Legal

BRANDUOO OÜ (trading as ZOVRYX), Estonia, is the data controller for personal data processed through the Service.

What we collect and why

• Account data (email, display name, sign-in records) — to create and secure your account (contract).
• Organisation and Studio content — to provide Studio (contract).
• Purchases and access records — to grant passes and plans (contract, legal obligation).
• Enquiries and newsletter sign-ups — to reply and send updates you asked for (consent, legitimate interests).
• AI guide questions and usage counts — to answer and prevent abuse (contract, legitimate interests).
• Hashed IP addresses for rate limiting — security and fraud prevention (legitimate interests).
• Aggregate page analytics, only if you allow analytics cookies (consent).

Who we share with

Hosting, database and AI service providers acting on our instructions; Paddle as Merchant of Record for sales, subscription management, payments, tax and invoicing; professional advisers; and authorities where required by law. Some providers are outside the EEA; we rely on adequacy decisions or Standard Contractual Clauses.

Retention and security

We keep data only as long as needed for these purposes or the law, then delete or anonymise it. We use encryption in transit, access controls and per-organisation separation.

Your rights

Under the GDPR you can access, correct, erase, restrict, port or object to processing of your data, and withdraw consent at any time. You can export or delete your account from your account page. We reply within one month. You may complain to the Estonian Data Protection Inspectorate (Andmekaitse Inspektsioon) or your local authority.

Cookies

Essential cookies only by default. Analytics and marketing are off until you allow them in the cookie policy section.