Privacy Policy

Controller, scope, and contact

Xscent Global Inc., 8 The Green, Suite A, Dover, Delaware 19901, United States, is the legal entity and controller for the product and account services described here. It is a Delaware corporation with registration number 10337831. The registered address is the address above. The privacy contact is privacy@zillusion.app.

This policy applies to Zillusion websites, accounts, APIs, agents, runs, generated outputs, billing, and support. It does not govern a target website's independent practices.

Information we collect

Account and billing data

• Email address, optional display name, password hash, email-verification status, account and authentication records.
• Selected pack, Creem checkout, order and customer identifiers, amounts, currency, balance, ledger entries, refunds, disputes, and chargebacks. Payment-card details are entered on Creem-hosted checkout and are not collected by Zillusion product code.

Service content

• Requests, prompts, conversations, target URLs, uploads, tool calls, public-web content, generated scrapers, reports, artifacts, robots, run output, and datasets.
• Complete LLM message lists are stored in structured run logs and sent to the configured model provider.
• API keys and Login-state credentials that you choose to save in the Credential Library are encrypted with authenticated encryption before database storage. The service lists only their names and metadata; plaintext is temporarily materialized only where an authorized run needs it. You may delete each saved credential from Settings.
• De-identified, reusable strategy lessons may be added to a shared service memory library. Its write boundary rejects account identifiers, query identifiers, direct personal data, and credential-like values. Because it is non-tenant-specific and contains only reusable lessons, it is not deleted with an account.

Technical records

Request logs include client IP address, path, a redacted query string, request ID, response status, and timing. Browser storage includes the access token, locale, and theme preference. The service sets no cookies and integrates no third-party analytics or advertising trackers; browser storage is limited to the three functional items listed above.

Sources, purposes, and legal bases

We receive information from you, your organization, your browser or device, Creem, service providers, and target sites you direct the service to access. Target sites can observe requests originating from the service.

We process information to provide accounts and runs, authenticate users, execute and validate requested data work, meter credits, process payments, prevent abuse, secure and debug the service, communicate with users, comply with law, and improve reliability. Where the GDPR or a similar law applies, the legal bases are: performance of our contract with you, for account creation, execution of the work you request, billing, and support; our legitimate interests, for securing the service, preventing abuse and fraud, debugging, and improving reliability; compliance with legal obligations, for tax and accounting records and lawful requests; and your consent where we ask for it, which you may withdraw at any time without affecting processing already carried out.

Providers and disclosures

Information is disclosed only as needed to operate the service, complete your request, enforce our terms, protect rights and safety, complete a corporate transaction, or comply with law. Production providers confirmed from the active deployment are:

• Merchant of Record: Creem.
• LLM providers: Anthropic, OpenAI, DeepSeek, Z.ai, and Alibaba Cloud (DashScope International).
• Embedding, search, and crawl providers: Firecrawl (cloud API) for page retrieval; Exa, Brave Search, Tavily, and Jina AI for search or retrieval; and Alibaba Cloud DashScope for embeddings. Primary web search runs on a SearXNG instance we operate ourselves, which forwards search queries to upstream public search engines.
• Hosting, database, and storage: Google Cloud Platform (compute, networking, and disk). The PostgreSQL database, Redis cache, and Qdrant vector store are operated by us on that infrastructure rather than as third-party managed services.
• Transactional email: Google Gmail SMTP.
• Observability: no external observability provider is currently enabled.
• Professional advisers and disclosures required by law.

We do not sell personal information, and we do not share it for cross-context behavioral advertising. We have confirmed with our model providers that content sent through the service is not used to train their models. We use no third-party analytics or advertising trackers. Disclosure to the providers listed above, strictly to operate the service at your direction, is neither a sale nor an advertising disclosure.

Processing regions and international transfers

Our own compute, database, and storage run in the United States (Google Cloud region us-east5). Data sent to the providers named above is processed in the regions those providers operate, which may include the United States, Singapore, and mainland China. For international transfers of personal data out of the European Economic Area, the United Kingdom, or Switzerland, we rely on the European Commission Standard Contractual Clauses, together with the UK International Data Transfer Addendum where applicable, incorporated into our agreements with the relevant providers and supported by a transfer risk assessment and by technical and organizational measures. Where a provider is located in a country without an adequacy decision, we rely on those clauses and assessments rather than on adequacy.

Retention and deletion

Retention is set by category, operational need, contractual obligation, security, disputes, and law. When you confirm self-service account deletion in Settings, access is revoked immediately and background cleanup removes account-owned service content, saved credentials, and execution files. Billing, purchase, refund, and chargeback records remain for 7 years where required for tax and accounting. Terminal operator-action records normally remain for 730 days after their cleanup completes and may remain longer for an active security investigation, dispute, legal hold, or incomplete operational saga. Shared de-identified strategy lessons are not account data and remain in the global memory library. Request and IP logs are size-bounded rotating logs, in practice a few days; backups are kept for 14 days by default, so backup deletion follows that cycle and deleted data may persist in protected backups until then.

Credential deletion is available for each saved API key or Login-state credential. You may also permanently delete your account from Settings. Account deletion is irreversible, disables scheduled and active work, releases outstanding credit reservations, and forfeits the remaining balance except where a refund is due or law requires otherwise. The confirmation response means access has been revoked and cleanup has been durably queued; physical cleanup may continue asynchronously. You may also contact privacy@zillusion.app for a rights request. The product does not currently offer self-service export.

Your rights and choices

Depending on location, you may request access, correction, deletion, restriction, portability, or objection, and may withdraw consent where relied upon. Submit requests to privacy@zillusion.app. We verify your identity through the email address registered to the account before acting on a request. We respond within 30 days and tell you if we need a permitted extension. Reasonable requests are free of charge. We may decline or limit a request where a legal exception applies, and we will explain why. We accept authorized agents who provide written authorization we can verify. If we decline a request, you may appeal within 30 days by replying to our decision or writing to legal@zillusion.app; the appeal is reviewed by someone who did not make the original decision, and we give you a written outcome. You may complain to a competent supervisory authority.

Children, security, and changes

The service is for users aged 18 or older, and it is not offered in countries or regions subject to comprehensive sanctions or an applicable export-control prohibition. The service is not directed to children, and we do not knowingly collect personal information from them. We do not knowingly invite use outside that decision.

We use administrative, technical, and organizational safeguards appropriate to the service, but no system is absolutely secure. Confirmed controls are TLS termination at our edge proxy for all public traffic, bcrypt password hashing, AES-256-GCM authenticated encryption for Credential Library payloads, a nonce-based Content-Security-Policy, container-isolated execution of agent runs, and restricted access to the production environment. We make no general encryption-at-rest claim for other stored service content.

Material changes will be communicated by email to the address registered to your account at least 30 days before they take effect, except where a change must take effect sooner to meet a legal requirement.

Contact

Privacy contact: privacy@zillusion.app. Legal contact: legal@zillusion.app. Abuse contact: abuse@zillusion.app. Support contact: support@zillusion.app. Postal address: 8 The Green, Suite A, Dover, Delaware 19901, United States.