Privacybeleid — Zynceo

ZYNCEO PRIVACY POLICY

Version 2.0

Last updated: 10 July 2026

Article 1. Who are we?

1.1 This Privacy Policy applies to Zynceo, the SaaS platform for AI-powered SEO content creation, blog automation, content optimisation, internal linking, translations and Shopify integrations.

1.2 Zynceo is provided by:

Zyncport B.V.

Trading under the name Zynceo

Spoorstraat 35b

8271 RG IJsselmuiden

The Netherlands

Dutch Chamber of Commerce number: 42002045

VAT identification number: NL869230888B01

Website: www.zynceo.com

Privacy and legal enquiries: team@zynceo.com

Support: support@zynceo.com

1.3 Zyncport B.V. is responsible for the processing of personal data as described in this Privacy Policy.

1.4 This Privacy Policy explains:

a. which personal data we process;

b. where this data comes from;

c. why we process personal data;

d. the legal bases on which we rely;

e. with whom we share personal data;

f. how long we retain personal data;

g. how we protect personal data;

h. which privacy rights you have.

Article 2. Who does this Privacy Policy apply to?

2.1 This Privacy Policy applies to:

a. visitors to the Zynceo website;

b. persons who create a Zynceo Account;

c. employees and Team Members of business customers;

d. persons who purchase a Subscription or Add-on;

e. persons who connect a Shopify Store to Zynceo;

f. persons who contact Zynceo;

g. persons who receive service messages, newsletters or product updates;

h. suppliers, partners and business contacts;

i. persons whose data is processed through a connected Shopify Store.

2.2 Zynceo is a business service. The Service is not intended for private consumer use.

2.3 This Privacy Policy does not apply to the independent processing of personal data by Shopify, AI providers, hosting providers, email providers or other external parties.

2.4 External parties may independently determine the purposes and means of their own processing and may apply their own privacy policies.

Article 3. Definitions

3.1 Account

Access to Zynceo linked to a User, Organisation, email address, Shopify Store and Subscription.

3.2 User

The person who uses Zynceo on behalf of a business or Organisation.

3.3 Organisation

The business or legal entity on whose behalf an Account is used.

3.4 Shopify Store

The Shopify store connected to Zynceo by a User.

3.5 User Content

All texts, images, prompts, instructions, brand information, product information and other information entered or made available by a User.

3.6 Generated Content

All texts, images, translations, analyses, recommendations and other output generated through Zynceo.

3.7 Autopilot

The functionality through which Content is automatically generated, scheduled, stored or published.

3.8 Subprocessor

An external party that processes personal data on behalf of Zyncport B.V.

3.9 Personal Data

Any information relating directly or indirectly to an identified or identifiable natural person.

Article 4. Our role under the GDPR

4.1 Zyncport B.V. acts as a data controller when we process personal data for our own purposes.

4.2 This includes processing for:

a. Account management;

b. contract management;

c. Subscription management;

d. Shopify Billing;

e. customer support;

f. security;

g. fraud prevention;

h. product analysis;

i. business communication;

j. marketing;

k. administration;

l. compliance with legal obligations.

4.3 Zyncport B.V. acts as a data processor when we process personal data on behalf of a User within a connected Shopify Store.

4.4 In that situation, the User or the User’s Organisation acts as the data controller.

4.5 The User determines why and how personal data relating to its own customers, visitors, employees and contacts is processed.

4.6 Where Zyncport B.V. acts as a processor, the Zynceo Data Processing Agreement applies in addition to this Privacy Policy.

4.7 If a customer or visitor of a Shopify Store contacts us directly about personal data that we process on behalf of a User, we may refer the request to the relevant User.

Article 5. Where do we obtain personal data?

5.1 We may receive personal data:

a. directly from the User;

b. from the User’s Organisation;

c. through Shopify and the Shopify API;

d. through the User’s device, browser or internet connection;

e. through support messages and emails;

f. through Shopify Billing;

g. through connected services and integrations;

h. from public business sources;

i. from suppliers and business partners.

