Last updated: September 2026
Zeno is a web application. The website and the app are the same application at the same address — which is why there is one privacy policy here rather than two. It covers both what happens when you simply open a public page and what happens once you have an account and are studying with Zeno.
1. Controller
The controller for the processing of personal data within the meaning of the General Data Protection Regulation (GDPR) is:
Systeme Digital GmbH
Wandlhamerstraße 34a
82166 Gräfelfing
Germany
Represented by the managing directors Jakob Thiele and Staffan Schilke
Registered with the commercial register of the Munich Local Court under HRB 291589
Phone: +49 89 416137404
E-mail: team@zenostudy.app
This is also the address to write to about anything to do with data protection and to exercise your rights.
We have not appointed a data protection officer, because the statutory conditions requiring one do not currently apply to us.
2. In short
So that you do not have to read the whole policy to know the essentials:
- Zeno sets no analytics or advertising cookies and embeds no advertising pixels from Meta, TikTok or Google. That is why there is no consent banner here.
- Your study material is yours. We do not mine it to build profiles about you, and we do not sell it.
- What you type into the AI features is transmitted to the providers that power them. Section 6 names them.
- You can delete your account and everything attached to it yourself, at any time.
- You can object at any time to the processing we base on legitimate interests — above all the usage measurement (sections 9 and 14).
3. Visiting our pages, and hosting
Our application is operated on infrastructure provided by Vercel Inc., 440 N Barranca Ave #4133, Covina, CA 91723, USA, and its European group companies. When a page is requested, Vercel processes, as our processor, the connection data technically required to serve it: IP address, date and time of the request, the address requested, the volume of data transferred, the referrer, browser type and operating system.
This data is necessary to deliver the page at all and to fend off attacks. The legal basis is our legitimate interest in a secure and functioning service (Art. 6(1)(f) GDPR). We do not ourselves build persistent logs from this connection data.
Vercel also processes data in the United States. On the basis for that transfer, see section 11.
We store information on your device only where it is strictly necessary to provide the service you have explicitly requested — essentially the session information that keeps you signed in and local settings such as your choice of language. This is covered by § 25(2) no. 2 TDDDG and requires no consent.
4. Account and sign-in
Using Zeno requires an account. Accounts and sign-in are handled through Supabase, Inc., 970 Toa Payoh North #07-04, Singapore, with servers operated in the European Union.
What is processed
- Your e-mail address.
- The time you registered, last signed in, and confirmed your address.
- Technical identifiers for your account.
- Optionally, whatever you choose to put in your profile.
How you sign in
By default we sign you in without a password: you receive a single-use link or code by e-mail. Alternatively you can sign in with your Google or Apple account. If you do, we receive from Google or Apple the details needed to identify you, in particular an identifier and your e-mail address; with Apple this may be a relay address Apple generates. What Google and Apple themselves process in the course of that is governed by their own privacy notices.
The legal basis is performance of the contract (Art. 6(1)(b) GDPR).
5. Your content in Zeno
Everything you create in Zeno is stored in our database at Supabase so that it is still there next time. That includes:
- Notes, summaries, study sheets and flashcards, together with your progress.
- Quiz and test results.
- Folders and the files you add to them — PDF, JPEG, PNG, WebP and plain text files are accepted.
- Your chat history with Zeno.
Please do not upload files containing particularly sensitive data about you or anyone else, such as health or identity-document data. Zeno is a study application and is not designed for it.
The legal basis is performance of the contract (Art. 6(1)(b) GDPR). Access to this data is technically restricted to your own account.
6. The AI features
Zeno's core features — chat, explanations, summaries, flashcards, quiz questions, rewriting, and the transcription of voice recordings — work by transmitting your input to specialised providers and having it processed there. Without that transmission the feature would not exist.
What is transmitted is what you put in: your text or question, the content of the documents and images you supply for that request, your voice recording where applicable, and as much of the current conversation as the answer requires.
We use the following providers:
- Google Ireland Limited / Google LLC (Gemini API) — for chat, summaries, study material, and the transcription of voice recordings.
- OpenAI, L.L.C., San Francisco, USA — for rewriting and revising text.
- HumanizeAI — for rewriting English-language text and estimating how machine-generated a text reads. German-language text is not transmitted to this provider.
Which of these is called in a given case depends on the feature you use and the language you write in.
On training: we use these services through their paid programming interfaces and in the operating modes those interfaces provide. For those modes, the providers undertake not to use input to train their general models. We do not release your input for training. Beyond the providers' own undertakings we cannot give you a guarantee, because that part of the processing lies outside our control. Providers typically retain input for a limited period for abuse monitoring.
The legal basis is performance of the contract (Art. 6(1)(b) GDPR): the AI processing is precisely the service you use Zeno for.
Please note: AI-generated answers can be factually wrong. Check anything that matters.
7. Microphone and voice recordings
When you use the recording feature, Zeno accesses your microphone after you have explicitly granted permission in your browser. The recording is transmitted to the transcription service named in section 6 to be turned into text. Zeno does not listen unless you start a recording yourself.
8. Subscriptions and payment
Paid subscriptions are concluded directly with us. Payments are handled by Stripe Payments Europe, Ltd., 1 Grand Canal Street Lower, Dublin 2, Ireland, together with its group companies.
- To pay, you leave our site and enter your payment details directly with Stripe. We never see your full card details.
