Privacy policy

1. Who is responsible for your data

The controller of your personal data is the operator of zephyrmedia (“we”, “us”). Our details are below and in the Imprint, which always shows the current operator.

Operator

zephyrmedia

Country of establishment

Hungary

Email

contact@zephyrmedia.online

For any question about your data or this policy, use this contact: contact@zephyrmedia.online.

2. Data protection officer

We have not appointed a data protection officer. The law does not require one for us: we are not a public body, and our core activities do not involve large-scale, regular and systematic monitoring of people or large-scale processing of sensitive data (GDPR Article 37). Please send every data protection question to the contact above.

3. What we process, why, and for how long

Each heading below is one purpose for which we use personal data. For each we list the data, the purpose, the legal basis under GDPR Article 6(1), where the data comes from, and how long we keep it. Where we rely on our legitimate interests (Article 6(1)(f)), we name the interest. You can object to that processing at any time (section 11).

3.1 Channel-review request

Data

Your YouTube channel link or @handle, email address, the service you are interested in, whether your Shorts are ready, project type, approximate budget, timeline, and the optional niche and note you write; a request reference and the time you sent it.

Purpose

To check whether your channel fits our service (niche and audience), reply to you, agree the scope and prepare an offer.

Legal basis

Article 6(1)(b): steps taken at your request before entering into a contract.

Source

You, through the request form. To judge channel fit we also look at the public information on your YouTube channel.

Where it goes

The request is emailed to the studio inbox and then saved in our database, where you can see it in the client portal.

Retention

If no contract follows: 12 months after our last contact with you. If you order a service, the request becomes part of the client records described in 3.4 and 3.5.

3.2 Free consultation booking

Data

Your name, email address, preferred day and time slot (Budapest time), the optional note and the optional request reference you enter.

Purpose

To confirm, arrange and hold the call you asked for.

Legal basis

Article 6(1)(b): steps taken at your request before entering into a contract.

Source

You, through the booking form.

Where it goes

Saved in our database and emailed to the studio inbox so we can confirm the call.

Retention

12 months after our last contact with you, unless the call leads to a contract (then 3.4 and 3.5 apply).

3.3 Client portal sign-in and account

Data

Your email address and an account identifier. If you choose “Sign in with Google”: your Google account identifier, email address and the basic profile details Google shares (such as your name and profile picture link). The sign-in system also records sign-in times and technical data such as IP address and browser type, and stores a session token in your browser (see the cookies page).

Purpose

To let you sign in by email link or Google and see only your own requests, pay for approved requests and manage billing. The portal shows a request only when its email address matches your verified sign-in email.

Legal basis

Article 6(1)(b): providing the portal you asked to use. Sign-in security records: Article 6(1)(f), our legitimate interest in protecting accounts against misuse.

Source

You; Google, if you choose to sign in with Google.

Retention

Until you ask us to delete the account, or 12 months after your last service with us ends if you have not signed in since, whichever comes first. Deleting the account does not delete records we must keep under 3.4 and 3.11.

3.4 Orders, payments, invoicing and tax records

Data

Email address, billing country and postal code, any further billing details you enter in Stripe’s checkout or invoice, the plan bought, amount, tax, currency, payment date and status, subscription status and changes, and the reference numbers Stripe assigns (customer, payment, invoice and subscription IDs).

Card data

You enter card details only in Stripe’s secure payment form. We never see or store your full card number or security code.

Purpose

To take payment for services the studio approved, calculate applicable tax, issue receipts and invoices, run monthly subscriptions, handle cancellations and refunds, and keep accounting records.

Legal basis

Article 6(1)(b) for payment and subscription handling. Article 6(1)(c) for keeping accounting and tax records required by Hungarian law, in particular the Accounting Act (Act C of 2000, Számv. tv.) and tax rules.

Source

You; Stripe, which tells us whether a payment succeeded and what tax applied.

Retention

Accounting documents (such as invoices and the records supporting them): 8 years, as Számv. tv. § 169 requires. Other contract and payment records: for the term of the contract and 5 years after it ends, the general limitation period for civil claims (Civil Code, Act V of 2013, section 6:22).

3.5 Service delivery

Data

The Shorts and other materials you supply (titles, descriptions, files), which may show or name you or other people; your channel link and public channel information; our channel-fit notes (niche and audience), which we show you; scope and audience approvals and their dates; publishing schedules, publication links and the views recorded in your reports; our correspondence with you. For the own-channel service: the YouTube Studio permission you grant us and the channel data visible to us through it. We never ask for your password.

Purpose

To deliver the service you bought: review and approve the channel audience, publish your Shorts, and report on publications.

Legal basis

Article 6(1)(b): performing our contract with you. Where your Shorts show other people, we publish them for you under Article 6(1)(f), our and your legitimate interest in performing the contract you made with us; you are responsible for having those people’s permission (see the content policy).

Source

You; your public YouTube channel; YouTube (publication data and recorded views).

Retention

For the term of the contract and 5 years after it ends (Civil Code section 6:22). How long a published Short stays online is governed by the terms of service.