5.2 We only process data that is required for a specific purpose.

5.3 The User is responsible for the lawful provision of personal data to Zynceo.

Article 6. Account and contact information

6.1 We may process the following Account information:

a. first and last name;

b. company name;

c. business email address;

d. telephone number, if provided;

e. job title or User role;

f. language preference;

g. country and time zone;

h. Account settings;

i. Organisation information;

j. User permissions;

k. login times;

l. Account status.

6.2 Where Zynceo uses password authentication, we do not process readable passwords, but only securely stored password hashes.

6.3 Where access is provided through Shopify or another external login method, the relevant external party may process login information independently.

6.4 We use Account information for:

a. creating the Account;

b. verifying access;

c. managing User permissions;

d. protecting the Account;

e. providing the Service;

f. sending necessary service notifications.

Article 7. Business and Subscription information

7.1 We may process the following business information:

a. company name;

b. trading name;

c. Dutch Chamber of Commerce number;

d. VAT identification number;

e. country of establishment;

f. business address;

g. contact persons;

h. Subscription type;

i. Add-ons;

j. Usage Limits;

k. Subscription status;

l. connected Shopify Stores;

m. Team size.

7.2 We use this information for:

a. contract management;

b. Subscription management;

c. access management;

d. invoicing;

e. support;

f. legal compliance.

Article 8. Shopify Store information

8.1 When a Shopify Store is connected, we may process:

a. store name;

b. Shopify domain;

c. Shopify Store ID;

d. contact details of the store administrator;

e. app installation status;

f. granted API permissions;

g. Shopify Markets;

h. languages and country settings;

i. store currency;

j. time zone;

k. technical store settings.

8.2 For the operation of Zynceo, we may process the following store content:

a. products and variants;

b. product titles;

c. product descriptions;

d. product images;

e. collections;

f. collection descriptions;

g. blogs and blog articles;

h. pages;

i. URLs;

j. redirects;

k. metadata;

l. metafields;

m. tags;

n. alt texts;

o. internal links;

p. publication statuses;

q. translations;

r. content structures.

8.3 Store content does not normally contain personal data. Personal data may nevertheless be included if a User has entered it into product descriptions, blogs, pages, images, prompts or other Content.

8.4 We only process Shopify data for which the User has granted access and which is required for the selected functionalities.

Article 9. Protected Shopify customer data

9.1 The standard functionality of Zynceo is designed for SEO, content and store optimisation.

9.2 For this standard functionality, Zynceo does not require access to:

a. customer names;

b. residential addresses;

c. shipping addresses;

d. telephone numbers of store customers;

e. payment card information;

f. bank details;

g. checkout information;

h. order history;

i. payment information of store customers.

9.3 Zynceo does not request access to protected Shopify customer data where that data is not strictly required for an active functionality.

9.4 If a future optional functionality requires protected customer data:

a. access will be limited to the minimum data required;

b. the User must expressly activate the functionality;

c. Shopify must permit the required access;

d. the User will be informed in advance;

e. this Privacy Policy will be updated where necessary;

f. the User must have a valid legal basis for the processing.

9.5 We do not use customer data from Shopify Stores for our own marketing.

9.6 We do not sell customer data from Shopify Stores.

Article 10. Content information

10.1 We process information that the User enters, generates, imports or publishes through Zynceo.

10.2 This may include:

a. prompts;

b. instructions;

c. business information;

d. brand information;

e. brand values;

f. tone of voice;

g. target audience information;

h. buyer personas;

i. product information;

j. collection information;

k. blog topics;

l. content calendars;

m. generated texts;

n. images;

o. drafts;

p. translations;

q. SEO titles;

r. meta descriptions;

s. internal link suggestions;

t. quality checks;

u. publication settings;

v. publication logs.

10.3 The User may not enter special categories of personal data, criminal offence data or confidential personal data where this is not necessary.

10.4 The User is responsible for the lawfulness and accuracy of Content entered into the Service.

Article 11. Technical and usage information

11.1 We may process technical information such as:

a. IP address;

b. browser type;

c. browser version;

d. device type;

e. operating system;

f. screen size;

g. language settings;

h. time zone;

i. session ID;

j. date and time of use;

k. sections of the Service visited;

l. functionalities used;

m. API requests;

n. webhook logs;

o. error messages;

p. security notifications;

q. login attempts;

r. usage volumes;

s. AI Credit usage;

t. performance information.

