Privacy Policy
Last updated: 29 July 2026
This is an English translation provided for convenience. The French version is the legally binding one and prevails in case of discrepancy.
1. Introduction
This Privacy Policy describes how Zenvy (the “Application”), published by LINCK LABS (the “Publisher”, “we”, “our”), collects, uses, stores and protects the personal data of its users (the “User”, “you”, “your”).
We are committed to respecting your privacy and to processing your personal data in accordance with:
- the General Data Protection Regulation (GDPR — EU Regulation 2016/679);
- the French Data Protection Act (loi Informatique et Libertés), as amended.
Website: https://getzenvy.app
Terms of Use and Sale: https://getzenvy.app/en/terms
Privacy Policy: https://getzenvy.app/en/privacy-policy
2. Data controller
The controller of your personal data is:
LINCK LABS, a French simplified joint-stock company with a sole shareholder (SASU) with share capital of €1,000
Registered office: 47 rue Vivienne, 75002 Paris, France
Trade and Companies Register: Paris 107 722 613 — SIRET: 107 722 613 00018
Legal representative: Mr Thomas Linck, President
Email: getzenvyapp@gmail.com
Linck Labs has not appointed a Data Protection Officer (DPO), as this is not mandatory given its activity. Any request relating to personal data may be sent to the email address above or by post to the registered office.
3. Data we collect
3.1 Identification and account data
| Data | Required | Purpose |
|---|---|---|
| Email address | Yes (for email sign-up) | Account creation, authentication, support |
| Apple ID | If signing in with Apple | Authentication |
| Google ID | If signing in with Google | Authentication |
| First name (or nickname) | Optional (recommended) | Personalisation, in-app communication |
| Age (or age range) | Optional | Personalisation, protection of minors |
| City / time zone | Optional | Personalisation, reminders |
Note: where certain information (first name, age, city, occupation) is not requested in the Application, it is not collected.
3.2 Wellbeing data and preferences (self-declared)
| Data | Purpose |
|---|---|
| Meditation goal | Content personalisation |
| Experience level | Content adaptation |
| Preferred time of day | Reminders (if enabled) |
| Self-reported indicators (e.g. anxiety, sleep, energy) | Personalisation |
3.3 Content you provide
| Data | Retention | Purpose |
|---|---|---|
| Text messages (how you feel today, goals) | Until account deletion (or deletion by you, where available) | Meditation generation and personalisation |
| Transcripts (for voice input) | Until account deletion (or deletion by you, where available) | Meditation generation and personalisation |
| Voice recordings (for voice input) | 7 days (by default) | Transcription and generation |
| Selected tags / themes | Until account deletion | Personalisation |
3.4 Potentially sensitive data
Your messages and/or recordings may reveal information about your emotional state. Depending on their content, such data may qualify as sensitive under the GDPR.
We process it in order to:
- personalise the session;
- detect certain situations of distress where that feature is enabled.
Legal basis:
- Performance of the contract (Art. 6(1)(b)) for generation and personalisation;
- Explicit consent (Art. 9(2)(a)) where the processing involves data that may qualify as sensitive (depending on the use case and your in-app settings).
Where distress detection is active, it is described in section 11.
3.5 Technical and usage data
| Data | Purpose |
|---|---|
| Notification token (e.g. FCM/APNs) | Sending notifications (if enabled) |
| Usage events (analytics) | Improving the Application, statistics |
| Error logs (crashes/logs) | Diagnosing and fixing bugs |
| Technical identifiers (session/device) | Security, operation, fraud prevention |
4. Purposes and legal bases
| Purpose | Legal basis |
|---|---|
| Account creation and management | Performance of the contract (Art. 6(1)(b)) |
| Meditation generation and personalisation | Performance of the contract (Art. 6(1)(b)) |
| Voice features (transcription) | Performance of the contract (Art. 6(1)(b)) |
| Reminder notifications | Consent (Art. 6(1)(a)) |
| User support | Legitimate interest (Art. 6(1)(f)) |
| Product improvement / analytics | Legitimate interest (Art. 6(1)(f)) or consent (depending on settings) |
| Security, fraud prevention, stability | Legitimate interest (Art. 6(1)(f)) |
| Distress detection (if enabled) | Legitimate interest (Art. 6(1)(f)) and/or explicit consent (Art. 9(2)(a)) depending on the data processed |
5. Sharing data with third parties
We never sell your personal data.
