Privacy Policy

1. Data Controller

GRAVA Development Srl
Strada Principala nr. 50, Corp C1, Potangeni (Com. Movileni), Cod postal 707353, Jud. Iasi - Romania
CUI: 54891299
VAT no.: RO54949854
Email: contact@zuzita.app

GRAVA Development Srl has not designated a Data Protection Officer (DPO), as we do not meet the thresholds requiring mandatory appointment under Art. 37 GDPR.

2. Information We Collect

• Account information: email address and display name when you register.
• Usage data: tasks, shopping lists, and reminders you create within the app.
• Device data: device token for push notifications (FCM), device type, app version, preferred language.
• Voice input: the audio recording of your command, sent for transcription, and the resulting text. The audio file is deleted from your device immediately and is not stored on our servers.
• Payment data: subscription information processed by Google Play and RevenueCat (we do not store card details).
• Activity data: last login date, usage statistics.

3. Legal Basis for Processing

• Contract performance (Art. 6(1)(b)): account data, tasks, lists and reminders necessary to provide the service.
• Legitimate interest (Art. 6(1)(f)): usage data to improve app stability.
• Consent (Art. 6(1)(a)): voice input processing based on your explicit action.
• Explicit consent (Art. 9(2)(a)): where voice input incidentally contains special category data (see "Sensitive information in voice input" below).
• Legal obligation (Art. 6(1)(c)): tax compliance for payment data.

4. How We Use Your Information

• To provide and maintain the Zuzita service.
• To synchronize data across family group members in real time.
• To send push notifications for reminders you have scheduled.
• To process voice commands and convert them to tasks or shopping items.
• To improve app functionality and fix bugs.
• For security and fraud prevention.

5. Data Storage

Your data is stored securely using Supabase (PostgreSQL), hosted on servers in the European Union. We implement row-level security (RLS) policies to ensure your data is only accessible to you and your family group members.

6. Third-Party Services

• Supabase – database and authentication (privacy policy).
• Firebase (Google) – push notifications, usage statistics and crash reports, linked to your account identifier (privacy policy).
• Groq UK Limited (United Kingdom, with processing on servers in the United States) – transcribes the voice recording into text, splits dictated shopping lists into items and extracts tasks and reminders.
• Google Gemini (Google LLC / Google Ireland) – interprets voice commands (text only, never audio).
• Cloudflare Inc. – website hosting.
• RevenueCat, Inc. (USA) – subscription management; receives your account identifier and subscription status, never payment card details (privacy policy).

7. Data Sharing

We do not sell, trade, or rent your personal information to third parties. Data is shared only within your family group as part of the app's core functionality.

8. Data Retention

• Account data: for the lifetime of the account + 30 days after deletion.
• Payment data: 5 years (legal tax obligation).
• Activity data: 2 years from last use.

9. International Data Transfers

When you use a voice command and your device is online, the app records the audio while you hold the button and sends it, through our server, to Groq, which converts it into text. The audio file is deleted from your device immediately after it is sent, whether or not the transcription succeeded, and is not stored on our servers. Without an internet connection, speech is converted to text by your device's own speech recognition service (on Android, usually Google's); depending on your device, its installed language packs and your settings, that service may process the audio on the device or on its provider's servers - that choice is made by your device, not by us. The resulting text is then used only to interpret your command. Neither provider uses the audio or the text to train or improve their AI models: Groq processes it solely as a processor, on our documented instructions, under its Data Processing Addendum; Google Gemini is used under paid Google Cloud services, where Google acts as a processor on our behalf. For Groq we have enabled the “Zero Data Retention” option, so neither the recording nor the resulting text is kept once the request has been processed. Other providers may retain the data for a short period to prevent abuse and fix errors, as described in their own privacy policies.

This processing takes place in the United States. Transfers to Google rely on the EU-U.S. Data Privacy Framework, in which Google LLC participates, and/or on the Standard Contractual Clauses approved by the European Commission. The transcription service is provided by Groq UK Limited, in the United Kingdom; transfers to that company rely on the European Commission’s adequacy decision for the United Kingdom, renewed on 19 December 2025. The actual processing takes place on servers in the United States, and for that onward transfer Groq’s Data Processing Addendum provides the same Standard Contractual Clauses (Commission Implementing Decision (EU) 2021/914, Art. 46 GDPR). Transfers to RevenueCat, Inc. are likewise made under those Standard Contractual Clauses. The safeguards described above for Google also cover push notifications, usage statistics and crash reports. You can request a copy of these safeguards at contact@zuzita.app. Our primary data storage (Supabase) remains hosted in the EU.

Sensitive information in voice input. Voice input is free-form, so it may incidentally contain information that the GDPR treats as a special category of data - for example a reminder to call a doctor. We do not seek such information, we draw no inferences from it, and we never use it to treat you differently. Because you decide when to use voice input, we rely on your explicit consent (Art. 9(2)(a) GDPR) to process it; you can withdraw that consent at any time simply by typing instead of dictating. We recommend not dictating health, religious, political or other sensitive details.

10. Children's Privacy

Zuzita is intended for adults. You must be at least 18 years old to create an account. We do not knowingly collect personal information from anyone under 18. This minimum age also reflects the terms of the AI providers we use for voice features. If you believe a minor has provided us with personal information, please contact us and we will delete it.

11. Your Rights

• Access the personal data we hold about you.
• Request correction of inaccurate data.
• Request deletion of your account and all associated data.
• Export your data in a structured format.
• Restrict or object to processing.
• Withdraw consent at any time.

To exercise these rights, contact us at contact@zuzita.app. We will respond within 30 days.

12. Data Breach Notification

In the event of a personal data breach, GRAVA Development Srl will notify the relevant supervisory authority (ANSPDCP) within 72 hours and will inform affected users without undue delay. If you suspect a data breach, contact us immediately at contact@zuzita.app.

13. Supervisory Authority

You may lodge a complaint with the Romanian National Supervisory Authority (ANSPDCP):
dataprotection.ro · +40 318 059 211
You may also contact the supervisory authority in your country of residence.

14. Account Deletion

You can delete your account at any time from Settings → Delete my account. Data is removed within 30 days, except payment data which must be kept for 5 years by law.

15. Changes to This Policy

We will notify you of significant changes via the app or email at least 15 days in advance.

16. Cookies

Our website uses only strictly necessary cookies, set by our hosting provider Cloudflare for security and performance. We do not use analytics, advertising, or tracking cookies, so no cookie consent banner is required. The Zuzita mobile app does not use cookies. If we introduce analytics or marketing technologies in the future, we will update this policy and ask for your consent where required.

17. Contact

Email: contact@zuzita.app
GRAVA Development Srl · Iasi, Romania