.com. We may take reasonable steps to verify your identity prior to responding to your request.

8. Minor’s Personal Data

We do not knowingly collect personal data from children. If you believe we have received personal data from children under the age of 16 or other age stipulated by applicable laws, please contact us at support@cocoai.com.

9. Third-Party Websites and Services

The Service may contain links to third-party websites or services. These are provided solely for your convenience. We do not control, operate, or endorse these third parties and are not responsible for their content, actions, or privacy practices. Your use of any third-party site or service is at your own risk, and we encourage you to review their respective privacy policies and terms of use. This Policy does not apply to data processed by these external services.

10. Changes

We reserve the right to revise, consolidate or update this Policy in full or in part in compliance with applicable laws. We will inform users of relevant adjustments by updating the revision date stated herein, and may additionally send reminders via in-site pop-ups, system pushes or emails where necessary.

11. Regional Provisions

If you reside in the regions specified below, relevant local provisions shall prevail in case of any inconsistency with the aforesaid terms.

California

Sale or sharing of personal data: We do not “sell” or “share” personal information (as those terms are defined under the CCPA).

Generative Artificial Intelligence Training Data Transparency: To develop and improve some of our generative AI features, we may use datasets that include: publicly available data and licensed third-party data. We do not use your User-Generated Content for AI training purposes.

Brazil

Exercise of data protection rights: We will process and respond to your rights claims in line with prevailing laws including the Brazilian General Data Protection Law where applicable. We may lawfully decline certain requests on legitimate grounds. We may withhold relevant information if disclosure would harm our business interests or infringe our trade secrets and intellectual property rights. We may also refuse data deletion requests if retaining such data is necessary to satisfy legal obligations or safeguard our legitimate interests in potential disputes. We will duly inform you of specific reasons should we fail to meet your submitted requests.

South Korea

Data Retention: Subject to applicable laws, rules and regulations and the fulfillment of our business or legal purposes, we will delete your data (including your personal data) promptly upon your termination of your account with us. We will destroy your personal data according to the following procedures and methods.

  • Procedures for Destruction: We select personal information subject to destruction and destroy them with approval of our data protection officer.
  • Method of Destruction: We will destroy personal data stored and filed electronically in a way that can be deleted by using a means that renders the record irrecoverable as far as possible.

Argentina

Your rights and options: Pursuant to Law No. 25326, Regulatory Decree No. 1558/2001 and binding rulings issued by the Access to Public Information Agency (AAIP), you are entitled to personal data rights including access, correction and erasure. Should you be dissatisfied with our response to your rights applications, you may reach out to us. You also reserve the right to file complaints directly with AAIP via its official website: https://www.argentina.gob.ar/aaip/datospersonales/derechos

Mexico

Consent: By providing us with your personal data and using our Services, you agree to transfers that require your consent. You can always revoke your consent and exercise your rights.

Exercise of rights: If you are under 18 years of age, you may exercise your rights through a parent or guardian. Requests to exercise for your rights will be resolved as soon as possible according to the applicable data protection law and the nature of your request.

Last updated: September 9th, 2026