If your materials show people other than you, please make sure they know about this policy. Anyone who appears in a publication can contact us to exercise their rights or report a publication under the content policy.

3.6 Emails we send

Data

Your email address, the content of the message, and delivery data such as the time sent and whether it was delivered.

Purpose

Service emails only: sign-in links, replies and follow-ups about your request, scope approvals, payment confirmations and receipts. Stripe sends its own invoice emails if you choose to pay by invoice. We do not send a marketing newsletter. If we ever want to, we will ask for your consent first.

Legal basis

Article 6(1)(b): communication needed to answer your request and perform the contract.

Source

You.

How

Our emails are sent through our hosting provider’s email service from noreply@zephyrmedia.online. Replies and studio notifications reach the studio inbox.

Retention

As long as the activity the email belongs to (3.1 to 3.5). The email provider keeps delivery logs for its own limited period.

3.7 AI service helper

Data

The free-text description you type into the AI helper on the home page, and the suggestions it returns. You do not need to enter your name, email or any other personal data.

Purpose

To suggest which of our services might fit what you describe. The helper is an AI system and its suggestions are not offers; the studio confirms scope and price.

Legal basis

Article 6(1)(f): our legitimate interest, shared by visitors, in offering an optional quick way to find a fitting service, which you start yourself.

Source

You.

How

Our server sends the text to our hosting provider’s AI gateway, which passes it to an OpenAI language model. Our request switches off storage of the conversation at the model provider. The providers may keep it briefly where their terms require it for security or abuse monitoring.

Retention

Not stored by us. The text is not saved in our database or linked to any request or account.

3.8 Connecting an AI assistant

Data

Your sign-in, the authorization you approve (which assistant or app, when, and the access tokens issued), and the data the assistant reads at your request: our plans and your own requests (plan, channel, project type, budget, timeline, status, payment status and dates).

Purpose

To let an AI assistant you choose read your own zephyrmedia data. It acts with your permissions only and can see only what you could see in the portal.

Legal basis

Article 6(1)(b): providing the connection you ask for as part of the portal.

Source

You.

Recipient

The provider of the assistant you connect receives the data it reads. It decides itself how to use and keep that data under its own privacy terms, so it is responsible for it, not us.

Retention

The authorization lasts until you disconnect the assistant, ask us to revoke it, or your account is deleted. Access tokens expire on their own.

3.9 Website operation and security logs

Data

IP address, date and time, the page or address requested, browser and device information, the referring page, and technical error details.

Purpose

To deliver the website, keep it and our forms secure, detect and stop abuse, and fix errors.

Legal basis

Article 6(1)(f): our legitimate interest in a secure, working website and in preventing misuse.

Source

Your browser, automatically, when you visit.

Retention

Kept by our hosting provider in its server logs for its standard limited period. We do not use logs to identify visitors, except to investigate a security incident or to establish or defend a legal claim.

3.10 Search statistics

We use Google Search Console to see how our website appears in Google Search. Google gives us only aggregated statistics, such as search terms, clicks, impressions, pages and countries. These statistics do not identify you, so they are not personal data. We do not use analytics, tracking or advertising tools on the website.

3.11 Complaints, rights requests and legal claims

Data

Your contact details, the content of your complaint or request, our answer, and related correspondence and documents.

Purpose

To handle consumer complaints and data protection requests, keep the records the law requires, and establish, exercise or defend legal claims.

Legal basis

Article 6(1)(c): keeping records of consumer complaints (Consumer Protection Act, Act CLV of 1997, § 17/A) and answering data protection requests (GDPR Articles 12 to 22). Article 6(1)(f): our legitimate interest in establishing, exercising or defending legal claims.

Source

You; in a dispute, also the other party, an authority or a court.

Retention

Consumer complaint records and our answers: 3 years, as Act CLV of 1997 § 17/A requires. Data protection requests and our answers: 5 years, so that we can show how we handled them. Data needed for a legal claim: until the claim is time-barred (generally 5 years, Civil Code section 6:22) or, if proceedings start, until they end with a final decision.

4. How we apply these periods

We check stored data at least every six months and delete or anonymise anything that has reached the end of its retention period. Data can therefore remain for a short time after a period ends, but no longer than until the next check. Copies in backups kept by our providers are overwritten on their regular backup cycle.

5. Do you have to give us your data?

No law obliges you to. But we cannot review a request without the required form fields, confirm a call without your name and email, let you sign in without an email address or Google account, calculate tax without your billing country and postal code, or deliver a service without the materials and access it needs. Optional fields are marked as such.

6. Please do not send us

Do not write passwords, access codes or other account credentials in any form, note or email. Do not send sensitive data such as health information, political opinions, religious beliefs, sexual orientation or similar details (GDPR Article 9) in free-text fields. We do not need them, and if we receive them unasked we delete them.

7. Who receives your data

We use the service providers below. Those marked “processor” act only on our instructions under a data processing agreement. Those marked “independent controller” decide themselves how they use the data for their own purposes, under their own privacy policies.

