Privacy Notice

1. Who we are

VZQX is operated by VZQX LLC, established in the State of Kuwait. For the personal data we process to provide the Services to you, we act as the data controller. For privacy questions or to exercise your rights, contact support@vzqx.com.

2. The data we collect

We collect the following categories of personal data:

• Account data - your email address, username, and a securely hashed password (we never store your password in plain text). If you sign in with Google, we receive your basic Google profile and verified email from Google.
• Usage and technical data - information needed to operate and secure the Services, such as sign-in sessions and device/browser descriptors, approximate origin, timestamps, activity logs of actions on your account, and resource-usage metrics for your projects.
• Prompts and responses (only with your consent) - the text you send to the AI and the AI’s responses. This is collected only if you turn it on in Settings → Data Collection (see Section 4); it is off by default.
• Content you create - the projects, code, configuration, and other content you build with or upload to the Services.
• Communications - messages you send us (for example, support requests) and verification codes we send during sign-up.

3. How and why we use your data, and our legal bases

Where the EU/UK GDPR or comparable laws apply, we rely on these legal bases:

• To provide the Services - creating your account, authenticating you, running AI builds, hosting your projects, and maintaining the platform. Legal basis: performance of our contract with you.
• To secure and operate the Services - preventing abuse and fraud, enforcing limits, debugging, and keeping audit/activity logs. Legal basis: our legitimate interests in a secure, reliable service.
• To improve our AI models - using your prompts and responses to evaluate and improve model quality, only where you have opted in. Legal basis: your consent, which you can withdraw at any time.
• To communicate with you - sending verification codes, service notices, and responses to your requests. Legal basis: contract and our legitimate interests.
• To comply with law - meeting legal, tax, and regulatory obligations and responding to lawful requests. Legal basis: legal obligation.

4. AI prompt & response collection (opt-in)

Collection of your prompts and the AI’s responses is off by default and is governed by the toggles on your account’s Settings → Data Collection page. Specifically:

• We only store prompts and responses while “Collect prompts & responses” is turned on.
• Before storage, we run automated stripping to remove obvious secrets and direct identifiers - such as email addresses, API keys, and phone numbers. This reduces, but cannot guarantee the removal of, all personal context, so please avoid putting sensitive personal data in your prompts.
• Turning collection off stops new collection immediately and schedules deletion of your prior captures, completed within a 24-hour service level (usually sooner).
• “Keep my content if I delete my account” is a separate, optional choice. If it is on when you delete your account, your captured prompts/responses are retained in anonymized form (your identity is severed) as training data; if it is off, those captures are deleted with your account.

Withdrawing consent does not affect the lawfulness of processing carried out before withdrawal.

5. Who we share data with

We do not sell your personal data. We share it only with service providers (processors) who help us run the Services under contract, and only as needed:

• AI model providers (for example, Anthropic and Google) - we route your AI requests through our platform to these providers to generate Output. We send the request content needed to produce a response.
• Google sign-in - if you choose to authenticate with Google.
• Infrastructure providers - cloud hosting, databases, and email-delivery providers used to operate the Services.
• Payment and domain providers - if and when paid plans or domains are offered, the relevant payment processors and domain registrars.
• Legal and corporate - authorities where required by law, and a successor entity in a merger, acquisition, or asset sale.

Third parties have their own terms and privacy policies governing their use of data; we are not responsible for their independent practices.

6. International transfers

We and our providers may process your data in countries other than your own, including outside the EEA, UK, or your GCC country of residence. Where we do, we put in place appropriate safeguards required by applicable law (for example, standard contractual clauses or an equivalent mechanism) to protect your data.

7. How long we keep data

We keep account and content data for as long as your account is active and as needed to provide the Services. When you delete your account, we delete or anonymize your personal data within a reasonable period, except where we must retain certain data to meet legal obligations or resolve disputes. Opt-in prompt/response captures are retained only per your consent settings and are deleted within the 24-hour service level after you turn collection off, unless you have chosen anonymized retention as described in Section 4.

8. Your rights

Subject to applicable law, you have the right to access, correct, delete, and receive a copy of your personal data; to restrict or object to certain processing; and to withdraw consent where we rely on it. Many of these are available directly in your account settings (including the data-collection toggles and account deletion). To make any other request, contact support@vzqx.com. We will respond within the timeframe required by your local law. If you are in the EU/UK, you also have the right to lodge a complaint with your local data-protection supervisory authority; in GCC and other regions, you may have the right to complain to the relevant regulator.

9. Children

The Services are intended for users who are at least 18 years old and are not directed to children. We do not knowingly collect personal data from anyone under 18. If we learn that we have, we will delete it.

10. Security

We use technical and organizational measures to protect personal data, including encryption in transit, hashed passwords, access controls, and isolated project environments. No method of transmission or storage is completely secure, so we cannot guarantee absolute security; please keep your credentials confidential and notify us of any suspected unauthorized access.

11. Cookies and local storage

We use strictly necessary cookies and browser storage to keep you signed in and to operate the Services (for example, your session and authentication tokens). We do not use third-party advertising or cross-site tracking cookies. You can clear this storage through your browser, but doing so will sign you out.

12. Applications you build

When you build or deploy an application with the Services, you are the controller of any personal data your application collects from its end-users. You are responsible for your own privacy notice and for complying with data-protection law toward your end-users; we process that data on your behalf as part of providing the hosting and platform.

13. Changes to this notice

We may update this Privacy Notice from time to time. If we make a material change, we will take reasonable steps to notify you and will update the version and date above. Continued use of the Services after a change takes effect means you acknowledge the updated notice.

14. Contact

Questions about this Privacy Notice or your data? Contact VZQX LLC at support@vzqx.com.