Privacy Policy of the AIDA Service

1. What data is processed

Account and contact: email address, name or alias, account identifier, authentication method, and the Telegram user ID and username if the User chooses Telegram sign-in or notifications.

Author profile and working materials: information about the product, positioning, audience, goals, and communication style; queries, prompts, links, texts, images, videos, and other materials the User uploads to or creates in the service; analysis results, content plans, scripts, carousels, recommendations, activity history, and feedback.

Instagram data: if the User connects a professional account, the Operator receives, through Meta's official platform API, the account identifier and username, profile information, posts together with their metrics and analytics, and the available aggregated audience statistics. For idea search, reference analysis, and competitor monitoring, the service also processes publicly available information from public accounts and posts selected by the User.

Payment and technical data: the selected plan, the fact, amount, and status of a payment, any promo code applied, and the payment transaction identifier and, when a payment is started in a browser whose visits Google Analytics counts, the identifiers Google Analytics gave that browser and visit; IP address, device and browser information, security logs, and sign-in and feature-usage timestamps. The Operator neither receives nor stores full bank-card details.

2. Purposes of processing

Data is processed for registration and authentication; provision of the free mode and the paid "AIDA Pro" and "AIDA Max" plans; personalisation of idea search, content plans, scripts, carousels, profile audits, and Reels checks; monitoring of selected competitors and sending notifications; retention of history; processing payments and automatic renewals; support, security, and compliance with statutory requirements.

On the AIDA Max plan, working materials and profile information may be accessible to the assigned marketer solely in order to steer content, adjust the plan, deliver reviews, and provide feedback within the scope of the paid plan.

3. Legal grounds

Consent of the data subject; conclusion and performance of the contract based on the public offer; steps taken at the User's request before entering into the contract; and the Operator's obligations under applicable law.

4. Automated processing and third-party services

To operate the functions of "AIDA", the Operator may entrust data processing to providers that power individual parts of the service: Auth0 — authentication; CloudPayments, Prodamus and Robokassa — payment processing and storage of the payment token; Meta Platforms Ireland Limited — Instagram connection through the official API; HikerAPI — retrieval of publicly available data from public Instagram accounts and posts; Google Gemini, Anthropic (Claude models), DeepSeek and OpenRouter (which passes a request on to the provider of the model that answers it) — automated analysis and generation; Tavily — web search on queries the service composes while preparing a content plan; cloud infrastructure providers — data storage and processing. Each provider receives only the volume of data required to perform the corresponding function.

Ideas, scores, and recommendations may be produced automatically. They do not constitute a decision giving rise to legal consequences for the User and must be verified by the User before publication or any other use.

Usage analytics and session replay

During signup, limited signup steps are stored in this tab for up to 30 minutes and sent only after your account is identified. Admin and excluded test accounts are not tracked. Signup and password screens are never recorded.

We use Amplitude (US data center) to understand feature usage and troubleshoot difficulties in the service. Events include an account identifier, the account email address (if the account has one), page categories, selected actions and their status, plan, language, and browser/device information. Session recordings include clicks, scrolling, page addresses and titles, visible text, images, generated carousels, chat messages, prompts and text you enter in the service. Text and input values are recorded without masking. Authenticated images and fonts may be embedded in the recording so they remain available during playback. Signup, password and external payment screens are outside the recording. API request bodies and console logs are not collected.

Analytics is on for every account except admin and excluded test accounts. Replays are retained for 30 days; analytics data follows our Amplitude plan retention (up to one year on Free). Requests to delete previously collected data may be sent to the privacy contact below. Essential service and security logs remain separate from this choice. Replay also stores local session-timing markers that expire after 24 hours and are pruned when the SDK next starts; they are removed when site data is cleared. A local cache of sanitized replay settings and its fetch time contains no user or event content and has no automatic expiry; it remains until site storage is cleared.

We use Google Analytics (Google LLC, USA) for visit statistics on the website and in the service. The website, sign-in and service pages load a Google script that stores the _ga and _ga_* cookies in your browser for up to two years and sends Google the address of the page you open (for service pages, only the section name, without content identifiers), the referring source and the campaign tags of the link, browser and device information, and an approximate location derived from your IP address. With no account identifier, Google also receives a mark for four steps (an account was created, onboarding was finished, a request to create something was made, a checkout was started) and page-speed measurements (LCP, INP, CLS). When a payment started in such a browser goes through, our server reports it to Google Analytics: the amount, the currency and what was bought, again with no account identifier. Your account identifier, email address and the content of your work are not sent to Google Analytics; advertising features and ad personalization are turned off. Admin visits inside the service are not counted. Data is kept for the retention period set in Google Analytics (up to 14 months). You can opt out with Google's official browser add-on: tools.google.com/dlpage/gaoptout.

5. Disclosure and confidentiality

The Operator does not sell personal data. It is accessible only to the Operator, authorised staff and contractors, the assigned AIDA Max marketer, and the providers listed above — to the extent necessary to deliver the services, ensure security, or comply with legal requirements. Where processors are engaged, the Operator requires confidentiality and protective measures to be observed.

6. Retention periods

Account data and working materials are stored for the duration of the use of the service and thereafter until the expiry of the periods for bringing claims, unless longer retention is required by law. Payment and accounting records are kept for the mandatory statutory periods. Temporary files uploaded for analysis are deleted or anonymised once the task is complete or in accordance with the storage lifecycle rules. Once the purposes of processing have been achieved, data is deleted or anonymised.

7. User rights

The User may request information about the processing of their data, its correction, blocking, or deletion, and may withdraw consent by sending a request to privacy@zarazeu.com. Withdrawal of consent does not affect the lawfulness of processing carried out before it was received and may make the further provision of some services impossible.

The User may disconnect their Instagram account in the service and revoke the app's access in Meta settings. The procedure for deleting an account and the associated data is described on the data deletion page.

8. Data protection

The Operator applies the necessary legal, organisational, and technical protection measures, including access segregation, encryption of access tokens, logging, and monitoring of actions performed on data. The User must keep their sign-in credentials confidential and notify the Operator if unauthorised access is suspected.

9. Contact

Operator: Individual Entrepreneur Zarina Rustamovna Zeusheva, TIN 070108136890, PSRNIE 323774600433670, email: privacy@zarazeu.com, address: 13 Altufyevskoye Highway, bldg. 1, apt. 134, Moscow, 127106.