Privacy Policy

Effective date and roles

Effective October 10, 2026.

Zeon provides the Service described in the Terms. For most student and classroom data an Institute uploads, the Institute is the controller and Zeon is a processor. For account sign-in, security logs, billing metadata, and platform operations, Zeon may act as an independent controller.

Service properties include accounts.zeon.so (sign-in), api.zeon.so, app.zeon.so, admin.zeon.so, institute subdomains such as yourinstitute.zeon.so, and livekit.zeon.so for real-time classes where enabled.

Users in the EEA or UK: see "European users" below.

Information you provide

• Google (and, if used, GitHub) profile data from OAuth: name, email, avatar when available.
• Institute membership, role, batch, and permission data assigned by administrators.
• Customer Data: chat messages, files, calendar events, attendance, fee records where enabled, and similar Institute content.
• Live class participation metadata and recordings when recording is enabled.
• AI Feature prompts, attachments, and generated outputs you submit.
• Support and security communications you send to us.

Information collected automatically

• IP address, browser type, device information, timestamps, and request logs for security and reliability.
• Authentication session events and rate-limit signals stored in our application database and Redis.

How we use information

• Provide and secure the Service, including tenant isolation and role enforcement.
• Deliver messaging, notifications, live classes, recordings, billing features, and AI Features you request.
• Operate subprocessors listed at https://accounts.zeon.so/subprocessors.
• Comply with law and respond to lawful requests.
• Analyze aggregated or de-identified operational metrics—we do not sell personal information.

Legal bases (EEA/UK)

Where GDPR or UK GDPR applies to Zeon as controller, we rely on contract, legitimate interests (security and product operation), legal obligation, and consent where required. Institutes determine their own legal bases for Customer Data they control.

How we share information

We do not sell personal information. We share data only as follows:

• Within an Institute, according to role and Institute settings.
• With subprocessors under contract (see Subprocessors page).
• With advisers, regulators, or law enforcement when required or to protect safety and rights.
• In a merger, acquisition, or asset sale, with notice where required.

AI processing

AI Features route requests to providers such as Google (Gemini), DeepSeek, and Groq to generate responses, including Hartog grading of answer scripts and attachments. We use Customer Data only to provide the feature invoked, not to train public foundation models. Limited logs may be retained for abuse prevention and debugging.

Your choices

• Institute administrators manage most profile and enrollment data.
• Clear cookies and local storage per the Cookie Policy; blocking auth cookies prevents sign-in.
• Contact [email protected] for access, correction, or deletion requests. Students and families should often contact their Institute first.

Security and retention

We use encryption in transit, access controls, and tenant-scoped data access. No system is perfectly secure. We retain data while accounts and Institutes are active and for a limited period afterward for backups, security, and legal needs.

International transfers

We operate from the United States and use providers that may process data in the US and other countries. Where required, we use appropriate safeguards such as Standard Contractual Clauses. European users: see below.

Children and students

Institutes may enroll minors; the Service is not marketed for children to sign up on their own. Institutes must obtain consents required by local law. Contact [email protected] if you believe we hold a child's data without appropriate authority.

U.S. state privacy rights

Residents of states with comprehensive privacy laws may have rights to know, access, delete, or correct personal information, and to opt out of certain processing. We do not sell personal information or use it for cross-context behavioral advertising as defined under California law. Submit requests to [email protected].

European users

You may have rights of access, rectification, erasure, restriction, objection, and portability, and may lodge a complaint with a supervisory authority. Contact [email protected]. Processor terms for Institutes are in our DPA at https://accounts.zeon.so/dpa.

[Zeon operating company legal name and registered address — for counsel review]

Changes

We will post updates with a new effective date. Material changes may be communicated through the Service or email.

Contact

[email protected] · Phone/WhatsApp +880 1897-698384 · Gulshan 2, Dhaka, Bangladesh. [Zeon operating company legal name and registered address — for counsel review].

Template credit

Adapted from templates prepared and made publicly available by General Legal, PC under CC0. General Legal provides these templates for general reference only; they are not legal advice. General Legal has not reviewed modifications made for Zeon.