5.1 Processors (technical providers)
The Application may rely on the following processors:
| Processor | Role | Data potentially concerned |
|---|---|---|
| OpenAI | Text generation, and possibly transcription/assessment | Messages, transcripts, necessary context data |
| RunPod | Compute hosting (e.g. text-to-speech) | Script text, technical identifiers |
| Supabase | Database, authentication, storage | Account data, content, preferences |
| Firebase / Google | Notifications, analytics (if enabled) | Tokens, usage events |
| Sentry | Errors and crashes | Technical logs, traces |
| PostHog | Product analytics, session recording (app and website) | Usage events, technical identifiers, screen interactions |
| Apple | In-app purchases, authentication (Sign in with Apple) | Transaction data, Apple identifiers |
| Vercel | Hosting of getzenvy.app | Connection logs, IP address |
The exact categories depend on the features enabled and on how you use the Application.
5.2 Purchases and subscriptions (App Store / Google Play)
Payments and subscription management are operated by Apple (iOS) or Google (Android).
We have no access to your payment card details. Apple and Google may pass on transaction status information (e.g. subscription active or inactive) through the mechanisms they provide to developers.
5.3 Transfers outside the EU
Some providers may process data outside the European Economic Area (in particular in the United States). Where that is the case, we put in place compliant transfer mechanisms (for example Standard Contractual Clauses and/or equivalent mechanisms depending on the provider), together with additional safeguards where necessary.
6. Retention periods
| Data type | Retention |
|---|---|
| Account and profile | Until account deletion |
| Messages / transcripts | Until account deletion (or manual deletion, where available) |
| Voice recordings | 7 days |
| Generated audio | 30 days (by default) |
| Analytics events | A period proportionate to the purpose (by default: up to 13 months where applicable) |
| Technical / error logs | The limited period needed for diagnosis (by default: up to 90 days) |
| Notification tokens | Until disabled, reinstalled, or the account is deleted |
When your account is deleted, the data is erased within a maximum of 30 days, unless a legal retention obligation applies or evidence must be preserved (e.g. fraud prevention), within strict limits.
7. Security
We implement reasonable technical and organisational measures, including:
- access control and restrictions on data access;
- encryption in transit (HTTPS/TLS);
- environment separation and secure key management;
- protection mechanisms and logging;
- database-level access rules (e.g. per-user access policies where available);
- minimising the data sent to third-party services.
As no system is infallible, we cannot guarantee absolute security, but we undertake to react promptly in the event of an incident.
8. Your rights (GDPR)
You have the following rights:
- access (Art. 15), rectification (Art. 16),
- erasure (Art. 17), restriction (Art. 18),
- portability (Art. 20),
- objection (Art. 21),
- withdrawal of consent (Art. 7(3)) where processing is based on consent.
8.1 Exercising your rights
You may:
- delete your account from within the Application (where available), or
- write to us at getzenvyapp@gmail.com, or by post to Linck Labs, 47 rue Vivienne, 75002 Paris, France.
We respond within one month of receiving your request (extendable in the cases provided for by the GDPR).
8.2 Complaint to the CNIL
You may lodge a complaint with the French data protection authority (CNIL):
If you are in another EU or EEA country, you may also lodge a complaint with your local supervisory authority.
9. Cookies and trackers
The mobile Application does not use cookies in the traditional web sense. However, some SDKs may use technical identifiers (e.g. analytics instance, notification token, session identifiers) for:
- analytics (if enabled);
- notifications;
- error diagnosis.
You can disable notifications in your iOS or Android settings.
10. Protection of minors
The Application is intended for people aged 15 or over.
We do not knowingly collect personal data from children under 15. If we discover that a child under 15 has provided us with data, we will delete it as soon as possible.
For minors aged 15 to 18, use is subject to the applicable legal framework and, where relevant, to authorisation by a legal guardian.
11. Automated decisions, profiling and distress detection (if enabled)
11.1 AI personalisation
The Application personalises meditations based on the information you provide (profile, preferences, messages). This constitutes a form of profiling in the broad sense, used solely to adapt content, and produces no legal effects.
11.2 Distress detection (if enabled)
Where the Application offers automated detection of signs of distress, it may:
- classify messages by level (e.g. none / mild / moderate / crisis);
- display support resources (e.g. 988 in the United States, 116 123 in the United Kingdom, 3114 in France).
Important: this detection is not a medical device, may produce false positives or false negatives, and is not a substitute for a healthcare professional.
12. Changes to this Policy
We may amend this Privacy Policy at any time.
In the event of a substantial change, we may inform you through the Application. The applicable version is the one published at: https://getzenvy.app/en/privacy-policy
13. Contact
For any question about privacy, or to exercise your rights:
LINCK LABS — 47 rue Vivienne, 75002 Paris, France
Email: getzenvyapp@gmail.com
Website: https://getzenvy.app