11.2 We use technical information for:

a. security;

b. authentication;

c. error resolution;

d. fraud prevention;

e. misuse detection;

f. capacity management;

g. product improvement;

h. usage registration;

i. usage-based invoicing;

j. support.

Article 12. Support and communication information

12.1 When you contact us, we may process:

a. name;

b. email address;

c. company name;

d. Shopify domain;

e. subject of the request;

f. content of messages;

g. screenshots;

h. attachments;

i. technical information;

j. support history;

k. internal support notes.

12.2 We use this information to:

a. answer questions;

b. investigate technical problems;

c. handle complaints;

d. resolve security issues;

e. improve our services;

f. record agreements.

12.3 We will not ask you to share passwords, full payment details or other confidential login credentials by email.

Article 13. Payment and billing information

13.1 Payments for the public Shopify app are processed through Shopify Billing.

13.2 We may receive the following information through Shopify:

a. selected Subscription;

b. activated Add-ons;

c. approved Usage Limit;

d. charge ID;

e. invoice amount;

f. currency;

g. payment status;

h. effective date;

i. renewal status;

j. cancellation;

k. refund or adjustment.

13.3 Zynceo does not receive or store full credit card numbers, bank account details or payment card security codes of the User.

13.4 Shopify processes certain payment and billing information under its own privacy terms.

Article 14. Purposes of processing

14.1 We process personal data for:

a. creating and managing Accounts;

b. verifying Users;

c. managing Organisations and Team Members;

d. connecting Shopify Stores;

e. providing Zynceo functionalities;

f. generating and optimising Content;

g. translating Content;

h. generating images;

i. analysing SEO and Content;

j. providing internal linking;

k. operating Autopilot;

l. storing and publishing Content;

m. processing Subscriptions and Add-ons;

n. registering usage and AI Credits;

o. providing support;

p. resolving errors;

q. securing systems;

r. preventing fraud and misuse;

s. measuring performance;

t. improving the Service;

u. sending service notifications;

v. permitted marketing communication;

w. maintaining administration;

x. handling complaints and disputes;

y. complying with legal obligations.

Article 15. Legal bases for processing

15.1 We only process personal data where a valid legal basis applies.

15.2 Performance of an agreement

We process personal data where this is necessary to:

a. provide an Account;

b. perform a Subscription;

c. maintain Shopify integrations;

d. generate Content;

e. provide support;

f. manage payments and Add-ons.

15.3 Legal obligation

We process personal data where this is necessary for:

a. tax obligations;

b. statutory administration and retention requirements;

c. lawful information requests;

d. fraud prevention;

e. compliance with court orders.

15.4 Legitimate interests

We may process personal data for:

a. securing the Service;

b. fraud prevention;

c. misuse detection;

d. logging;

e. error resolution;

f. product improvement;

g. customer service;

h. business communication;

i. protection of our legal interests.

15.5 Where we rely on legitimate interests, we balance our interests against the rights and interests of the data subject.

15.6 Consent

We request consent where legally required, including for:

a. non-essential cookies;

b. certain analytics tools;

c. marketing emails;

d. optional data processing;

e. future use of identifiable Content for AI training.

15.7 Consent may be withdrawn at any time.

15.8 Withdrawal does not affect processing that lawfully took place before consent was withdrawn.

15.9 Where we act as a processor, the User determines the applicable legal basis for processing personal data relating to its own customers, visitors and contacts.

Article 16. AI processing

16.1 Zynceo uses AI Models for:

a. generating texts;

b. rewriting texts;

c. translating Content;

d. generating and editing images;

e. SEO analysis;

f. quality checks;

g. classification;

h. summaries;

i. internal link suggestions;

j. content planning.

16.2 Prompts, instructions and relevant store content may be transmitted to AI providers where this is required for a requested functionality.

16.3 We limit transmitted data to what is required for the relevant processing.

16.4 We seek to exclude direct personal data from AI prompts where that data is not required.

16.5 The User may not enter special categories of personal data, criminal offence data or sensitive customer information unless this is necessary and lawful.

