Privacy Policy

Who we are

ZIK AI is operated by N.G.C.A. Technology Enterprises LTD ("ZIK AI", "we", "us", "our"), a company registered in Cyprus with its registered office at 1 Aprilou 8, Aristo Centre, Block B, Floor B, Office 204, 8100 Paphos, Cyprus.

For the purposes of the EU General Data Protection Regulation (GDPR) and the UK GDPR, we are the data controller for the personal data described in this policy. You can reach us about anything in this document at support@zikagent.ai.

What this policy covers

This policy explains how we handle personal data across two distinct things: this website at www.zikagent.ai, and the ZIK AI desktop application you install on your own computer. They work very differently, and the distinction matters for your privacy.

It does not cover the third-party services you choose to connect to ZIK AI — your Shopify store, eBay account, advertising platforms, or an AI model provider such as Anthropic or OpenRouter. Those services process your data under their own privacy policies.

Local-first: what never leaves your computer

ZIK AI is a desktop application, and it is built to keep your working data on your own machine rather than on our servers. The following are stored locally, in your operating system user profile:

• Credentials and access tokens for the platforms you connect, such as Shopify, eBay, WooCommerce, Google Ads and Meta Ads
• Conversations between you and your agents
• Agent memory, operating instructions and business context
• Workspace files, saved product lists, drafts and generated reports
• API keys for any third-party AI model provider you connect

We do not upload, copy or back up these items, and we cannot read them. One practical consequence is worth understanding: if you lose your computer or delete your local ZIK AI data, we cannot restore it for you.

What we do collect

Account information

When you create an account we collect your name, email address and a securely hashed password. If you register on behalf of a business we may also collect the company name and country.

Billing information

Subscription payments are handled by our payment processor. We do not receive or store your full card number. We retain your plan, billing country, subscription status, invoice history and the VAT information required for tax compliance.

Service usage

To operate credit-based billing and keep the service running we record the number of agent credits consumed, the timing and volume of requests, the plan limits that applied, and technical diagnostic information such as application version, operating system version and error reports.

Prompts sent to built-in ZIK AI models

If you use the built-in ZIK AI models, the prompts and context your agents send are transmitted to us and on to the model providers we use, so a response can be generated and returned to you. This is unavoidable — a hosted model cannot run without receiving the request. If you would rather this data never reach us, connect your own Claude or OpenRouter account instead, in which case requests go directly from your machine to that provider.

Support and marketing

If you contact support we keep the correspondence and anything you choose to include in it. If you subscribe to our newsletter we store your email address until you unsubscribe.

Website data

This website does not set advertising or analytics cookies. Our hosting provider processes standard server request logs, including IP address and user agent, for security and abuse prevention. If we later add analytics we will update this policy and, where the law requires it, ask for your consent first.

Why we are allowed to process it

Under the GDPR we rely on the following legal bases:

• Performance of a contract — to create and maintain your account, provide the service you subscribed to, meter credits and take payment.
• Legitimate interests — to secure the service, prevent abuse and fraud, diagnose faults, and improve the product. We balance these against your rights and do not use them to justify intrusive processing.
• Consent — for the newsletter, and for any optional analytics we may introduce. You may withdraw consent at any time.
• Legal obligation — to retain invoices and tax records for the periods Cypriot and EU law require.

Who we share data with

We do not sell your personal data, and we do not share it for third-party advertising. We use a small number of processors, each bound by contract to act only on our instructions:

• Cloud hosting and infrastructure providers
• Our payment processor, for subscriptions, invoices and tax
• AI model providers, where you use the built-in ZIK AI models
• Email delivery providers, for transactional email and the newsletter
• Error and performance monitoring providers

We may also disclose data where we are legally required to, or to establish, exercise or defend legal claims. If the business is ever sold or reorganised, data may transfer to the acquirer, who would remain bound by this policy until they give you notice of any change.

International transfers

Some of our providers are located outside the European Economic Area, including in the United States. Where that is the case we rely on the European Commission’s Standard Contractual Clauses, an adequacy decision, or another lawful transfer mechanism, together with additional safeguards where appropriate. You can ask us for details of the mechanism used for any specific transfer.

How long we keep it

• Account data — for as long as your account is open, then up to 12 months after closure so you can reactivate.
• Invoices and tax records — for the period required by Cypriot law, currently seven years.
• Service usage and credit records — up to 24 months.
• Prompts sent to built-in ZIK AI models — retained only as long as needed to generate and deliver the response, plus a short window for abuse detection.
• Support correspondence — up to 24 months after the conversation ends.
• Newsletter subscriptions — until you unsubscribe.

Your rights

If you are in the EEA or the UK, you have the right to access your personal data, to have inaccurate data corrected, to have data erased, to restrict or object to processing, to receive your data in a portable format, and to withdraw consent where processing is based on it.

To exercise any of these, email support@zikagent.ai. We will respond within one month, and will tell you if we need longer because the request is complex. We may need to verify your identity first.

If you think we have handled your data badly, please tell us so we can put it right. You also have the right to complain to a supervisory authority — in our case the Office of the Commissioner for Personal Data Protection of Cyprus, or the authority where you live or work.

Security

We use encryption in transit, encryption at rest for data held on our systems, access controls limiting staff access to what their role requires, and regular review of our providers. The local-first design of the application is itself a security measure: the data most valuable to an attacker — your store credentials — is never held centrally by us.

No system is perfectly secure. Because your workspace data sits on your own machine, keeping that machine secure, patched and protected by a strong account password is an important part of protecting it.

Children

ZIK AI is a business tool and is not directed at children. We do not knowingly collect personal data from anyone under 16. If you believe a child has given us personal data, contact us and we will delete it.

Changes to this policy

We may update this policy as the product changes or the law does. We will change the effective date at the top, and for material changes we will notify you by email or in the application before they take effect.

Contact us

For any privacy question or to exercise your rights, email support@zikagent.ai, or write to N.G.C.A. Technology Enterprises LTD, 1 Aprilou 8, Aristo Centre, Block B, Floor B, Office 204, 8100 Paphos, Cyprus.