Hey Zuzu · BRUTANIX

Privacy Policy

Effective: 1 October 2026 · Last updated: 1 October 2026

1. Information we collect

• Account and connection details: Instagram identifiers and available profile information, your linked WhatsApp number, optional name and email, connection verification records, consent choices and timezone.
• Content you send or save: messages to Zuzu, Reel links, notes, collections, questions, reminder instructions and available media metadata. Where accessible, we process Reel video, audio, captions and sampled images, and store transcripts, summaries and other generated context.
• Service records: message identifiers and timestamps, processing results, reminder schedules, delivery receipts, sign-in sessions, errors and security records.
• Website and support information: ordinary request information, such as IP address, browser and access time, and information you include in support correspondence.

We receive this information from you, connected platforms and content you ask us to process. We do not ask for your Instagram or WhatsApp password. Sending a link does not give us access to private content or permission to bypass access restrictions.

2. How we use information

We use it to create and protect your account, connect your channels, save and organize your library, transcribe and analyze accessible Reels, answer questions about saved content, deliver reminders you request, handle support and deletion requests, and diagnose failures or abuse. We do not sell personal information or use saved content for targeted advertising.

Optional connections are your choice. WhatsApp reminders require a verified connection and your permission. You can withdraw that permission by sending STOP on WhatsApp or disconnecting in account settings. Stopping reminders is separate from deleting your account data.

3. AI processing

When Sarvam transcription is enabled, Reel audio is sent to Sarvam AI to generate a transcript. Configured local models may process transcripts and sampled video frames to produce summaries and answers. We store the resulting context with the relevant saved item and keep your personal notes associated with your account.

BRUTANIX does not currently train its own general-purpose AI models on your private messages or saved library. External provider handling, retention and any model-improvement use depend on the provider’s applicable terms and account configuration; we do not promise that every provider uses zero retention. See Sarvam’s privacy information. AI output can be inaccurate, including for mixed-language audio, names, dates and links; verify important details against the original source.

4. Service providers and disclosures

• Meta: Instagram and WhatsApp message delivery, platform identifiers and connection events.
• Sarvam AI: audio transcription when enabled.
• Vercel: public website hosting and related delivery and security logs.
• Cloudflare: connection routing when used, including temporary connections for limited-access sessions.

Our current limited-access service stores application records and media on BRUTANIX-controlled systems, including local development infrastructure. Authorized personnel may access records to operate the service, resolve support requests and investigate errors. Providers may process data outside your country. We may also disclose information where legally required or necessary to protect users and the service.

5. Cookies and account access

The authenticated library uses session cookies for sign-in. Private sign-in links expire and are single-use; do not forward them. The public website does not currently include advertising trackers or an added third-party analytics script. Hosting and messaging providers operate their own services under their own policies.

6. Retention

We keep saved items, notes, transcripts, linked identities and reminders while they are needed to provide your library and requested services. The current service does not automatically expire all stored records. You can request deletion at any time. Operational records and backups may require separate removal; we will explain any remaining retention and its reason when handling your request. We do not promise immediate erasure from every backup or independently operated provider system.

7. Your choices and requests

Email hello@heyzuzu.app to request access, correction, a copy of your information, withdrawal of consent, or deletion, or to raise a privacy concern. Where applicable law provides additional rights, you may exercise those through the same contact. We may verify control of your connected account before disclosing or deleting records. Do not send passwords, OTPs or identity documents unless a necessary verification method has been agreed with you.

Read our data-deletion instructions for the request process. Disconnecting a platform or deleting an Instagram message does not automatically erase the copy already stored in Zuzu.

8. Security and age

We use account-scoped access, session controls, webhook signature checks and restricted access to application credentials. No service can guarantee complete security. Avoid sending sensitive personal information that is unnecessary for saving a Reel or setting a reminder. Hey Zuzu is intended for people aged 18 or older. Contact us if you believe a child has provided personal information.

9. Policy changes

We will update this page when our practices change and provide an appropriate notice for material changes. New uses that require permission will be subject to that permission. The effective date above identifies this version.