16.6 Zyncport B.V. does not use identifiable User Content for the general training of its own generative AI Models without separate and explicit consent.

16.7 We do not authorise external AI providers to use identifiable User Content for general model training unless:

a. the User has given explicit consent;

b. this has been clearly communicated in advance;

c. a valid legal basis applies.

16.8 Authorised employees may access limited input or output where required for:

a. support;

b. security;

c. error resolution;

d. investigation of misuse;

e. quality control.

16.9 Employee access is restricted to persons who require access for their work.

16.10 We may use anonymised and aggregated data for statistics, product improvement, quality measurement and capacity planning.

Article 17. Autopilot and automated publication

17.1 When a User enables Autopilot, Zynceo may automatically generate, review, store, schedule and publish Content.

17.2 For Autopilot, we may process:

a. store content;

b. brand information;

c. tone of voice;

d. content rules;

e. languages;

f. Shopify Markets;

g. publication settings;

h. quality scores;

i. content calendars;

j. publication logs.

17.3 A User may set a minimum quality score for automated publication.

17.4 Where automated publication is enabled, Content may be published without prior manual review.

17.5 The User remains responsible for the settings and published Content.

17.6 The User may disable Autopilot through the settings of the Service.

17.7 Content already published remains in Shopify until the User changes or removes it.

Article 18. Cookies and similar technologies

18.1 Zynceo may use cookies, local storage, pixels, scripts, SDKs and similar technologies.

18.2 We may use these technologies for:

a. essential operation;

b. security;

c. login;

d. session management;

e. language and User preferences;

f. error detection;

g. performance measurement;

h. analytics;

i. marketing, where permitted.

18.3 Essential cookies may be placed without consent where they are required for the Service.

18.4 We request consent for non-essential cookies where legally required.

18.5 A User may manage cookie preferences through the cookie banner or browser settings.

18.6 Blocking essential cookies may prevent parts of Zynceo from functioning.

18.7 The standard functionality of Zynceo does not place advertising cookies on visitors to connected Shopify Stores.

18.8 If a future functionality places cookies or tracking technologies on a Shopify Store, this will be disclosed in advance and the User must obtain visitor consent where required.

Article 19. Email and marketing

19.1 We may send necessary service messages relating to:

a. Account activity;

b. payments;

c. Subscriptions;

d. security;

e. disruptions;

f. changes to the Service;

g. changes to terms;

h. privacy and data processing;

i. support requests.

19.2 Necessary service messages cannot always be disabled while the Account remains active.

19.3 We only send marketing emails and newsletters where permitted.

19.4 Every marketing email includes an option to unsubscribe.

19.5 Unsubscribing from marketing does not affect necessary service messages.

19.6 We may retain a minimal record of an unsubscribe request to prevent further unwanted marketing.

Article 20. With whom do we share personal data?

20.1 We only share personal data where this is necessary for a stated purpose, legally required or based on another valid legal basis.

20.2 We may share personal data with:

a. Shopify;

b. hosting providers;

c. database providers;

d. cloud infrastructure providers;

e. AI Model providers;

f. image generation providers;

g. email providers;

h. support software providers;

i. monitoring and logging providers;

j. analytics providers;

k. security providers;

l. accounting software providers;

m. business advisers;

n. legal and tax advisers;

o. competent government authorities;

p. supervisory authorities;

q. courts.

20.3 Subprocessors may only process personal data for agreed purposes and under appropriate contractual arrangements.

20.4 We do not sell personal data.

20.5 We do not rent personal data.

20.6 We do not share personal data of Shopify customers with other Zynceo Users.

20.7 A current list of Subprocessors is made available through www.zynceo.com or on request through team@zynceo.com.

Article 21. International transfers

21.1 Where practically possible, we seek to process personal data within the European Economic Area.

21.2 Some suppliers may process personal data outside the European Economic Area.

21.3 Where personal data is processed outside the European Economic Area, we use, where required:

a. an adequacy decision;

b. approved Standard Contractual Clauses;

c. supplementary technical and organisational measures;

d. another legally permitted transfer mechanism.

