Zemi Privacy Policy

Draft: not yet reviewed by a lawyer. Lawyer review is deferred by the owner (decision of 2026-10-26). This is not legal advice. Sections marked Draft are still being confirmed. Version 1.0, issued 2026-11-06.

Effective date: 2026-11-06
Who we are: Zemi (“we”, “us”, “our”), Zemi Learning Corporation (proposed corporate name), Ontario, Canada. Website at https://www.getzemi.tech.
Privacy officer: the owner of Zemi, reachable at privacy@getzemi.tech.

1. In short

• Zemi runs on your computer. Your files, notes, chats, recordings, memories and flashcards stay on your computer unless you turn on something that sends data.
• When something does leave your computer, Zemi shows you exactly what was sent, in the Privacy centre.
• What leaves your computer is the minimum each feature needs: your question plus a few short snippets from your own material (and a short memory summary). Once chat session state is on, a short note of where you are in that chat can also go with a hosted-AI turn — it can include your last answer, and it is capped at 1,500 characters / 500 tokens. Never whole files. Never recordings.
• We never sell your data, show ads, train AI on your content, or let providers train AI on your hosted-AI content.
• You can use Zemi fully offline, with no account at all.
• You can see, export or delete your data at any time. For your account, email privacy@getzemi.tech.
• Zemi accounts and hosted features are for adults (18 and older) in every region. Local use asks for nothing about your age.

2. Who this is for

This policy covers the Zemi desktop app, your Zemi account (if you make one), and our website at getzemi.tech.

Zemi accounts and hosted features are for adults (18 and older), in every region, with no parent or guardian route. When you make an account we check your age (section 6). If we find out someone under 18 has an account, we delete it.

Zemi is run from Canada. This policy is written to meet Canada’s federal privacy law (PIPEDA) and Quebec’s privacy law (Law 25). It also gives everyone the main rights that US state laws such as California’s CCPA give, and it follows the US children’s privacy law (COPPA) by keeping accounts for adults only.

3. What stays on your computer

Everything below is stored on your computer, in your Zemi profile. We never get a copy.

• Your files, and the text Zemi reads from them (including local OCR).
• The folders you add, and the spreadsheets and tables you open or import. Zemi reads and stores them on your computer. Like any file, only short snippets from them can leave, and only in a hosted-AI question.
• Lecture recordings and their transcripts. Speech-to-text runs on your computer.
• Your courses, units, chats, quests, flashcards, review history, mistake notebook and progress.
• Your memories: what Zemi remembers about your courses and units. You can view, edit and delete them.
• The search index, settings, and the list of everything Zemi has sent out (the outbound log).
• Your optional integrity log, if you turn it on.
• Your own API key, if you add one. It is kept in your operating system’s keychain, not in the Zemi database.

Your key stays in your system keychain, is held in memory by Zemi’s local engine only while Zemi runs, and is sent only to openrouter.ai. It is never in exports, backups, logs or crash reports. Removing it in Zemi takes effect at once; a key deleted in the OS keychain stays in memory until you restart Zemi.

Your profile database is an ordinary database file in your Zemi profile folder. This version of Zemi does not encrypt it on disk. Protect it with your computer’s login and with your operating system’s disk encryption (BitLocker on Windows, FileVault on macOS). Your own API key is kept in your operating system’s keychain, never in the database.

A photo you paste or drop into a chat is read on your computer by the same reading model that reads your files. The photo itself is never uploaded or saved by Zemi; only the text you choose to send with your question goes with it, and the Privacy centre names it in that request.

Because this data lives on your computer, you are in charge of it: back it up, and keep your device and your operating-system account secure. If you delete Zemi’s data from your computer, we cannot recover it for you.

4. What leaves your computer, and when

This table is the whole list. If it isn’t here, Zemi doesn’t send it.

Diagrams Zemi draws. A diagram the tutor adds to an answer (a chart, a flow, a table or a concept map) is drawn on your computer from the answer’s own description. The description travels with the answer you already asked for; drawing it is not a separate request, nothing extra is sent, and the drawing is kept only in your local conversation. The AI illustrations row above is the hosted picture feature, used only when it is switched on and a picture cannot be drawn from a template.

Fully local mode. If you switch on Fully local mode, Zemi blocks all outbound traffic except downloading models. The automatic update check is blocked in this mode too; a manual update check, when it is offered, is blocked in this mode as well. In this mode nothing about you leaves your computer, and you need no account. The block is enforced twice: by Zemi’s own network client, and again underneath it by a guard on the program’s network connections, so a component that tries to connect on its own is stopped unless it is one of the model hosts above, and every connection and refusal is written to the Privacy centre. Zemi’s file reader is blocked from using the network. Connections between Zemi’s own parts on your computer never leave the device and are not listed. Zemi does not use your system’s proxy settings.