• Lovable (processor): hosts the website and server code, runs our managed database and sign-in system, sends our emails, provides the AI gateway for the AI helper, and relays our server’s calls to Stripe and Google Search Console.
• Supabase (processor, through our hosting provider): the database and sign-in system behind our managed backend, where requests, bookings and accounts are stored.
• Stripe: processes payments, subscriptions, invoices, tax calculation and the billing page as our processor. For fraud prevention, and to meet its own legal obligations (such as financial and anti-money-laundering rules), Stripe acts as an independent controller. See Stripe’s privacy policy.
• Google (independent controller): if you choose “Sign in with Google”, Google handles your Google account under its own privacy policy. YouTube, a Google service, receives and publishes the Shorts and channel information involved in the service, under its own terms. Google Search Console gives us aggregated statistics only.
• OpenAI (processor, through our hosting provider’s AI gateway): provides the language model behind the AI helper (3.7).
• The AI assistant you connect (your own provider, independent controller): only if you connect one (3.8).
• Our email inbox provider (processor): holds the studio inbox where requests, bookings and your emails arrive.
• Advisers and authorities: an accountant or lawyer if we engage one (bound by confidentiality), and courts or authorities where the law requires us to disclose data.

We do not sell your personal data or share it with anyone for their advertising or marketing.

8. Transfers outside the European Economic Area

Some of the providers above, or companies that work for them, process data in the United States or other countries outside the EEA. Where a recipient is certified under the EU–US Data Privacy Framework, the transfer relies on the European Commission’s adequacy decision for that framework. Otherwise it relies on the Standard Contractual Clauses approved by the European Commission, with additional safeguards where needed (GDPR Article 46). You can ask us for information about the safeguards for a given provider.

9. No profiling or automated decisions

We do not profile you and we make no decision with legal or similarly significant effects about you by automated means (GDPR Article 22). People at the studio review every request, decide channel fit and approve scope and publishing. The AI helper only suggests services; it decides nothing.

10. Children

Our services are for adults (18 or over) and businesses. We do not knowingly collect data from children. If you believe a child has sent us personal data, please contact us and we will delete it.

11. Your rights

Under the GDPR you have the right to:

• access your data and receive a copy, with information about how we use it (Article 15);
• have inaccurate data corrected and incomplete data completed (Article 16);
• have your data erased when there is no longer a reason to keep it, unless the law requires us to keep it or we need it for a legal claim (Article 17);
• restrict our use of your data, for example while we check a correction or an objection (Article 18);
• receive data you gave us under a contract in a structured, machine-readable format and have it transferred to someone else where technically feasible (Article 20);
• object at any time, on grounds relating to your situation, to processing based on our legitimate interests (Article 21). We then stop unless we have compelling legitimate grounds or need the data for a legal claim;
• not be subject to decisions based solely on automated processing (Article 22) — we make none;
• withdraw consent at any time where we rely on it. We do not currently rely on consent for any activity in this policy. Withdrawal does not affect processing before it.

When we correct, erase or restrict data, we tell the recipients we shared it with, unless that is impossible or involves disproportionate effort (Article 19).

12. How to use your rights

Contact us in writing: contact@zephyrmedia.online. To protect your data, we need to confirm it is you: usually by replying from the email address linked to your request or account, or by signing in to the portal. We ask only for what we need to identify you.

We answer without undue delay and within one month of receiving your request. If a request is complex or we receive many, we may extend this by two further months; we will tell you within the first month and explain why. Using your rights is free. If a request is manifestly unfounded or excessive, we may charge a reasonable fee or refuse it, and we will explain why.

13. Complaints and court

We would like to hear from you first so we can put things right. You also have the right to lodge a complaint with a supervisory authority. In Hungary this is:

Nemzeti Adatvédelmi és Információszabadság Hatóság (NAIH)
Hungarian National Authority for Data Protection and Freedom of Information
Address: 1055 Budapest, Falk Miksa utca 9–11.
Postal address: 1363 Budapest, Pf. 9.
Email: ugyfelszolgalat@naih.hu
Phone: +36 1 391 1400
Website: naih.hu

If you live or work in another EU or EEA country, you can also complain to the supervisory authority there (GDPR Article 77).

You can also go to court if you believe your rights have been infringed (GDPR Article 79). In Hungary such cases belong to the regional court (törvényszék). You may choose to bring the case before the regional court of your place of residence or stay (Infotv. § 23).

14. How we protect your data

We use measures appropriate to the risk, including: encrypted connections (TLS) between your browser and the website and between our server and our providers; row-level security in the database, so a signed-in client can read only their own requests; access for studio members only through a dedicated role; keeping secret keys on the server, never in your browser; giving each part of the system only the access it needs; and leaving card payments entirely to Stripe. No system is perfectly secure, so we cannot guarantee absolute security. If a personal data breach occurs, we notify the NAIH without undue delay and, where feasible, within 72 hours, unless the breach is unlikely to put anyone at risk, and we inform you directly if the risk to you is high, as GDPR Articles 33 and 34 require.

15. Changes to this policy

We update this policy when our services, providers or the law change. The date at the top shows the latest version. If a change significantly affects how we use data you have already given us, we will tell clients by email or in the portal before it takes effect. How we use cookies and browser storage is described on the cookies page.