21.4 Where required, we assess the risks relating to international transfers.

21.5 Information about the locations and transfer mechanisms of Subprocessors may be included in the Subprocessor list.

Article 22. Retention periods

22.1 We do not retain personal data longer than necessary for the purpose for which it was collected.

22.2 We retain Account and Organisation information:

a. for as long as the Account remains active;

b. for up to 30 days after termination or removal of the app;

c. for longer where a statutory retention requirement or legal dispute requires this.

22.3 We retain Shopify Store information and User Content:

a. for as long as the Shopify Store remains connected;

b. for as long as required for the selected functionalities;

c. for up to 30 days following termination, removal or a valid deletion request.

22.4 Where available, the User will be given the opportunity to request an export before deletion.

22.5 We generally retain invoice, contract and administration information for seven years, or longer where a specific tax rule requires this.

22.6 We generally retain support messages and attachments for up to two years after closing the support request.

22.7 We generally retain technical usage logs for up to 12 months.

22.8 Security logs and information relating to fraud, misuse or incidents may be retained for longer where required for investigation, security or legal claims.

22.9 Backups may temporarily continue to contain deleted information until the relevant backup is overwritten.

22.10 Personal data in backups is generally overwritten or made inaccessible within 90 days after deletion from active systems.

22.11 We retain marketing information until you unsubscribe or until the purpose of processing no longer applies.

22.12 A record of the unsubscribe request may be retained for longer to ensure that the request is respected.

22.13 Anonymised and aggregated information may be retained for longer where it can no longer be linked to a person.

22.14 Where information is required for a legal dispute, fraud investigation or legal obligation, it may be retained until the relevant purpose no longer applies.

Article 23. Removal of the Shopify app

23.1 When a User removes the Shopify app, Zynceo’s active access to the Shopify Store ends.

23.2 Zynceo receives a deletion request for the relevant store through Shopify.

23.3 We delete or anonymise the relevant store information within 30 days after receiving the deletion request, unless:

a. a statutory retention obligation applies;

b. information is required for outstanding payments;

c. information is required for fraud investigation;

d. information is required for a legal dispute;

e. the User has expressly requested retention or export and this is legally permitted.

23.4 Information that must be retained for longer will be restricted and only used for the purpose for which it is retained.

23.5 Content already published in Shopify remains part of the Shopify Store and is not automatically deleted when the app is removed.

Article 24. Shopify privacy requests

24.1 Zynceo supports the mandatory Shopify privacy requests for:

a. access to customer data;

b. deletion of customer data;

c. deletion of store data.

24.2 When Shopify forwards a valid privacy request, we check whether Zynceo processes personal data relating to the relevant person or store.

24.3 Where information is present, we provide, delete or anonymise it in accordance with the request and applicable legal obligations.

24.4 We generally process a valid Shopify privacy request within 30 days after receipt.

24.5 Where information must legally be retained, we will not delete it for as long as the legal obligation applies.

24.6 We may inform the Shopify merchant where additional information is required to process the request.

Article 25. Security

25.1 We take appropriate technical and organisational measures to protect personal data.

25.2 Depending on the relevant system, these measures may include:

a. secure connections;

b. access controls;

c. roles and permissions;

d. encryption;

e. logging;

f. monitoring;

g. backups;

h. secure token storage;

i. webhook verification;

j. restricting access to authorised persons;

k. security updates;

l. incident procedures.

25.3 Employees and suppliers only receive access to personal data where required for their work.

25.4 The User is responsible for:

a. strong passwords;

b. secure devices;

c. correct User permissions;

d. removing former Team Members;

e. securing the Shopify Store;

f. protecting login credentials.

25.5 No technical system can guarantee complete security.

Article 26. Personal data breaches

26.1 If we discover a personal data breach, we investigate:

a. which information is involved;

b. how many persons are affected;

c. which risks exist;

d. which measures are required.

26.2 Where we act as data controller, we report a personal data breach to the Dutch Data Protection Authority where legally required.

26.3 Where a personal data breach creates a high risk for affected persons, we inform those persons where legally required.

