Zoviz

GDPR overview

GDPR compliance rests on a data processing addendum (v1.0, effective 31 August 2026) that is incorporated automatically, without signature, and is written to satisfy Article 28(3). It also covers the UK GDPR and Data Protection Act 2018, the Swiss FADP and US state laws including CCPA/CPRA. Transfers rely on the 2021/914 Standard Contractual Clauses, modules 2 and 3, the UK Addendum B1.0 and a Swiss adaptation. Zoviz commits to assisting with data subject requests, with Articles 32 to 36, with the Article 30(2) record, breach notification, cooperation with supervisory authorities and audits capped at once a year; the product itself lets users retrieve, correct, export and delete. Two limits: Zoviz appoints no EU representative under Article 27 for itself, and the consumer-facing privacy policy never mentions the GDPR, so the entire framework sits in the DPA.

Who owns the data?

Zoviz splits ownership in two. Under section 5 of the terms, business names, trademarks and other intellectual property arising from the content you supply remain your exclusive property. Under section 4, the platform itself, its software, images, text, graphics and Zoviz's own logos, stays Zoviz's. Once a logo is purchased, the licensing page states that you hold copyright over it for the lifetime of the business, with full commercial use and no royalty, although you cannot claim ownership of isolated elements such as individual symbols or fonts unless the whole is original. For personal data, the DPA makes Zoviz a processor acting on the customer's instructions, and the customer stays responsible for the lawfulness of what it submits.

Reuse rights

Purchased assets can be reused without asking again: the lifetime commercial license covers one registered brand, carries no royalty and imposes no further permission, the icon being the only element that can no longer be altered. On Zoviz's side, the privacy policy lists service delivery, account information, contract performance, improvement of the site and services, and marketing as purposes, and allows disclosure to service providers and authorities, plus unrestricted use of aggregated data. Advertising cookies may link sign-up data to browsing data for targeted advertising, with consent. The DPA is stricter: processing follows the customer's documented instructions only, and clause 4.6 forbids Zoviz and its subprocessors from training, retraining or fine-tuning general-purpose AI or machine learning models on customer personal data without prior written consent, while aggregated or de-identified data may be used to operate, secure and improve the service. Annex I confirms that automated analysis by AI models is part of how assets are generated and edited.

Data retention & training

Hosting summary

Zoviz is established in the United States and processes customer data there (DPA 9.1). The services run on Microsoft Azure, in data centers holding ISO 27001, SOC 1 and SOC 2 attestations, which are the host's certifications rather than Zoviz's own. Annex III names the subprocessors: Microsoft Corporation for Azure in the United States, Cloudflare Inc. for the global edge network with US headquarters, Stripe Inc. in the United States with Stripe Payments Europe Ltd in Ireland handling EEA customers, and third-party AI model providers in the United States. Data is encrypted in transit with TLS 1.2 or above and at rest with AES-256, using keys managed by the cloud provider. Transfers out of the EEA, the United Kingdom and Switzerland are covered by the 2021/914 Standard Contractual Clauses, the UK Addendum B1.0 and the Swiss FADP adaptation. In short, a US jurisdiction with a documented transfer framework, and a single European touchpoint that concerns billing only.