Privacy policy.
Last updated: October 2026
This page describes how Zynra Agency ("Zynra", "we") processes personal data when you visit zynra.agency or contact us. We comply with the EU General Data Protection Regulation (GDPR), the French Loi Informatique et Libertés, and ePrivacy rules. Zynra Agency acts as data controller.
Controller
Zynra Agency — registered in France. Contact: hello@zynra.agency. Full identification details are provided on the Legal Notice page.
What we collect and why
Contact form (lawful basis: pre-contractual measures, art. 6(1)(b) GDPR): name, email, and optionally phone, company, budget, scope and free-text message — used solely to reply to your enquiry. Security signals (lawful basis: legitimate interest, art. 6(1)(f)): truncated IP address and User-Agent stored with the contact submission to mitigate spam and abuse. Analytics (lawful basis: consent, art. 6(1)(a)): Google Analytics 4 with IP anonymisation, loaded only after you accept analytics cookies. Captcha (lawful basis: legitimate interest): Cloudflare Turnstile to filter automated submissions.
Project space (private portfolio)
To see all our projects, you create an access (legal basis: consent, Art. 6(1)(a) GDPR, given with a checkbox). We collect your first name, last name, e-mail, phone, company (optional) and why you want access, plus your activity in the space: projects viewed and time spent, filters used, clicks on contact buttons, and the steps and answers of the price estimator. This data is only used to contact you about your project in a relevant way; it is never sold or used for advertising. Sign-in uses a code sent by e-mail and a strictly necessary session cookie (z_pv, 30 days). From the “My account” page you can edit your details, download your data (JSON) and delete your account at any time, which also withdraws your consent. After 3 years without activity, the account and its history are deleted automatically.
Zynra Agency iOS app
The Zynra Agency app (App Store) is the portal for our clients and team. Clients sign in with a single-use invitation code. Without a code, anyone can browse our projects and use the cost estimator; a free prospect account (first and last name, e-mail, phone, optional company, interests, verified with a 6-digit e-mail code; lawful basis: your consent and pre-contractual steps, art. 6(1)(a) and (b) GDPR) unlocks the private projects and saves your estimate. For prospect accounts we also record the projects you view, the time spent on them and the buttons you use, only to tailor how we contact you. A prospect account is deleted 3 years after your last activity, or at once in the app (Account → Delete my account), which also deletes your history and saved estimate; Account → Export my data gives you a copy of everything stored. Data processed (lawful basis: performance of the contract, art. 6(1)(b) GDPR): your name and e-mail as entered by us, the client company, chat messages, photos and files you send (from the camera, which only opens when you tap it, or from your photo library and files, which you pick yourself), briefs, task progress, CGV signatures (name, drawn signature, date and IP address) and payments. For notifications and Live Activities we store a device push token, the device model and your language; you can turn notifications off in iOS Settings at any time. Face ID (staff only) is handled by iOS: the app never receives biometric data. The app contains no advertising, analytics, tracking or third-party SDK other than Stripe for payments, and your data is never used to track you across apps. Retention: your app access lasts until you delete it or we revoke it; messages and files stay with the project for the duration of the relationship and up to 3 years after it, contracts and invoices 10 years. Deleting your account: in the app, Account → Delete my account removes your access and signs out your devices immediately; to have your messages and files erased as well, write to hello@zynra.agency (we answer within one month).
Payments
Payments in the app and in the client portal (Apple Pay, card, TWINT…) are processed by Stripe Payments Europe, Ltd. (Ireland), independent controller for the payment data. We never see or store your full card number; we keep the amount, currency, status, date and receipt of each payment (10 years, accounting obligations). Stripe's privacy policy: stripe.com/privacy.
Retention
Contact submissions: kept for up to 3 years after the last interaction unless the relationship becomes contractual. Security signals (IP, User-Agent): truncated on storage and deleted after 12 months. Analytics: retained according to Google Analytics defaults (max. 14 months). Signed contracts and supporting proof of consent: kept up to 10 years as required by French commercial law.
Recipients and processors
We use a minimal number of trusted processors: Resend (transactional email delivery), Cloudflare (Turnstile captcha and edge protection), Google (Analytics — only with consent), and our French hosting provider. Each processor is bound by a Data Processing Agreement. A current sub-processor list is available on request. For the client app and payments we also use Apple (push notifications, Apple Pay) and Stripe (payment processing).
International transfers
Some processors (Google, Resend, Cloudflare) are headquartered in the United States. Transfers rely on the EU–US Data Privacy Framework and on Standard Contractual Clauses where applicable. Analytics transfers only occur if you have given consent.
Your rights
Under GDPR you have the right to access, rectify, erase, restrict, and port your data, and to object to processing based on legitimate interest. You may withdraw consent for analytics at any time via the cookie banner. To exercise these rights, email hello@zynra.agency. We respond within one month. You may also lodge a complaint with the CNIL (cnil.fr).
Security
Data is transmitted over HTTPS. Passwords (internal staff accounts only) are hashed with Argon2id. Two-factor authentication is enforced on staff accounts. We do not sell or rent personal data.
Children
The site is not directed at children under 15 and we do not knowingly collect data from them.
Changes
We may update this policy. Material changes will be highlighted on this page with a new "Last updated" date.