Privacy Notice

The short version

This summary is for convenience. The full text below controls.

1.About this notice

1.1Who we are

In this Privacy Notice, "Zinstruct," "we," and "us" mean [Exact registered entity name], a Colorado limited liability company doing business as Zinstruct, with its mailing address at 2403 E 28th Ave, Denver, CO 80205, USA. "You" means the individual this notice describes. Other capitalized terms, such as Creator, Member, Services, Creator Site, Creator Content, Member Data, Community AI, and Personal Data, have the meanings given in the Terms of Service.

1.2Who this notice covers

This notice applies when Zinstruct is the controller of your Personal Data, meaning that we decide why and how it is processed. It covers you if you are:

• a Creator, or an Authorized User of a Creator's Account;
• a Partner, or someone who applies to become one;
• a visitor to zinstruct.com or any other website we operate under the Zinstruct name;
• a prospective Creator, or anyone else who contacts us, subscribes to our own emails, or receives our marketing; or
• a Member, but only in the limited situations described in Section 2.2.

1.3What this notice does not cover

This notice does not cover:

• Member Data that we process for Creators. For that data, the Creator is the controller and Zinstruct is the processor. Section 2 explains what that means for you.
• Creators' own privacy practices. Each Creator is responsible for its own privacy notice to its Members. A Creator Site may also set its own cookies, which the Creator controls, as the Cookie Notice explains.
• Third-Party Services. Services such as Stripe, or the AI provider a Creator connects through a Creator AI Key, handle Personal Data under their own terms and privacy policies when they act for their own purposes.
• Our workforce. The Workforce Member Privacy Policy covers our employees, contractors, and job applicants.

1.4If you live in a US state with a privacy law

If you live in a US state with a comprehensive privacy law, such as Colorado or California, the US State Privacy Notice gives you additional information and explains your rights under that law. It supplements this notice.

2.If you are a Member: the Creator is in charge of your data

2.1Creators control Member Data

Each Creator Site belongs to a Creator. When you sign up for, buy from, or take part in a Creator Site, that Creator decides what information to collect about you, what to do with it, and how long to keep it. For that information, the Creator is the controller and Zinstruct is the processor (a "service provider" or "processor" under US state privacy laws).

This information is Member Data. It includes, for example:

• your account and profile on the Creator Site;
• what you buy and your transaction records;
• your course progress;
• what you post or submit in the Creator's Community;
• your conversations with Community AI in that Community; and
• your newsletter subscription and whether you open or click the Creator's emails.

We process Member Data only to provide the Services to the Creator and as the Creator instructs, under the Data Processing Addendum. The Creator's own privacy notice, not this one, explains how the Creator uses your data. You can usually find it on the Creator Site.

2.2When we are the controller for information about Members

In a few limited situations, we decide how and why information about a Member is used, and this notice applies to that information:

• When you contact us directly. For example, when you write to our support team, send us a privacy request, report content or conduct, report a security issue, or send a copyright notice.
• Security and abuse prevention. When we protect the Services, Creators, and Members from fraud, spam, account takeover, security threats, and violations of our Policies across the whole platform.
• Legal compliance. When we respond to legal requests as described in the Law Enforcement and Legal Request Guidelines, keep records the law requires, or establish, exercise, or defend legal claims.
• Aggregated Data. When we create Aggregated Data, which by definition cannot identify you.
• Our own website. When you visit zinstruct.com rather than a Creator Site.

2.3How Members can exercise privacy rights

• Contact the Creator. For access, correction, deletion, or any other request about Member Data, contact the Creator whose Creator Site you use. If you use more than one Creator Site, each Creator controls its own Member Data, so contact each one.
• If you contact us instead, we forward your request. We send it to the Creator it concerns, or tell you how to reach that Creator. We then help the Creator respond as the Data Processing Addendum requires. We do not decide requests about Member Data ourselves, unless the law requires us to.
• Requests about the information in Section 2.2. We handle these ourselves under Section 12.
• If you cannot reach the Creator, contact us at support@zinstruct.com and tell us which Creator Site your request concerns.

3.Personal Data we collect

We collect the categories of Personal Data below. The same category names appear in our other Policies.

If you give us Personal Data about another person, such as when you invite an Authorized User, you must have the right to do so.

4.How we use Personal Data

4.1Purposes and legal bases

The table lists why we use Personal Data. If you are in the European Economic Area, the United Kingdom, or Switzerland, it also lists the legal basis we rely on for each purpose.

4.2Legitimate interests

When we rely on legitimate interests, we weigh them against your rights and interests. You can object to that processing as Section 12 explains. You can ask us for more information about how we balanced them.

