Privacy Policy

1. Scope and contact

This Policy concerns personal information handled in connection with Zene’s website, applications, accounts, discovery services, physical poster orders, and communications. It distinguishes information provided by a user, information generated by use, and information received from other services. Third-party websites, applications, payment providers, and delivery carriers also have their own privacy notices.

Zene is a brand operated as an individual business in India. Email: [email protected].

Privacy and grievance contact: Rizwan Sayyed, CEO and Grievance Officer, [email protected]. This designation does not state that a statutory data-protection officer has been appointed.

2. Account information and material you provide

Account functions handle your email address, display name, username, profile photograph, and authentication-provider identifiers. The profile model also supports an optional telephone number and communication preferences. Sign-in providers may supply the profile fields and authentication assertions authorised by their sign-in flow; Zene does not need the password for your Google or Apple account.

Library features handle playlist names and covers, imported track information, saved items, likes, and listening history. Uploading a selected photograph transmits that file for storage and delivery. Choosing a photograph does not grant permission to use every image in your device library. Imported lists can reveal listening preferences even when the original file is parsed on your device, because matching searches and saved playlist records are sent to the service.

A poster order can require the purchaser’s name, email address, telephone number, billing and shipping addresses, country, selected product and size, delivery instructions, tax information, and transaction and fulfilment status. Zene does not need or receive a complete card number when the payment form is provided by Razorpay.

If a community or sharing feature is enabled, the information submitted through it and its audience determine what is disclosed to others. Correspondence, privacy requests, complaints, and supporting information are also personal information when linked to an individual. Avoid sending passwords, payment-card details, identity documents, or unnecessary sensitive information in an ordinary support email.

3. Activity, device information, and approximate location

Zene handles requests for pages and media, search and playback activity, saves and other interactions, and technical information associated with those requests. This can include an IP address, browser or operating-system details, device and installation identifiers, language and country settings, timestamps, and diagnostic events. Playback and page analytics can describe how features are used and whether errors occur.

The web sign-in flow includes an IP-based location lookup through ipwho.is. The response can include an IP address, city, region, country, and coordinates estimated from that IP address; the browser may cache the result and submit location-related account metadata. This is distinct from GPS permission and should not be described as collecting only a country code.

Push-notification registration can associate a device token with your account, platform, device metadata, locale, and delivery or engagement state. Notification providers and the operating system handle delivery. Notification permission can be changed in system settings, and a notification may be visible on a lock screen or shared device.

4. Purposes and applicable legal grounds

Account and session information supports authentication, continuity of access, account settings, and security. Library records and selected activity support saved content, playback continuity, and relevant discovery. Subscription information supports entitlement validation, restoration where available, family access, and billing-related support. Poster-order information supports payment, fraud review, tax and accounting records, production, delivery, returns, refunds, customer support, and legal compliance. Reports and correspondence support assistance, rights requests, abuse review, and dispute handling.

Where the EU or UK GDPR applies, processing genuinely necessary to deliver a requested account or paid feature may rely on contract; proportionate security, fraud prevention, service diagnostics, and ordinary support may rely on legitimate interests, subject to necessity and balancing against individual rights. Records required by law rely on the relevant legal obligation. These grounds do not automatically justify optional advertising or analytics tracking.

Consent is required for optional processing where applicable law requires it, including relevant tracking technologies. It must be specific, informed, freely given, and capable of withdrawal. Reading a policy, signing in, or paying for Premium does not by itself provide all necessary consents. In countries with a different legal framework, the available grounds and rights must be assessed under that framework rather than importing GDPR terminology indiscriminately.

5. Recipients and service providers

Google/Firebase supports authentication, analytics, and push messaging in the relevant builds. Apple supports Apple sign-in and iOS purchases. Google Play supports Android billing. Razorpay processes supported web poster payments. Zene prints, frames, packs, and fulfils poster orders directly and does not disclose poster-order details to an outside printer or fulfilment partner. A postal or courier service receives the recipient and parcel details necessary to deliver an order. Sentry receives configured error and performance reports. Microsoft Clarity receives usage data, such as taps, clicks, scrolling and masked screen recordings, from the website and the applications to show how features are used. Meta (Facebook and Instagram) and Google Ads receive shop activity — prints viewed, added to the bag, checkouts started and orders paid, with their value — to measure the ads that brought visitors; for a paid order Meta may also receive the buyer’s email, phone number and address in hashed form. Bunny infrastructure is used for uploaded image storage and delivery. Hosting, database, email, and operational providers may handle information needed for their functions; their locations and contractual roles require a current deployment inventory.

