Privacy Policy

This Privacy Policy describes how PICSZIO, S.A.P.I. de C.V. ("we", "us") collects, uses, and protects your information when you use POLYON ("Service"). We comply with applicable data-protection laws including LFPDPPP (Mexico), GDPR (EU/EEA/UK), DPDP Act 2023 (India), CCPA (California), and equivalent laws in our operating markets.

1. Information we collect

• Account information: email, password (hashed), name, country, language preference.
• Subscription information: tier, billing status, payment processor reference (we do not store full card numbers).
• Usage data: messages you send, files you upload, voice inputs, AI responses generated.
• Device data: device type, OS, app version, IP address (truncated), session identifiers.
• Analytics: aggregated usage metrics for product improvement.

2. How we use your information

• To provide and operate the Service (route requests, store conversation history, deliver subscription benefits).
• To improve quality, performance, and safety of the Service.
• To send transactional emails (account, billing, security alerts) and, with your consent, marketing emails.
• To prevent fraud, abuse, and security incidents.
• To comply with legal obligations.

3. AI model providers

POLYON routes your requests to third-party AI providers (OpenAI, Anthropic, Google, Meta, Mistral, DeepSeek, xAI, Alibaba, and others) via OpenRouter and direct APIs. Your requests are transmitted to the selected provider for processing. We work only with providers that contractually commit not to train on user data without opt-in. We pass a tokenized user identifier — never your email or full name — for usage tracking.

4. Data sharing

We do NOT sell your personal data. We share data only with: (a) AI providers as described above; (b) infrastructure providers (AWS, Cloudflare) bound by data-processing agreements; (c) payment processors (Stripe, RevenueCat, telco billing partners) bound by PCI-DSS standards; (d) authorities when legally required.

5. Your rights

Depending on your jurisdiction, you have rights to: access your data, correct it, delete it (right to be forgotten), object to or restrict processing, port your data, withdraw consent, and lodge a complaint with your data-protection authority. Exercise rights at privacy@polyon.ai or Settings → Privacy & Security.

6. Data retention

Account data: kept while your account is active. Conversation history: kept until you delete it. Billing data: kept 7 years for tax and accounting compliance. Backups: rolling 30-day windows. Deleted accounts: purged within 30 days, except where law requires longer retention.

7. Security

We encrypt data in transit (TLS 1.3) and at rest (AES-256). Passwords are hashed with Argon2id. We perform regular security audits, vulnerability scans, and penetration tests. Authentication includes optional two-factor authentication. Read more on our Security page.

8. Children

POLYON is not directed at children under 13 (or under 16 where required by GDPR / DPDP Act). We do not knowingly collect data from such children. If we learn we have collected data from a minor without parental consent, we will delete it.

9. International transfers

POLYON operates globally. Your data may be processed in countries outside your jurisdiction, including the United States and the European Union. We use Standard Contractual Clauses (SCCs) and equivalent safeguards for international transfers.

10. Cookies and tracking

See our Cookies Policy for details on cookies, similar technologies, and how to manage them.

11. Changes

We may update this Policy. Material changes will be announced in-app at least 14 days before taking effect.

12. Contact

Data Protection Officer — PICSZIO, S.A.P.I. de C.V. — privacy@polyon.ai