ZooData

GDPR overview

There is nothing to report, and that is itself the finding. Across the sixteen pages archived for this review, terms, privacy policy and acceptable use policy included, the words GDPR, CCPA, data processing agreement, sub-processor and opt-out do not appear once, neither in the visible text nor in the HTML. No Article 27 EU representative is named, no DPA is published or offered on request, and no formal list of sub-processors exists: only Firebase and Stripe are mentioned in passing. No hosting country or region is disclosed. The terms place the contract under the law of the State of Delaware, with thirty days of good-faith negotiation before any legal action. Rights of access, rectification and deletion are announced, but without reference to any regulatory framework. A European controller should treat this silence as an open question rather than as compliance.

Who owns the data?

ZooData's terms draw a clear line. The personal data you provide, namely email, name, usage and query records, payment details handled through Stripe and records of your consent to the acceptable use policy, remains yours: access, correction and deletion can be requested at any time from support@zoodata.ai. The data returned by the API is another matter. ZooData grants the customer no rights in third-party content, including product listings, images, trademarks and copyrighted text owned by the e-commerce platforms referenced through the service. Deciding whether a given use of that content is lawful is explicitly the customer's responsibility. No regulatory framework is invoked anywhere to qualify these rights.

Reuse rights

ZooData states that the data it collects serves to provide and improve the service, process transactions, send technical and support notifications, answer questions and keep compliance records. Two third parties are named: Firebase for authentication and Stripe for payments, each operating under its own policy. Cookies handle sessions and preferences and can be controlled from the browser. Nothing on the site says whether ZooData itself trains models on customer data. On the customer's side the acceptable use policy is restrictive: the retrieved data may not be used to train AI or ML models, to identify or profile individuals, or to reproduce copyrighted content beyond internal analysis, and raw responses may not be redistributed or resold. Reuse is therefore permitted for your own analysis, not for republication.

Data retention & training

Hosting summary

The site publishes nothing about where data is hosted. No country, no region, no data center and no cloud provider for the platform itself is named on any of the sixteen pages reviewed. The privacy policy limits itself to a single sentence on the subject, stating that appropriate security measures are implemented to protect personal information, without one technical or geographic detail. The only third parties identified anywhere are Firebase for authentication and Stripe for payments, each governed by its own policy, and neither is presented as part of a sub-processor list. What can be observed from outside is that the infrastructure is served behind Cloudflare, on an anycast address; that is a network observation made during this review, not a statement by ZooData. The only jurisdictional anchors the company provides itself are its United States base in Sammamish, Washington, and terms governed by the law of the State of Delaware. Anyone with a data residency requirement will have to ask directly, because the published material does not answer the question.