Google advertising products, including AdSense on the website and AdMob in supported app builds, can receive online identifiers, device information, ad events, and information about the context in which an advertisement appears. The specific processing depends on deployment, provider settings, permissions, region, and the choices available to the user. Advertising is not equivalent to a disclosure solely to a processor acting on Zene’s instructions.

Search terms and requested media or image identifiers may be sent to content sources. A direct image request, stream, embedded player, or map can disclose your IP address, browser/device information, and request context to the provider or publisher. Server-side retrieval and direct device requests have different recipients; not every source receives every account field.

Where lawful and necessary, information may be disclosed to professional advisers, authorities, or others to respond to binding legal requirements, address serious safety concerns, or establish and defend legal claims. A business transfer would require safeguards and any notices or choices required by law; it is not permission for an unrelated use inconsistent with those obligations.

• Google Privacy Policy
• Apple Privacy Policy
• Sentry Privacy Policy
• Microsoft Privacy Statement
• Meta Privacy Policy
• Bunny Privacy Policy
• Razorpay Privacy Policy
• Provider references

6. Public information and discovery sources

Profile and playlist information shared publicly can be seen by other people and may be linked from public pages. A person who receives a link may copy or redistribute it. Review the audience shown by the feature before uploading; if no private audience is offered, do not treat that surface as private.

Entertainment features retrieve information about artists, public figures, concerts, films, and styles from third-party sources. Some information is collected by automated retrieval and cached. Public-source material can still be personal information, inaccurate, sensitive, or subject to copyright. A person affected by an inaccurate or inappropriate listing can request correction or removal and identify the relevant Zene and source URLs.

7. Advertising, analytics, and privacy choices

The website contains Firebase analytics and Google advertising integrations, while supported applications have their own analytics and advertising integrations. Analytics identifiers derived from account details are pseudonymous, not necessarily anonymous. Error reporting and analytics are different processing activities and can have different purposes and retention settings. Microsoft Clarity records how pages and screens are used, with typed input and personal details such as delivery addresses masked before they leave the device.

This Policy does not claim that Zene has verified an absence of sale or sharing under every privacy-law definition, or that a Global Privacy Control signal currently blocks all relevant collection. The terms “sale”, “sharing”, and “targeted advertising” can cover disclosures without a cash payment. Current provider contracts, settings, consent controls, and actual requests must support the published classification.

Use any privacy controls actually displayed by the service or provider, system advertising/tracking settings, and the contact route below. An email request does not itself prevent requests already sent by a device, and clearing cookies does not erase information held on a server. Premium affects the advertised Zene ad experience; it does not mean authentication, diagnostics, or every form of processing stops.

• Cookies and Device Storage
• Advertising Privacy Choices

8. Purchase records

For supported store purchases, the store handles the payment instrument. Zene receives or processes the purchase identifiers, verification information, product, entitlement, status, and account associations needed to recognise access. These records are personal information even when they do not contain a complete payment-card number.

For a web poster order, Razorpay handles the payment instrument and returns transaction references and status. Zene handles printing, framing, packing, and fulfilment directly. Zene does not disclose poster-order details to an outside printer or fulfilment partner. A postal or courier service may receive the recipient’s name, address, telephone number, email address, parcel details, and customs information required for delivery.

A family plan can involve membership and invitation records. The person paying for a plan is not thereby entitled to another member’s private account data. Cancelling store renewal, leaving a family group, returning a poster, and deleting a Zene account are separate actions with separate effects. Accounting, tax, fraud, warranty, delivery, and dispute records may need to remain after an account or marketing profile is deleted for the period required by applicable law.

9. Zene Stores

If you open a store, Zene keeps its names, chosen posters, photo, display name and description, which are public on your store page; the bank account details you add for payments, encrypted with a key held only on Zene’s server and shown back to you only partly hidden; and your commissions and the payments made to you, with each bank reference and screenshot. Zene uses them to run your store, credit and pay your commissions, check sales for fraud, and show you what was earned and paid while the store exists.