4.3New purposes

If we want to use Personal Data for a purpose that is not compatible with the purpose for which we collected it, we will tell you first and, where the law requires, ask for your consent.

5.Community AI and other AI features

• Creators' use of AI features. When you set up and use Community AI or other AI features, we process your instructions, the sources you provide, the insights reported to you, and your usage records. We use them to provide the feature, meter and bill platform-metered usage, and keep the feature secure. The AI Terms explain how the features work.
• AI model providers. To generate AI Output, we send prompts and other inputs to an AI model provider. For platform-metered usage, that is a provider we select, listed in the Sub-processor List. If you connect a Creator AI Key, inputs go to your own provider, whose terms and privacy practices govern its processing.
• Creator AI Keys. We store a Creator AI Key with security safeguards and use it only to provide the Services to the Creator who connected it.
• Members and Community AI. Member posts in a Community and Member conversations with Community AI are Member Data. We process them for the Creator as Section 2 explains. Community AI posts and answers are identified as AI-generated.
• Training. [AI training policy]

6.How we share Personal Data

We share Personal Data only as described below.

• Service providers. We use service providers for hosting, databases and authentication, email delivery, payments, AI inference, analytics, and customer support. They may use Personal Data only to provide services to us, under contracts that require confidentiality and security. The Sub-processor List names the providers that process Member Data for Creators. We use providers in the same categories for the Personal Data this notice covers.
• Stripe. Stripe processes payments for Fees and Member Transactions. Stripe may also use Personal Data for its own purposes, such as fraud prevention and meeting its legal obligations, as described in Stripe's own privacy policy.
• Creators. If you are an Authorized User, the Creator whose Account you use can see your activity in that Account. If you are a Member and you contact us about Member Data, we share your request with the Creator it concerns.
• Partners. If a Partner referred you to Zinstruct, we share with that Partner the limited information needed to attribute the referral and calculate its commission, such as whether a referred account signed up or subscribed.
• Public information. Information you choose to make public through the Services, such as your Creator Site, public profile, or public posts, can be seen by anyone who visits it.
• Cookies and similar technologies. Cookies and similar technologies on zinstruct.com can let third parties, such as analytics providers, collect information directly from your browser or device. The Cookie Notice lists them. The US State Privacy Notice explains whether any of this is a "sale," "sharing," or "targeted advertising" under US state laws.
• Professional advisers. We share Personal Data with our lawyers, accountants, auditors, and insurers when they need it to advise or protect us, under duties of confidentiality.
• Legal and safety reasons. We may disclose Personal Data when we believe in good faith that the law requires it, or that disclosure is needed to protect the rights, property, or safety of Zinstruct, Creators, Members, or others. The Law Enforcement and Legal Request Guidelines explain how we handle requests from government authorities.
• Business transfers. If we are involved in a merger, acquisition, financing, reorganization, bankruptcy, or sale of assets, Personal Data may be transferred as part of that transaction. The recipient will be bound by this notice or give you notice of any change.
• With your consent or at your direction. For example, when you connect a Third-Party Service to your Account.

We may share Aggregated Data with anyone, because it does not identify any individual.

7.Cookies and Global Privacy Control

7.1Cookies

We use cookies and similar technologies on zinstruct.com and in the Services. The Cookie Notice explains which ones we use, why, and how to manage your preferences. It also explains how we respond to Do Not Track signals.

7.2Global Privacy Control

Global Privacy Control (GPC) is a setting in some browsers and extensions that tells websites you want to opt out of the sale or sharing of your Personal Data. When we detect a GPC signal, we treat it as a valid request to opt out of any sale, sharing, or targeted advertising, as those terms are defined in the US State Privacy Notice, for that browser or device. If we can associate the signal with you, such as when you are logged in to your Account, we also apply it to your Account. Where the law requires, we show you whether we have processed your signal.

8.How long we keep Personal Data

We keep Personal Data for as long as we need it for the purposes in Section 4, and then delete or de-identify it. Our retention periods are set out in [Retention schedule].

In setting those periods, we consider:

• how long you have an Account or relationship with us;
• whether the law requires us to keep the data, such as for tax, accounting, or legal records;
• whether we need it to resolve disputes, enforce our agreements, or defend legal claims; and
• the sensitivity of the data and the risk of keeping it.

When a Creator's Agreement ends, the Creator's ability to export Creator Content and Member Data, and our later deletion of that data, follow the Terms of Service and the Data Processing Addendum. Copies in backups are deleted as the backups are overwritten.