- We transmit your e-mail address and an identifier for your account to Stripe so that the payment can be matched to the right account.
- Stripe returns to us whether a subscription exists, which one, since when and until when.
- To manage the entitlements arising from your subscription we use RevenueCat, Inc., San Francisco, USA. An identifier for your account and your subscription status are transmitted there — no payment data.
The legal basis is performance of the subscription contract (Art. 6(1)(b) GDPR), and for the statutory retention of invoicing records additionally Art. 6(1)(c) GDPR.
9. Usage measurement without cookies
To understand which pages are used and where people get stuck, we measure the use of our application ourselves. The measurement runs entirely on our own infrastructure; no external analytics provider is involved.
How it works: when a page is opened, your browser generates a random identifier that exists only in that tab's memory. It is not written to a cookie, to local storage, or anywhere else on your device. Close the tab and it is gone; on your next visit you are a new visit as far as the measurement is concerned. This is exactly why no consent under § 25 TDDDG is required: nothing is stored on your device and nothing is read from it beyond what is transmitted to deliver the page anyway.
What is recorded:
- Pages opened, time spent, scroll depth and the number of clicks on a page.
- The information in the address about where a visit came from (campaign parameters such as utm_source and click identifiers such as fbclid, ttclid and gclid), and the referring page.
- Technical context: window size, device category, browser, operating system and the language set in your browser.
- An approximate location at country, region and city level, which we receive from our host. Your IP address is not stored.
- Whether and where usability problems occurred, for example repeated clicking on an element that does not respond.
- If you create an account, we record once which campaign the first visit came from, so that we can judge how our advertising performs.
The legal basis is our legitimate interest in a comprehensible, working application and in assessing our advertising (Art. 6(1)(f) GDPR).
How to switch it off: we honour the Global Privacy Control signal. If your browser sends it, no measurement takes place. Many browsers and privacy extensions offer a setting for this. Independently of that, you can object to the measurement at any time, informally, at team@zenostudy.app (Art. 21(1) GDPR).
10. Embedded videos
On our public pages we embed videos using YouTube's privacy-enhanced mode (youtube-nocookie.com, operated by Google). The video loads only after you have clicked it. Before that, no connection to Google is made. Once you start a video, Google receives your IP address and technical details about your device; in privacy-enhanced mode YouTube sets no recognition cookies unless you play the video.
The legal basis for loading it after your click is the consent given in that click (Art. 6(1)(a) GDPR, § 25(1) TDDDG).
11. Recipients and transfers to third countries
Apart from the service providers named in this policy, we do not pass your data on. Exceptions are cases in which we are legally obliged to, and tax advice and the pursuit of legal claims within the limits the law allows.
Where service providers act for us, they do so under data processing agreements pursuant to Art. 28 GDPR, which bind them to our instructions and to the standard of protection required by the GDPR. We conclude such agreements with every processor we engage.
Some of the providers named process data in the United States. The transfer is based either on the provider's certification under the EU-US Data Privacy Framework, for which the European Commission has found an adequate level of protection, or on the European Commission's standard contractual clauses pursuant to Art. 46(2)(c) GDPR. Despite these safeguards, access by US authorities cannot be ruled out, and against such access you may not have the legal remedies you would have in the EU.
12. Retention
- Account and study data are kept for as long as your account exists. Delete your account and they are deleted.
- Billing records are retained for six or ten years under commercial and tax law, including after an account is deleted.
- Usage measurement data is kept in the form described above, which cannot be traced back to a person, for no longer than 24 months.
- Where processing is no longer necessary and no retention obligation applies, we delete the data.
13. Minors
Zeno is aimed at learners. The same rules apply to children and young people as to everyone else, with two particularities:
- Processing under the user contract is based on Art. 6(1)(b) GDPR, not on consent. The special consent rules in Art. 8 GDPR therefore do not apply here.
- Under German law, a minor needs the agreement of their parent or guardian to enter into a paid subscription. Our terms and conditions set out the detail.
If we learn that an account was created, or a paid subscription entered into, without the agreement required, we reverse it and delete the data.
14. Your rights
You have the following rights in relation to us:
- Access to whether and what data we process about you (Art. 15 GDPR).
- Rectification of inaccurate data (Art. 16 GDPR).
- Erasure (Art. 17 GDPR). You can delete your account and its data yourself at any time in the settings.
- Restriction of processing (Art. 18 GDPR).
- Data portability (Art. 20 GDPR).
- Withdrawal of consent with effect for the future, wherever we have obtained consent (Art. 7(3) GDPR).
- Objection to processing we base on Art. 6(1)(f) GDPR — in particular the usage measurement described in section 9 (Art. 21(1) GDPR). An objection needs no particular form.
Write to team@zenostudy.app. Exercising these rights is free of charge.
Right to lodge a complaint
You may also complain to a data protection supervisory authority. The authority responsible for us is the Bayerisches Landesamt für Datenschutzaufsicht, Promenade 18, 91522 Ansbach, Germany.
15. Security
The connection between your device and our application is encrypted end to end with TLS, as are the connections to the service providers we use. Access to account and study data is secured at database level so that each account can reach only its own data.
16. Changes to this policy
We update this policy when the application or the law changes. The version published on this page is the one that applies. Where a change is material, we will also tell you in the application or by e-mail.