When someone opens a store or a poster from it, Zene counts the visit by day, country, device type, operating system, and website or app. The country comes from the IP address; the IP address and the browser’s anonymous visitor identifier are held only briefly in server memory to stop repeated counting and are not saved with the counts, which are deleted after 30 days. Store owners see only these totals and their own commissions, never who a buyer or visitor is. When an order earns a commission, Zene records which store and poster it came from; the buyer’s identity is never shared with the store.

A store its owner switches off, or is closing, shows visitors only that it is closed. Commission and payment records are kept while the store exists. When a store is deleted — fifteen days after its owner closes it, or when the owner’s account is deleted — everything about it is deleted, those records included. Zene’s own bank and accounting records of payments it made are kept separately, for as long as tax and accounting law requires.

• Zene Stores Terms

10. Retention and deletion

Account, library, and preference records are used while needed to support the account and requested features. The in-app account-deletion process schedules a purge after a fifteen-day cancellation period. A scheduled date does not establish the exact time every database record, uploaded file, processor copy, and backup is erased.

Final retention periods must be set by data category and deployment. Relevant criteria include whether an account is active, whether a record remains necessary for a requested feature, applicable accounting and claims periods, documented safety or fraud needs, contractual provider limits, and a valid preservation obligation. Retention must not become indefinite simply because a backup exists or a future use is possible.

The current implementation does not establish a verified universal backup expiry or complete erasure from all external systems. Zene must confirm processor deletion, uploaded-media cleanup, legacy records, and any retained categories before publishing a complete-erasure guarantee. You may request deletion or an explanation of a retention decision through the contact route.

• Account and Data Deletion

11. Security and international handling

Account access uses authentication and session controls; production communications and storage require appropriate technical and organisational safeguards. No service can promise absolute security. Zene does not claim independently audited encryption of every data store or end-to-end encryption of all contributions on the basis of this notice.

Providers may process information outside your home country. The final notice must identify relevant processing locations and the legal mechanism used for restricted transfers, where required. A statement that standard contractual clauses exist cannot substitute for executed agreements, a transfer assessment, and any necessary supplementary safeguards. Contact Zene to request information about applicable safeguards.

12. Requests, objections, and complaints

Depending on your location and applicable law, you may have rights to learn what information is processed, obtain access or a copy, correct inaccuracies, request deletion, restrict processing, receive portable information, object to certain uses, withdraw consent, and complain to a regulator. Some jurisdictions provide rights concerning targeted advertising, sale or sharing, sensitive information, and appeals of a refused request.

Send a request to [email protected] and identify the right you wish to exercise and enough information to locate the relevant account or content. Access or deletion requests may require proportionate identity verification to protect your information; an advertising opt-out should not require unnecessary identity documents or creation of an account. An authorised representative may submit a request subject to applicable authority requirements.

Requests must be handled within the deadlines imposed by the applicable law. Any permitted extension or refusal should be explained, together with available complaint or appeal routes. An ordinary deletion cancellation period does not suspend a statutory response deadline. You should not be penalised for exercising a protected privacy right. Withdrawal does not retrospectively invalidate processing that was lawful before withdrawal.

13. Children and young people

The proposed service minimum is thirteen, subject to higher local thresholds and required parental authorisation. Names and email addresses are personal information even when received through Google or Apple, and Zene also processes the activity, device, location, and other categories described above. No verified parental-consent programme is established by this notice. Store ratings or an account statement do not replace duties arising from the actual audience or knowledge of a child’s use.

If a child has supplied personal information or is at risk through Zene, contact [email protected] with a safe description and relevant account or content identifiers. Do not attach abusive material or unnecessary identity records. Child-safety reports and privacy requests must be handled through appropriate procedures, including restrictions, deletion, preservation, or authority reporting where the circumstances and law require.

• Child Safety Standards

14. Changes to this notice

When processing materially changes, the notice and collection-time disclosures must change accordingly. New purposes may require fresh consent or another valid legal basis before use begins. The revision date records the published revision, and a material change will receive appropriate notice where required.