9.How we protect Personal Data

We use administrative, technical, and physical safeguards designed to protect Personal Data from loss, misuse, and unauthorized access, disclosure, alteration, and destruction. The security commitments that apply to Member Data are set out in the Data Processing Addendum.

No method of transmission or storage is completely secure, so we cannot guarantee absolute security. You help protect your data by keeping your login credentials confidential and using the security features the Services offer. If you believe your Account has been compromised, contact us at support@zinstruct.com. If a security incident affects your Personal Data, we will notify you and the relevant authorities where the law requires.

To report a security vulnerability, follow the Vulnerability Disclosure Policy.

10.International transfers

Zinstruct is based in the United States. We and our service providers process Personal Data in the United States and in other countries where those providers operate. Those countries may have data protection laws that differ from the laws where you live.

When we transfer Personal Data from the European Economic Area, the United Kingdom, or Switzerland to a country that has not been found to provide adequate protection, we rely on [International transfer mechanism]. You can ask for a copy of the relevant safeguards by contacting us.

11.Children

The Services are not directed to children under [Minimum age]. We do not knowingly collect Personal Data from children under that age. If you believe a child under that age has given us Personal Data, contact us at support@zinstruct.com and we will take steps to delete it. Creators whose Creator Content targets children must comply with the Children's Online Privacy Protection Act (COPPA) and every other applicable law, and must not use the Services in a way that causes Zinstruct to collect Personal Data from children without the consent the law requires.

12.Your rights and choices

12.1Choices available to everyone

• Account information. You can review and update much of your Account and profile data in your Account settings.
• Marketing email. You can unsubscribe from our marketing email at any time using the link in each message. We will still send you transactional and account messages, such as receipts and security notices.
• Cookies. You can manage cookie preferences as the Cookie Notice explains.
• Global Privacy Control. You can turn on GPC in a supporting browser, as Section 7.2 explains.

12.2If you are in the European Economic Area, the United Kingdom, or Switzerland

Subject to the conditions and exceptions in the law, you have the right to:

• access your Personal Data and get a copy of it;
• correct Personal Data that is inaccurate or incomplete;
• delete your Personal Data;
• restrict how we process your Personal Data;
• object to processing based on our legitimate interests, and to direct marketing at any time;
• receive Personal Data you gave us in a portable format, and have it sent to another controller where technically feasible;
• withdraw consent at any time, where we rely on consent, without affecting processing that took place before you withdrew it; and
• not be subject to a decision based solely on automated processing that produces legal or similarly significant effects on you, where the law gives you this right.

You also have the right to lodge a complaint with the data protection supervisory authority where you live, where you work, or where you believe an infringement occurred. We would appreciate the chance to address your concern first.

Our representative in the European Union and the United Kingdom, where the law requires one: [EU and UK representative]

12.3If you live in a US state with a privacy law

Depending on your state, you may have the right to know about, access, correct, delete, and get a portable copy of your Personal Data, to opt out of the sale or sharing of Personal Data, targeted advertising, and certain profiling, and to appeal our decision on your request. The US State Privacy Notice explains these rights, how to use them, how to use an authorized agent, and how to appeal.

12.4Everyone else

If you live somewhere else, you may have similar rights under local law. Contact us and we will respond as that law requires.

12.5How to make a request

To make a request, email support@zinstruct.com with "Privacy Request" in the subject line, or write to us at the address in Section 15. Tell us what you are asking for and which Account or email address it concerns.

• Verification. We need to confirm your identity before we act on most requests. We will ask only for information we need to do that, and we use it only for verification.
• Timing. We respond within the time the law requires. Under the GDPR and UK GDPR, that is one month, which we may extend by up to two further months for complex or numerous requests, with notice to you.
• Cost. We do not charge for requests, unless the law allows a reasonable fee because a request is manifestly unfounded, excessive, or repetitive.
• If we cannot fully comply, we will tell you why, subject to any legal limits on what we can say.

If you are a Member asking about Member Data, see Section 2.3.

13.Governing law

Nothing in this section limits your right to complain to a data protection authority or other regulator, or any right that the data protection law where you live gives you and does not allow to be waived.

14.Changes to this policy

We may update this notice from time to time. When we do, we will post the updated version in the Policy Center and change the "Last updated" date at the top.

If a change is material, we will notify you by email or through the Services at least [Change notification period] before it takes effect, unless the law requires a change to take effect sooner. If a change would let us use Personal Data we have already collected in a materially different way, we will ask for your consent first where the law requires it.

15.Contact us