What the hosted AI sees. To get an answer from a hosted AI model, your question and snippets must travel through our server to the model provider, so both can read them while the answer is made. Our server checks that only allowed fields are sent (never whole files), counts your usage, and then forgets the content. We keep counts and cost totals, never the text of your questions or answers. The chat-session note travels the same path when hosted AI is on, under zero-data-retention routing.

Chat session state at rest. The chat note is stored on your computer in your Zemi profile (the chat_state table), in the same unencrypted profile database described in section 3, until you delete the chat. It is only sent when hosted AI is on, and only as part of a hosted-AI turn. Anything you remove from chat notes stops being sent at once, is never rebuilt from older stored rows, and shows as [cleared] in the outbound log. Export and delete treat it like the rest of your chat: it is included when you export a chat or your account data, and removed when you delete the chat, delete everything, or close your account.

5. Accounts and age

You only need an account for hosted AI, billing, Education pricing, or the online version when it launches. The app works with no account.

When you make an account we collect: your email address; how you signed in (email link, or Google or Microsoft sign-in, in which case we get your name and email from them); your plan and billing status; usage counts (answers, web lookups, illustrations) so we can apply your plan’s limits; and the devices signed in (so you can sign them out).

When you make an account we ask for your birth month and year and where you live (a province, territory or state). We use your answers once, to check that you are 18 or older, in every region. We keep only a yes and the date you answered; we don’t keep your birth month, birth year or where you live. If the answers show you are under 18, we don’t make the account. If an account was already started (for example with Google or Microsoft sign-in), we delete it right away, with your email address. If an account never answers these questions, we delete it within a day. On the computer you used, Zemi remembers for 24 hours that the answer was refused, so it doesn’t ask again straight away. If we find out later that an account belongs to someone under 18 (for example an account made before 2026-10-28 whose owner does not answer the age question again), we lock it straight away and close it, and cancel any plan and refund as the Subscription Terms say.

Sign-in records. Our sign-in service (Supabase Auth) does not keep your birth month, birth year or region. The app removes those answers from the sign-in record as soon as they are written, and we check the sign-in service’s records and logs for them with count-only checks. Our last check (2026-10-29) found none. Its records keep your email address and sign-in method, as section 6 describes.

6. Who we share data with (our service providers)

We use these companies to run Zemi. They may use your data only to provide their service to us. Each provider we contract with directly is bound by a data processing agreement or equivalent terms with us. AI hosts reached through OpenRouter are OpenRouter’s sub-processors, bound through our data processing agreement with OpenRouter.

AI providers. Zemi sends AI requests through OpenRouter, Inc. (US), which routes them only to zero-data-retention endpoints. Those requests may be processed by these hosts, acting as OpenRouter’s sub-processors: Amazon Web Services (Amazon Bedrock, US and Ireland) for Anthropic Claude models; DeepInfra (US), BaseTen (US) and CoreWeave (US) for open-weight models; and Perplexity (United States, to be confirmed) for optional web research, which receives your search query only. These providers may not keep your requests or use them to train models. Your information may be processed outside your province or country, including in the United States and Ireland, where local law may allow authorities to access it. We’ll update this list before adding a provider.

Draft: OpenRouter’s and Perplexity’s processing locations are still being confirmed with those providers. Everything else in this list, including the hosts’ locations in section 7, is confirmed.

What is sent: your question, short snippets from your course files, and a short study-memory summary — plus the chat-session note when hosted AI is on — never your whole files. For the full data scope, see section 1 (“In short”), the table in section 4 (“What leaves your computer, and when”) and “What the hosted AI sees” in section 4.

Other service providers:

Pictures drawn from a template. Charts, flows, tables and concept maps that Zemi draws from an answer’s own description are made on your computer. They are not sent to any provider and add no sharing of their own; the answer they belong to is covered by the hosted-AI rows above.

We may also share information if the law requires it (for example a court order), to protect someone’s safety, or if Zemi is sold or merged (in which case we will tell you and this policy keeps applying).

Zero data retention. Every hosted AI request, including optional web research with Perplexity Sonar, is sent only to endpoints that have agreed not to store your requests or use them for training. Web research sends only a search query, which Zemi writes and screens for personal details first, never your files. Zemi doesn’t use search plugins that fall outside these protections. If you use your own API key (BYOK), Zemi sends the same zero-data-retention routing request, but retention is governed by your OpenRouter account and terms, and Zemi cannot guarantee it.

