Privacy Policy
Last updated 12 October 2026
Who we are
Zymblo is run by [TODO: legal name of the controller], of [TODO: postal address]. We decide how and why your personal data is used, which makes us its controller under UK data protection law (the UK GDPR and the Data Protection Act 2018).
For anything about your data, email [TODO: privacy contact email].
What we collect
- Your account. When you sign in with Google, we get your name, email address and profile picture from Google, and keep the sign-in tokens Google issues so your account stays linked.
- Your logos and brand kits. The logo file you upload and what Zymblo builds from it: the parts it finds, your colours, typeface and settings, and the kits you generate. If you're not signed in, your work is kept in your own browser, not on our servers. When you save a kit to your account, it's stored in our database.
- Payments. If you subscribe to Pro, Stripe handles your card details. We never see or store them. We keep your Stripe customer reference, your plan, its status and when it renews.
- Sign-in sessions. For each signed-in session we store the IP address and browser details it was opened from, so sessions can be kept secure.
- Abuse protection. To stop automated misuse, we briefly keep a count of requests against your account, or your IP address if you're not signed in. These counts expire on their own.
- Analytics, only if you allow it. With your permission, Google Analytics records how you arrived and which pages you visit, along with your device, browser and approximate location.
How we use it, and why we're allowed to
Signing you in and running your account
- Lawful basis
- Contract: we need it to provide the service you signed up for.
Analysing your logo and building your kit
- Lawful basis
- Contract: it's the service you asked for.
Taking payment and managing your subscription
- Lawful basis
- Contract, and legal obligation for the tax records we must keep.
Keeping sessions secure and stopping abuse
- Lawful basis
- Legitimate interests: protecting you, other users and the service.
Understanding how people use Zymblo (analytics)
- Lawful basis
- Consent: only after you accept analytics cookies. You can change your mind at any time.
| Use | Lawful basis |
|---|---|
| Signing you in and running your account | Contract: we need it to provide the service you signed up for. |
| Analysing your logo and building your kit | Contract: it's the service you asked for. |
| Taking payment and managing your subscription | Contract, and legal obligation for the tax records we must keep. |
| Keeping sessions secure and stopping abuse | Legitimate interests: protecting you, other users and the service. |
| Understanding how people use Zymblo (analytics) | Consent: only after you accept analytics cookies. You can change your mind at any time. |
We don't sell your data, and we don't use it for advertising.
How your logo is analysed
When you upload a logo, an image of it is sent to an AI vision service that finds its parts, such as the icon, the name and the tagline. We use Anthropic today, and may switch to OpenAI or Google. Adobe Illustrator (AI) files, and EPS exports, also pass through a file conversion service we run. In each case the file is processed to return a result to us. We don't ask any of them to keep it.
Who we share it with
We use these providers to run Zymblo. They process data on our behalf, under contracts that limit what they can do with it.
Vercel
- What for
- Hosting the website and app
- Data
- All requests, including IP addresses
Supabase
- What for
- Our database
- Data
- Account, sessions, saved kits, plan
Google
- What for
- Sign-in, and analytics if you allow it
- Data
- Name, email, profile picture; usage data
Stripe
- What for
- Payments and billing
- Data
- Payment details, billing email, plan
Anthropic (or OpenAI or Google)
- What for
- Analysing your logo
- Data
- An image of your logo
| Provider | What for | Data |
|---|---|---|
| Vercel | Hosting the website and app | All requests, including IP addresses |
| Supabase | Our database | Account, sessions, saved kits, plan |
| Sign-in, and analytics if you allow it | Name, email, profile picture; usage data | |
| Stripe | Payments and billing | Payment details, billing email, plan |
| Anthropic (or OpenAI or Google) | Analysing your logo | An image of your logo |
We may also disclose data if the law requires it, or to protect our rights or someone's safety.
International transfers
Several of these providers are based in, or process data in, the United States. Where data leaves the UK, we rely on UK adequacy regulations (including the UK–US data bridge) or the International Data Transfer Addendum to the EU Standard Contractual Clauses, so it stays protected.
How long we keep it
- Account and saved kits: until you delete them or ask us to delete your account.
- Sign-in sessions: they expire after 7 days of inactivity.
- Abuse-protection counts: up to a day, then they expire.
- Payment and tax records: six years, as UK tax law requires.
- Analytics: up to 14 months in Google Analytics.
- Work kept in your browser: until you clear it or your browser's storage.
Cookies and browser storage
We only use what Zymblo needs to work, plus analytics if you allow it. You can change your analytics choice at any time with “Cookie settings” at the bottom of this page.
better-auth.session_token
- Purpose
- Keeps you signed in
- Kind
- Essential cookie
- How long
- 7 days
zymblo:cookie-consent
- Purpose
- Remembers your cookie choice
- Kind
- Essential, browser storage
- How long
- Until cleared
theme, zymbol-canvas-prefs, zymblo:product-tour-*
- Purpose
- Remembers light or dark mode, canvas settings and whether you've seen the tour
- Kind
- Essential, browser storage
- How long
- Until cleared
Editor draft
- Purpose
- Keeps your current logo and settings if you're not signed in
- Kind
- Essential, browser storage
- How long
- Until cleared
_ga, _ga_*
- Purpose
- Google Analytics: tells visits apart
- Kind
- Analytics cookie, only with consent
- How long
- Up to 2 years
| Name | Purpose | Kind | How long |
|---|---|---|---|
| better-auth.session_token | Keeps you signed in | Essential cookie | 7 days |
| zymblo:cookie-consent | Remembers your cookie choice | Essential, browser storage | Until cleared |
| theme, zymbol-canvas-prefs, zymblo:product-tour-* | Remembers light or dark mode, canvas settings and whether you've seen the tour | Essential, browser storage | Until cleared |
| Editor draft | Keeps your current logo and settings if you're not signed in | Essential, browser storage | Until cleared |
| _ga, _ga_* | Google Analytics: tells visits apart | Analytics cookie, only with consent | Up to 2 years |
Stripe sets its own cookies on its checkout and billing pages, which are covered by Stripe's privacy policy.
Your rights
You have the right to:
- get a copy of the personal data we hold about you
- have it corrected if it's wrong
- have it deleted, including your whole account
- restrict or object to how we use it
- receive it in a portable format
- withdraw consent for analytics at any time, which doesn't affect anything done before
Email [TODO: privacy contact email]to use any of these. We reply within one month. If you're unhappy with how we handle your data, you can complain to the Information Commissioner's Office at ico.org.uk or on 0303 123 1113.
Security
Data travels over encrypted connections, access to our database is restricted to our servers, and card details never reach us. No system is perfectly secure, but we'll tell you and the ICO promptly if a breach puts your data at risk.
Children
Zymblo isn't meant for children under 13, and we don't knowingly collect their data.
Changes to this policy
If we change how we use your data, we'll update this page and the date at the top. For significant changes, we'll let signed-in users know first. If we add new optional cookies, we'll ask again before using them.