26.4 Where we act as data processor, we inform the relevant User without undue delay.

26.5 The User remains responsible, as data controller, for assessing notifications to supervisory authorities and affected persons concerning its own customer data.

26.6 We cooperate within the scope of our role with the investigation, mitigation and handling of a personal data breach.

Article 27. Privacy rights

27.1 Depending on the circumstances, you have the right to:

a. receive information about processing;

b. access personal data;

c. correct inaccurate information;

d. complete incomplete information;

e. delete information;

f. restrict processing;

g. data portability;

h. object to processing;

i. withdraw consent;

j. request human review of certain automated decisions;

k. submit a complaint.

27.2 A privacy request may be sent to team@zynceo.com.

27.3 Please include in the request:

a. your name;

b. your business email address;

c. the relevant Organisation;

d. the Shopify domain, where applicable;

e. the right you wish to exercise.

27.4 We may request additional information to verify your identity and authority.

27.5 We do not request more information for identity verification than is reasonably necessary.

27.6 We generally respond within one month.

27.7 Where a request is complex or multiple requests are submitted, the response period may be extended where permitted by law.

27.8 We will inform you within the original response period if an extension is required.

27.9 A privacy request is generally free of charge.

27.10 We may refuse a request or charge a reasonable fee where the request is demonstrably unfounded or excessive.

27.11 A request may be restricted where:

a. a statutory retention obligation applies;

b. the rights of others would be affected;

c. information is required for legal claims;

d. security or fraud investigations would be harmed;

e. we process the information solely on behalf of a User.

27.12 Where we process personal data on behalf of a User, the relevant User may be responsible for the substantive handling of the request.

Article 28. Automated processing

28.1 Zynceo uses automation and AI for:

a. content generation;

b. analyses;

c. quality scores;

d. recommendations;

e. classification;

f. planning;

g. automated publication;

h. misuse detection.

28.2 Zynceo does not make decisions about persons based solely on automated processing that produce legal or similarly significant effects for those persons.

28.3 Quality scores and SEO scores are technical tools and do not constitute decisions about natural persons.

28.4 The User remains responsible for business decisions made on the basis of Zynceo output.

Article 29. Special categories of personal data and children

29.1 Zynceo is not intended for processing:

a. medical information;

b. information about race or ethnic origin;

c. religious or philosophical beliefs;

d. political opinions;

e. trade union membership;

f. genetic data;

g. biometric identification data;

h. information about sexual behaviour or sexual orientation;

i. criminal offence data.

29.2 The User may not enter this data unless this is necessary, legally permitted and agreed in advance with Zyncport B.V.

29.3 Zynceo is not directed at children.

29.4 We do not knowingly collect personal data relating to persons under the age of 16.

29.5 If we discover that personal data relating to a child has been processed without a valid legal basis, we may delete it.

Article 30. Transfer of the business

30.1 If Zyncport B.V. or Zynceo is sold, merged, reorganised or transferred, personal data may form part of that transaction.

30.2 In that situation, personal data may only be used for purposes compatible with this Privacy Policy and applicable law.

30.3 Data subjects will be informed where legally required.

Article 31. Changes to this Privacy Policy

31.1 We may amend this Privacy Policy where:

a. our Service changes;

b. new functionalities are added;

c. suppliers change;

d. laws and regulations change;

e. security measures are changed;

f. our data processing activities change.

31.2 The current version will be published through www.zynceo.com.

31.3 Where a material change is made, we will inform Users through:

a. email;

b. dashboard notification;

c. a notification in the Service;

d. another appropriate method.

31.4 The date at the top of this Privacy Policy indicates when the version was last updated.

31.5 Where consent is required for new processing, we will request consent before the processing begins.

Article 32. Complaints

32.1 If you believe that we do not handle personal data carefully, you may contact us through team@zynceo.com.

32.2 We will first attempt to resolve the complaint directly with you.

32.3 You have the right to submit a complaint to the Dutch Data Protection Authority.

32.4 You may also contact another competent European data protection authority where this applies to your situation.

Article 33. Contact details

33.1 For questions about privacy, data processing or privacy rights, you may contact: