ZYMIX Privacy Policy

Last updated: September 2026

1. Who We Are

ZYMIX is a social and community platform for user interaction, content sharing, social discovery, messaging, and community engagement. The platform is operated by:

Company	FLICKNMIX LTD
Registered address	15 Fitzroy Street, London, England, W1T 4DG
Privacy contact	privacy@zymix.ai
Support contact	support@zymix.ai
ICO registration	Registered with the UK Information Commissioner's Office as a data controller.

Throughout this policy, 'ZYMIX', 'we', 'us', and 'our' refer to FLICKNMIX LTD. 'You' means anyone who uses the ZYMIX app, website, or related services (together, the 'Platform').

As data controller, we decide how and why your personal data is used. This carries legal responsibilities under the UK GDPR, the UK Data Protection Act 2018 and, where applicable, the EU GDPR, and we take those responsibilities seriously.

2. What Information We Collect

We only collect information that we genuinely need. Here is a full account of what we collect and how.

2.1 Information you give us

• Registration details — your phone number or email address when you create an account, together with your confirmation that you are 18 or over.
• Profile information — your nickname, username, profile photo, bio, date of birth, and any other details you choose to add to your profile.
• Content you post — text, photos, images, audio, and video content you upload or share on the Platform.
• Messages — content sent through the Platform's direct messaging features.
• Correspondence with us — information you provide when contacting support, submitting feedback, making a complaint, or responding to a survey.
• Event and promotion participation — information you submit when taking part in ZYMIX events, contests, challenges, or promotions.
• Payment information — if you make or receive a payment through the Platform, relevant financial details processed securely through our payment provider (currently Mangopay).

2.2 Information collected automatically

When you use the Platform, we and our service providers automatically collect the following:

• Device information — device type, operating system, device identifiers, app version, and browser type.
• Usage and activity data — features you use, content you view or interact with, time and duration of activity, search terms, and engagement patterns, including your activity in any mini apps and mini games within the Platform.
• Log data — IP address, access times, screens or pages visited, and error logs.
• Location information — if you enable location features, we may collect your precise or approximate location. You can control this through your device settings at any time.
• Behavioural data — how you interact with content, other users, and recommendations on the Platform. This feeds our personalisation and recommendation systems (see Section 9).
• Analytics data — collected via analytics tools and SDKs to help us understand how the Platform is used and where to improve it. Only with your consent do we collect marketing attribution data, which helps us understand which advertising campaign led you to install ZYMIX (see Sections 3, 6.1 and 11).

2.3 Information from your contacts

If you give us permission, we can access your device's contact list to help you find people you know on ZYMIX. We always ask before accessing your contacts. You can withdraw permission at any time through your device settings.

2.4 Information from third-party services

Some information about you reaches us from services operated by other organisations. For example, on supported Apple devices we may also receive an age range associated with your Apple Account through Apple’s Declared Age Range API (see Section 2.7).

2.5 Moderation-related information

If you report content or another user, or if content you have posted is reported to us, we collect information about that report and any moderation review that follows. See Section 12 for more on how moderation works.

2.6 Apple Health Data (Health Agent)

If you choose to connect Apple Health to your Health Agent, ZYMIX reads the following seven daily summary metrics from Apple HealthKit, depending on which ones you allow: step count, walking and running distance, active energy burned, exercise minutes, total sleep duration, average resting heart rate, and water intake.

How collection works. Health data is read only after you explicitly connect Apple Health in App Connectors and grant permission through the iOS Health authorization screen. ZYMIX is read-only and never writes any data to Apple Health. We collect daily aggregated summaries only — we do not collect raw samples, real-time heart rate, workout routes, or sleep-stage details (such as deep or REM sleep). We process this data on the basis of your explicit consent (Article 6(1)(a) and 9(2)(a) of the UK GDPR and EU GDPR), which you may withdraw at any time by disconnecting Apple Health. You can use ZYMIX without connecting Apple Health.

How we use it. Your health summaries are transmitted securely to our servers and used solely to power your Health Agent conversations. We do not use health data for advertising, marketing, or data mining; we do not use it to build advertising profiles; we do not use it to train AI models; and we never sell it or share it with advertisers or data brokers.

Third-party AI processing. To generate Health Agent responses, your health summaries are processed through OpenRouter, which provides the AI infrastructure used by the Health Agent. OpenRouter and the model provider act as our data processors under contractual confidentiality and data-protection obligations. They are prohibited from using your health data for their own purposes, including the training of AI models. We configure the services used for the Health Agent so that health data is not used to train general-purpose AI models. These providers may process your data outside of the UK and EEA, including in the United States; the safeguards we apply to such transfer are described in Section 7 (International Data Transfers) of this policy.

Retention and deletion. We retain health summaries for as long as your Apple Health connection remains active. When you disconnect Apple Health in App Connectors, we stop collecting health data immediately and delete health summaries from our active systems. Backup copies are deleted according to our backup retention schedule. You can also revoke ZYMIX’s access at any time in the iOS Health app (Profile > Privacy > Apps > ZYMIX) or in Settings > Privacy & Security > Health. If you delete your ZYMIX account, health summaries stored on our servers are deleted in accordance with Section 8 (How Long We Keep Your Information) of this policy.

2.7 Age assurance (Apple Declared Age Range)

ZYMIX is intended only for users aged 18 or over, as stated in our Terms of Use. When registering for a ZYMIX account, users are required to confirm that they are at least 18 years old. This initial age confirmation is based on information provided by the user and does not, by itself, constitute independent age verification.

As an additional input to our age-assurance process, on supported Apple devices ZYMIX may receive an age range associated with a user’s Apple Account through Apple’s Declared Age Range API, where this information is shared by the user or, where applicable, a parent or guardian, or otherwise made available by Apple where required under applicable law. The age range is based on age information provided to Apple by the user or their parent or guardian and, in some cases, may have been confirmed using an age-assurance method supported by Apple. ZYMIX does not independently verify the underlying Apple Account age information, and the Declared Age Range signal does not by itself establish that a user has completed ZYMIX’s own independent age-verification process. Where this signal is not available or not shared, ZYMIX does not treat its absence as confirmation that the user meets the minimum age requirement.

Where age information made available to ZYMIX, whether from Apple’s Declared Age Range API or from other age-assurance measures applied by ZYMIX, indicates that a user is under 18, the user may be prevented from accessing ZYMIX or relevant services in accordance with our Terms of Use and applicable age-assurance requirements.

3. How We Use Your Information

We only use your personal data where we have a valid legal reason to do so — known as a 'lawful basis'. The table below explains the lawful bases we rely on and when we use each one.

Lawful basis	When and why we use it
Contract	Running the Platform, specifically: Creating and managing your account, and delivering the core features you sign up for, including posting, messaging, communities and events, self-developed mini apps and mini games, and payments. Sending service communications about your account and activity. Providing the Health Agent where you choose to connect Apple Health (the health data itself is processed only with your explicit consent, see below).
Legitimate interests	Personalising your experience and recommending content, people and events (you can object, see Section 9). Improving the Platform: developing and testing features, diagnosing and fixing technical problems, and analysing how the Platform is used. Keeping the Platform safe: using AI tools (provided by Checkstep) and human moderators to detect harmful content and conduct, investigating abuse and safety reports, and maintaining records to enforce bans, where this goes beyond what the law requires of us. Age assurance: applying age-assurance measures and restricting accounts that have not completed them, to keep under-18s off the Platform. Preventing fraud and abuse and securing our systems. Enforcing our Terms of Use, and handling complaints and legal claims.
Consent	Marketing communications. Analytics or behavioural cookies and SDKs beyond what is essential (see Section 11). Accessing your device contacts or your location. Advertising attribution and measurement, and audience-matching advertising tools (see Section 6.1). Apple Health data used by the Health Agent is based on explicit consent, which you can withdraw at any time by disconnecting Apple Health (see Section 2.6). We will always ask before relying on consent, and you can withdraw it at any time.
Legal obligation	Content moderation and reporting duties under the UK Online Safety Act 2023 and, where applicable, the EU Digital Services Act, including assessing and removing illegal content, handling reports and appeals, and keeping the records these laws require (see Section 12). Age assurance and children’s-safety duties under the Online Safety Act, including checking that users are 18 or over before they can access restricted features (see Section 10). Financial, tax and anti-money-laundering record-keeping in connection with payments. Responding to lawful requests from courts, regulators and law enforcement, and complying with data protection law itself, for example, handling your rights requests.
Vital interests	Protecting someone’s life or physical safety in urgent circumstances, for example, escalating a credible risk of serious harm to the emergency services.

4. Your Rights

Under UK and EU data protection law, you have a number of important rights over your personal data. These are set out below. To exercise any of them, contact us at privacy@zymix.ai or use the relevant in-app tools. We will respond within one calendar month.

Your right	What it means in practice
Right to access	Ask us for a copy of all the personal data we hold about you, along with details of how and why we use it.
Right to rectification	If any information we hold is inaccurate or incomplete, ask us to correct it. You can also update most profile details directly within the app.
Right to erasure	Ask us to delete your personal data. For example, where it is no longer needed for the purpose it was collected, or where you withdraw consent. To delete your account: Me > Account > Delete Account, or email us. We may retain some data where legally required (e.g. financial records, safety records). A 30-day cancellation window applies to account-deletion requests (see Section 8).
Right to data portability	Where we process your data based on consent or contract, ask us to provide it in a structured, machine-readable format, or to transfer it directly to another provider where technically possible.
Right to restriction	Ask us to pause or limit processing of your data. For example, while we investigate a dispute about its accuracy.
Right to object	Object to us processing your data based on our legitimate interests, including for profiling and recommendations. We will stop unless we have compelling grounds that override your interests.
Right to withdraw consent	Withdraw any consent you have given at any time. This does not affect anything that happened before you withdrew it.
Automated decisions	Where we make decisions about you based solely on automated processing that have a significant effect on you, ask for human review, express your view, or challenge the decision.
Right to complain	Lodge a complaint with the UK ICO (ico.org.uk / 0303 123 1113) or, if you are in the EU, with your local data protection authority. We would always welcome the chance to resolve your concern first — please email privacy@zymix.ai.

5. What Others Can See

ZYMIX is a social platform, so some of your information is visible to other users. This section explains what is public and what you can control.

5.1 Default visibility

• Your username and profile photo are visible to other users and may be publicly searchable depending on your settings.
• Content you post publicly — photos, videos, text, and other posts — is visible to all users on the Platform.
• Your interactions with public content may be visible to other users in certain contexts.

5.2 Location and nearby discovery

ZYMIX currently offers, and intends to develop further, features that allow you to discover other users nearby. If you enable location or proximity-based features:

• Your approximate location may be visible to other users within that feature.
• You may become discoverable to users near you.

Location sharing is always opt-in. We will ask for your explicit permission before enabling it, and you can turn it off at any time through your device settings or within the app.

Accounts that have not completed age assurance: Location and proximity-based features are off by default and are not available. We strongly encourage you to keep location features switched off unless you actively choose to use them. You can contact us at privacy@zymix.ai at any time if you have concerns about location settings.

5.3 Privacy controls

We offer settings within the Platform to control who can see your profile, content, and activity. These controls are expanding as the Platform develops. We encourage you to review your privacy settings regularly and to think carefully about what you share publicly.

6. Who We Share Your Information With

We do not sell your personal data to anyone. We may share it in the following circumstances:

6.1 Third-party service providers

We use trusted third-party companies to help run ZYMIX. The table below lists our main providers, what they do for us, and the personal data involved. Providers marked as processors act only on our instructions and are contractually required to keep your information secure; those marked as independent controllers decide how they use the data under their own privacy policies. Some providers are located outside the UK and the EEA (including in the United States); the safeguards we apply are described in Section 7.

Provider	What they do for us	Personal data shared	Role
Amazon Web Services (London, UK)	Infrastructure hosting	Account information, profile data, user-generated content, messages and application logs	Processor
Tencent Cloud Infrastructure (Frankfurt, Germany)	Cloud storage and database services	Account information, profile data, user-generated content, messages and application logs	Processor
Cloudflare	Content delivery and network security	IP address, device and connection data, and network traffic data	Processor
Twilio	Phone verification (SMS codes) and messaging	Phone number	Processor
Agora	Real-time voice and video	Voice and video streams, session identifiers, device and connection data	Processor
Sentry	Error monitoring	IP address, device and app information, and error logs which may include your ZYMIX user ID	Processor
Axiom	Logging and performance monitoring	Log data, device information, and IP address	Processor
Resend	Transactional email	Email address and the content of service emails	Processor
AssemblyAI	Audio transcription	Audio content you upload or send, for transcription	Processor
Checkstep	Content moderation — AI screening and moderation tooling (see Section 12)	Content you post, reported messages, moderation reports and account identifiers	Processor
Yoti	Facial age estimation (see Section 10)	A selfie image, processed to estimate your age band; we receive only the age band and a timestamp	Processor
OpenRouter (and the AI model providers, OpenAI, it routes to)	AI inference for the Health Agent (see Section 2.6)	The Apple Health daily summaries you connect and your Health Agent conversation content	Processor
Adjust	Advertising attribution and measurement	Device identifiers, IP address, and install, session and in-app event data	Processor
Mangopay	Payments, wallet and identity verification (KYC) (see Section 10)	Payment and transaction details, and the KYC information you give Mangopay; we receive only the KYC outcome	Independent controller
Meta Platforms	Advertising measurement and audience matching	Device identifiers, session and event data, and hashed identifiers for audience matching	Independent controller (joint controller for audience matching)

6.2 Other users

Information you choose to make public — your profile, username, and public posts — is visible to other users of the Platform as described in Section 5. Please think carefully about what you share.

6.3 Law enforcement and regulatory authorities

We may share your information with regulators, law enforcement agencies, courts, or other public authorities where we are legally required to do so, or where we reasonably believe it is necessary to:

• comply with a legal obligation, court order, or regulatory requirement;
• enforce our Terms of Use or investigate suspected violations;
• investigate or respond to suspected illegal activity, fraud, or platform misuse;
• protect the safety of any person; or
• protect the rights, property, or security of ZYMIX, our users, or the public.

6.4 Business transfers

If FLICKNMIX LTD is involved in a merger, acquisition, restructuring, or sale of assets, your personal data may be transferred as part of that transaction. We will take reasonable steps to ensure any such transfer is subject to appropriate protections and that you are informed of any material changes to how your information is handled.

6.5 Research and other business partners (aggregated or anonymised data only)

We may share aggregated or anonymised information — data that cannot reasonably be used to identify you — with research, analytics and business partners for research, analysis, or business purposes.

7. International Data Transfers

Your personal data is stored and processed primarily in the United Kingdom and the EU. Some of our service providers are located in other countries, including the United States. Where personal data is transferred outside the UK or the EEA, we ensure that appropriate safeguards are in place before any transfer takes place. These may include:

• UK International Data Transfer Agreements (IDTAs), EU Standard Contractual Clauses (SCCs), or UK International Data Transfer Addendum to EU SCCs (UK Addendum);
• an adequacy decision by the UK Government or European Commission confirming that the destination country provides adequate protection; or
• other transfer mechanisms permitted under applicable data protection law.

We will update this section if our international transfer arrangements change.

8. How Long We Keep Your Information

We keep your personal data for as long as we genuinely need it. The table below sets out our approach by data type.

Type of information	How long we keep it
Account and profile information	While your account is open. Deleted when your account deletion completes (see below), except where the law requires us to keep it.
Content you have posted	Until you delete it or your account is deleted. Some content may be retained longer after deletion for safety reasons.
Payment and transaction records	Up to 7 years, required by financial and tax law.
Moderation and safety records	As long as necessary for the relevant safety, security, legal, or enforcement purpose, including preventing re-registration after a ban. Generally, no longer than 3 years.
Analytics and usage data	Generally, no longer than 24 months. Aggregated or anonymised data may be retained for longer.
Contact list	While your permission remains in place; deleted when you withdraw it or when your account deletion completes.
Apple Health summaries (Health Agent)	While your Apple Health connection remains active; deleted when you disconnect Apple Health or when your account deletion completes (see Section 2.6).
Age-assurance results	While your account is open. Deleted when your account deletion completes (see Section 10).
Legal compliance records	As long as required by applicable law or regulation.