7. Where your data is stored

• On your computer: wherever you are.
• Our account database and private storage (Supabase): the United States, Supabase region us-east-1 (US East, N. Virginia). That is outside Canada and outside Quebec.
• Our role mailbox: Zoho Mail hosts our role mailbox in its Canadian data centre (zoho.ca, owner-confirmed 2026-11-02). Zoho may also process mail in other countries where it operates. This is a statement of where the mailbox is hosted, not a residency guarantee. Protection under our contract with Zoho applies, because its data processing agreement is signed.
• Hosted AI: the model hosts are in the United States (Amazon Bedrock in us-east-1 and, as a fallback, eu-west-1 in Ireland; DeepInfra, BaseTen and CoreWeave in the United States). OpenRouter and Perplexity: see the note in section 6.
• Stripe: Canada and the United States. Resend: the United States. Cloudflare: our app downloads and update files are in a United States storage bucket (us-east-1), served through Cloudflare’s network. Some providers may process data elsewhere.

Moving your information outside Canada and Quebec. Most of our online services are in the United States: the account database, the hosted-AI model hosts, and the download bucket. So your account information, and any hosted-AI request you make, may be stored or processed in the United States. US courts, law enforcement and government agencies can ask for access to information held there, under US law, and that law may give less protection than Canadian or Quebec law. To reduce the risk, we:

• keep only the information described in sections 4 and 5, for the periods in section 8, and keep counts of hosted-AI requests rather than their text (section 4);
• use contracts (data processing agreements) with each provider that limit what the provider may do with the information, and with the AI providers the zero-data-retention terms in section 6;
• encrypt connections and stored data, and limit access with access rules and row-level security (section 10).

We assessed this transfer in a privacy impact assessment, as Quebec’s privacy law (Law 25) requires before personal information is sent outside Quebec. If you want to know more, including what is stored in the United States or what our contracts say, contact our privacy officer at privacy@getzemi.tech (section 13).

8. How long we keep things

About the monthly cost totals. Before the hosted-AI request records are deleted at 90 days, we add them up into one line per month, plan and model: how many requests and what they cost us. A line holds no account identifier and no content, so it cannot be looked up by person. We keep these totals to see what the service costs to run. In a month where very few people used a given plan and model, a line may reflect only a few people’s use; it still carries no identifier.

9. Your rights

You can ask us to:

• tell you what we hold about you (access);
• fix it (correction);
• delete it, and close your account;
• give you a copy in a usable format (export);
• stop using it for something you agreed to (withdraw consent);
• explain any decision about you made only by a computer. For example, if an automatic school-email check declines your Education plan, you can ask a person to review it.

How: you do not need us for most of this. The app can export everything (Settings, Privacy & data), delete everything on your computer, and show you what it has sent. For what we keep online, use Settings > Privacy & data > Download my account data (for your safety it asks you to sign in again if you last signed in more than 10 minutes ago). For your account, email privacy@getzemi.tech or use [Settings > Plan & usage > Delete account]. We will answer within 30 days. If we can’t do what you ask, we will tell you why.

If you’re not happy with our answer, you can complain to the Office of the Privacy Commissioner of Canada (priv.gc.ca), or, if you live in Quebec, to the Commission d’accès à l’information du Québec (cai.gouv.qc.ca). US residents can also contact their state attorney general. Please talk to us first if you can. We’d like the chance to fix it.

California residents: we don’t sell or share your personal information (as those words are defined in California law), and we don’t use it to build ad profiles. You can use the rights above, and we won’t treat you worse for using them.

10. Keeping data safe

• The part of Zemi that runs on your computer only listens to your own computer, and only to the Zemi app (it uses a one-time password for each session).
• Zemi can only send out the fields listed in section 4. The server checks that again.
• Files are read in a separate low-privilege process. File text is treated as data, never as instructions.
• Our servers use encrypted connections, access rules, and admin sign-in with two-step verification.
• If something goes wrong with your information, we follow our breach response plan. If there is a real risk of significant harm to you, we will tell you, and the privacy regulator, as soon as we can.
• No system is perfectly safe, and we can’t promise that nothing will ever go wrong.

11. Adults only

Zemi accounts and hosted features are for adults (18 and older), in every region. Local use collects nothing about you and asks nothing about your age. We don’t knowingly keep information from anyone under 18. If the answers at sign-up show you are under 18, we delete the account and keep nothing from the answer. If you think someone under 18 has an account, email privacy@getzemi.tech and we will delete it.

12. Changes to this policy

If we make a material change, we will tell you in the app and by email at least 30 days before it starts, unless the law requires something faster. The date at the top shows the latest version. Earlier versions of this policy are kept on file.

13. Contact

Owner (individual), Privacy Officer, Zemi Learning Corporation, Registered office in Ontario, Canada
privacy@getzemi.tech
support@getzemi.tech