Privacy & Cookie Policy
Last updated: 17 October 2026. This policy explains what personal data we collect when you use the Zoommy website (zoommyapp.com) and the Zoommy desktop app, why we collect it, who we share it with, how long we keep it, and your rights under the EU General Data Protection Regulation (GDPR). Questions? Email dmytro@kontentapps.com.
Who we are
Zoommy is made by Kontent Apps EOOD, a company registered in Bulgaria. Kontent Apps EOOD is the data controller for the personal data described below. You can reach us at dmytro@kontentapps.com.
What data we collect
- Account data: your email address, your password (stored only as a one-way hash, never in plain text), the time and IP address of your current and previous sign-in, and a count of failed sign-in attempts (used to lock the account against password guessing).
- Purchase and licence data: when you buy Zoommy, PayPal sends us your PayPal email address, your PayPal payer ID, the order and payment references, the amount and currency, and the platform you bought for. We create a licence key for you and record the IP address it was activated from. We never see your card or bank details.
- App data: the favorites and collections you save, and the devices linked to your account (device name, operating system and an identifier the app generates for the device), so your library syncs across your computers.
- Messages: the emails you send us and our replies.
- Technical data: server and security logs (IP address, requested address, browser or app version, time of the request).
We do not use analytics, advertising or tracking tools, and we do not build profiles or make automated decisions about you.
Why we use it and our legal basis
- To provide the service (your account, licence activation, syncing favorites and collections, and the emails this requires: licence keys and password resets). Legal basis: performance of our contract with you (GDPR Art. 6(1)(b)).
- To keep purchase records required by Bulgarian accounting and tax law. Legal basis: legal obligation (Art. 6(1)(c)).
- To keep the service secure (sign-in history, account locking, rate limiting, server logs and abuse prevention). Legal basis: our legitimate interest in protecting the service and its users (Art. 6(1)(f)).
- To answer your messages. Legal basis: our legitimate interest in providing support, or our contract with you when the message is about your purchase.
Who we share it with
We do not sell your personal data or share it for advertising. We use these service providers, who process data on our behalf under data processing agreements:
- Oracle Cloud Infrastructure (Oracle): hosts the website, the app's servers and the database in Frankfurt, Germany.
- Cloudflare, Inc.: delivers the website, protects it from attacks and abuse, secures access to our admin tools, and can deliver our emails. Cloudflare runs a global network, so your requests may be handled outside the EU.
- Amazon Web Services (AWS): stores app files and photos (Ireland), stores database backups (United States) and can deliver our emails (Amazon SES).
- Google (Google Workspace): hosts the mailbox that receives your emails to us.
PayPal processes your payment as an independent controller under its own privacy statement.
Transfers outside the EU: Cloudflare, AWS and Google are US companies, and some of the data above (backups in particular) is stored or processed in the United States. These transfers are covered by the EU–US Data Privacy Framework, in which these providers participate, and by the European Commission's Standard Contractual Clauses in their data processing agreements.
How long we keep it
- Account and app data: for as long as your account exists. When you ask us to delete your account, we delete it within 30 days.
- Purchase and licence records: for as long as Bulgarian accounting and tax law requires (currently up to 10 years), even if you delete your account.
- Sign-in IP addresses: only your current and previous sign-in are kept; each new sign-in replaces the oldest.
- Server logs: rotated and deleted automatically, normally within days and never later than 30 days.
- Database backups: deleted automatically after 30 days at most, so deleted data disappears from backups within that time.
- Messages: for as long as we need them to handle your request and any follow-up.
Cookies
We only use cookies that are strictly necessary for the site to work, so they do not need your consent. We use no analytics, advertising or social-media cookies.
| Cookie | Set by | Purpose | Kept for |
|---|---|---|---|
| _zoommie_session | Zoommy | Keeps you signed in and protects forms against forgery. | Until you close your browser |
| cookie_consent | Zoommy | Remembers that you closed the cookie notice. | 1 year |
| __cf_bm | Cloudflare | Tells people apart from bots to protect the site from abuse. | 30 minutes |
| cf_clearance | Cloudflare | Remembers that you passed a security check, if Cloudflare showed you one. | Up to 1 year |
| CF_Authorization | Cloudflare | Signs our staff in to the admin area. Never set for visitors. | Up to 24 hours |
If we ever add optional cookies, we will ask for your consent before setting them.
Your rights
Under the GDPR you have the right to:
- access the personal data we hold about you and get a copy of it;
- have inaccurate data corrected;
- have your account and data erased;
- receive your data in a portable, machine-readable format;
- object to processing based on our legitimate interests, or ask us to restrict it;
- lodge a complaint with a data protection authority. In Bulgaria this is the Commission for Personal Data Protection, but you can also contact the authority in the EU country where you live or work.
To use any of these rights, email dmytro@kontentapps.com from the address linked to your account. We reply within one month.
Children
Zoommy is not intended for children under 16, and we do not knowingly collect their personal data.
Changes to this policy
When we change this policy we update the date at the top. If a change is significant, we will also announce it on the site or by email.