To delete your account, go to Me > Account > Delete Account in the app, or email privacy@zymix.ai. When you submit a deletion request, you then have 30 days to cancel it — if you change your mind within that window, your account can be restored. Once the 30 days have passed, the deletion process will be initiated, and your account cannot be recovered. It may take up to 90 days from the beginning of the deletion process to complete it. While we’re deleting your account, it's not visible or accessible to other users.

9. Recommendations, Profiling and AI

ZYMIX uses automated systems to personalise your experience and to keep the Platform safe. This section explains what those systems do and how they affect you.

9.1 Content recommendations

Our recommendation system analyses your activity on the Platform — what you engage with, what you skip, how you interact with other users — to suggest content, people, and events you are likely to find interesting. This is a form of automated profiling. Our recommendations are currently based on your activity within ZYMIX only. We do not currently use third-party data for this purpose.

Recommendations and profiling are off by default for accounts that have not completed age assurance. You can object to profiling or modify your personalisation settings at any time by using in-app tools or contacting us at privacy@zymix.ai.

9.2 AI-assisted moderation

We use AI-powered tools (provided by Checkstep) alongside human moderators to help keep the Platform safe. To avoid setting out the same information twice, full details of how our content moderation works are set out in Section 12.

9.3 AI-enabled Health Agent

The Health Agent uses AI models to generate responses based on the Apple Health summaries you choose to connect. It provides general wellbeing information only and does not make decisions about you that have legal or similarly significant effects. Section 2.6 explains the data involved, and Section 3.8 of our Terms of Use explains the limits of relying on it.

10. Minimum Age and Age Assurance

ZYMIX is intended for adults. You must be 18 or over to use the Platform. We use age-assurance measures and other safeguards designed to keep the Platform safe and to help prevent under-18s from using it. Our age and safety measures include:

• Facial age-estimation technology provided by our age-assurance partner (Yoti) is used to help confirm that users are 18 or over before they access restricted features or adult content. Yoti processes your selfie on our behalf and returns only an age-band label; we do not receive or store your image. We keep the label together with a timestamp and delete when your account deletion completes (see Section 8).
• Where you have completed identity verification (KYC) checks with our payment partner (Mangopay) in order to use payment features, we may rely on the outcome of that verification instead of asking you to complete a separate age check. In that case we receive and store only confirmation of whether your verification indicates that you are 18 or over, together with the date of the check, never your date of birth, your identity documents, or the underlying information you provided to Mangopay, and we delete it when your account deletion completes (see Section 8).
• Content reporting tools so you can flag harmful content or interactions directly within the app.
• A moderation team that reviews all reports and escalates serious safety concerns, including any safeguarding concerns, as a priority.
• A complaints and appeals process for age-estimation/moderation decisions, details of which are available within the app.
• Where we confirm that an account belongs to someone under 18, we close it immediately and delete the associated personal data following the deletion process described in Section 8 but without the 30-day cancellation window.

Until you complete age assurance, your account has limited access:

• Short videos and your feed — you can only see content from a restricted pool that has been screened as suitable for all ages, and recommendations are not personalised (see Section 9.1).
• Contact with people you do not know — features that involve contact with people you are not already connected with, such as Shake and Groups Nearby, are unavailable.
• Location — features that require your location are unavailable (see Section 5.2).
• Posting — you cannot post content until you have completed age assurance. You can still browse public content and set your profile fields to public.

We are developing an always-available option in the app that lets you complete age assurance at any time. Until it is released, we prompt you to verify when you first try to use a restricted feature.

On supported Apple devices we may also receive an age range associated with your Apple Account through Apple’s Declared Age Range API as an additional input to our age-assurance process. This signal does not by itself constitute independent age verification. See Section 2.7 of this policy for details.

If you are a parent or guardian with a concern, or if you believe a user under 18 is on the Platform, please contact us at privacy@zymix.ai. We will investigate and take appropriate action promptly.

