Privacy Policy

This Privacy Policy explains what information Zylosia collects, how it is used, and the choices you have. It reflects what Zylosia V1 actually does today.

1. Information you give us

When you create an account, we collect:

• Your email address and the authentication information needed to sign you in. Your password is handled by our authentication provider and is never stored in readable form by Zylosia.
• A unique user ID generated for your account.

When you use the hair quiz and your results, we store the answers you provide:

• Hair quiz and hair profile information — texture, strand thickness, density, porosity (including estimated porosity), goals, struggles, wash rhythm, styles worn, protective-style frequency, routine experience, budget, climate, and available time.
• Scalp concerns and ingredient sensitivities or allergies you tell us about. Some of this is health-related information, and you choose whether to share it.
• Free-text information you type, such as the products you currently use and any reaction notes. Please avoid entering information you do not want stored.
• Your 30-Day Plan progress and your reflection responses.

2. Purchase information

Zylosia V1 is a one-time purchase. Payments are processed by Paddle, which acts as the Merchant of Record. Paddle collects and processes your payment details directly — Zylosia never receives or stores your card number or billing address.

We store an entitlement record so we know your access is unlocked: the product purchased, whether the purchase was made in test or live mode, its status, the payment provider's transaction and customer reference, and the relevant dates.

3. Information collected automatically

• Browser and session storage: your in-progress quiz answers, plan progress, reflections, and your sign-in session are stored in your own browser so the experience works smoothly. Paddle may set its own cookies during checkout.
• Technical and server logs: ordinary request logs and record timestamps generated by our hosting and backend infrastructure.

4. What Zylosia does not do

• Zylosia V1 does not send your quiz or hair profile information to an external AI model or AI API. All personalization is generated by Zylosia's own logic.
• Zylosia V1 does not use advertising pixels, behavioral advertising, or third-party marketing trackers.
• Zylosia does not sell your personal information.
• Zylosia does not allow photo or image uploads, so we hold no photos of you.

5. Service providers

• Lovable Cloud (powered by Supabase) provides our account sign-in, database, and hosting infrastructure. Your hair profile and entitlement records are stored there and are restricted so that only your account can read them.
• Paddle processes payments as Merchant of Record and handles billing, tax, and receipts.

6. Where your information is processed

Zylosia relies on third-party providers for hosting, database and authentication, and payment processing. As a result, your personal information may be processed or stored outside Canada, including in the United States or another country, depending on where the provider operates its servers.

Information processed or stored outside Canada may be subject to the laws of that jurisdiction. That means courts, law enforcement, or national security authorities in that country may be able to require the provider to disclose your information, where permitted by local law.

Zylosia takes reasonable steps to use service providers that provide appropriate protection for personal information.

7. How long we keep your information

We keep your account information and hair data for as long as your account exists. When you delete your account, the personal information Zylosia holds about you is removed.

8. Your rights, and deleting your account

You can request access to, correction of, or deletion of your personal information. You can also delete your account yourself at any time: sign in, open your account area, and choose “Delete My Account.” Deletion is permanent and removes your hair profile, quiz answers, scalp and sensitivity answers, progress, reflections, and your Zylosia V1 access.

Zylosia cannot delete records that Paddle or the law requires the payment provider to retain. Transaction and tax records may remain with Paddle.

9. Children

Zylosia is not intended for children under 13, and we do not knowingly collect their information.

10. Changes to this policy

If this policy changes, we will update the date at the top of this page.

11. Contact

For privacy questions or requests, contact us at zylosia@gmail.com.