11. Cookies and Tracking Technologies

11.1 What cookies are

Cookies are small text files stored on your device when you use the Platform. They help the Platform function, remember your preferences, and tell us how the Platform is being used. Similar technologies — including SDKs (software development kits built into the app), pixels, and device identifiers — work in a similar way and are covered by this section.

11.2 Types of cookies we use

Type	Your choice	What it does
Essential	Always on — cannot be switched off	Keeps you logged in, maintains session security, and enables core Platform features.
Analytics	We ask for your consent	Helps us understand how the Platform is being used so we can improve it. Collected via analytics tools and SDKs.
Behavioural / Preference	We ask for your consent	Remembers your settings and preferences and supports the personalisation of your experience.
Advertising	We ask for your consent	We use attribution and advertising-measurement technologies to measure how our advertising campaigns perform and to support ZYMIX’s advertising on advertising networks such as Meta. We do not show third-party advertising inside ZYMIX.

11.3 Managing your preferences

You cannot opt out of essential cookies, as these are required for the Platform to function. For all other cookies and tracking technologies, you can manage your preferences through the settings within the app, your device's privacy controls, or by contacting us at privacy@zymix.ai. Please note that disabling certain technologies may affect some features of the Platform.

12. Moderation and Online Safety

Keeping ZYMIX safe is one of our most important responsibilities. Here is how we approach it.

12.1 How moderation works

We use a combination of automated AI tools and human moderators to review content on the Platform. In practice, this means:

• AI tools provided by our content-moderation partner (Checkstep) automatically scan content, including text, images, audio, and video, for potential policy violations and harmful material.
• Human moderators review content flagged by the automated systems and handle all serious or disputed cases.
• User reports submitted through the app's reporting tools are reviewed by the moderation team.
• Serious safety concerns, including potential illegal content, are escalated to internal teams and, where required, to law enforcement or regulatory authorities.

12.2 Reporting harmful content

You can report any content or user you believe is violating our Terms of use or applicable law using the reporting tools within the app. We take all reports seriously and aim to respond promptly.

12.3 Appealing a moderation decision

If we remove your content, restrict your account, or take other enforcement action, you may be able to appeal that decision through the complaints and appeals process in the app. We will provide further details about this process within the Platform.

12.4 UK Online Safety Act 2023

As a user-to-user service accessible in the United Kingdom, ZYMIX is subject to the UK Online Safety Act 2023. This means we have legal duties relating to illegal content, children's safety, user reporting, and transparency. Our compliance programme is ongoing and we will continue to develop our practices as our obligations become fully applicable.

12.5 EU Digital Services Act

Where ZYMIX is accessible to users in the EU, relevant requirements of the EU Digital Services Act (DSA) apply — including obligations relating to content moderation transparency, recommender systems, and user redress. We are working towards full DSA compliance and will provide further information within the Platform as applicable.

13. Security

We take the security of your personal data seriously. The measures we currently have in place include:

• Access controls — personal data is accessible only to authorised personnel, and only to the extent required for their role.
• Encryption — we encrypt the transmission of personal data between your device and our systems.
• Monitoring and logging — we maintain logs and monitoring to detect and respond to security incidents.

No system is completely immune to security risks. While we work hard to protect your data, we cannot guarantee absolute security. Keeping your account credentials secure also helps protect your data; your responsibilities in this respect are set out in our Terms of Use. If you believe your account has been compromised, please contact us at privacy@zymix.ai immediately.

14. Third-Party Links and Services

The Platform may contain links to third-party websites, apps, or services. This Privacy Policy does not apply to those third parties, and we are not responsible for how they collect or use your information. We encourage you to check the privacy policies of any third-party services before sharing information with them.

15. Changes to This Policy

We may update this Privacy Policy from time to time — to reflect changes in the Platform, in how we use personal data, or in applicable law.

If we make a significant change, we will notify you through the app or by other appropriate means before the change takes effect. The 'last updated' date at the top of this document always reflects when the policy was most recently revised.

The updated policy applies from the date shown at the top of this document. If you are not comfortable with how we handle your data after a change, you can exercise your rights (see Section 4), stop using the Platform, or delete your account.

16. Contact Us

If you have any questions, concerns, or requests about this Privacy Policy or the way we process your personal data, please get in touch: