Zhorvel

Privacy Policy

Version 2026-10-23

This policy explains what personal data Zhorvel keeps, why, for how long, who helps us process it and what rights you have. We do not sell your data, we do not use it for advertising and we do not use your content to train AI models.

  1. Who we are. Lomray Software LLC, 7901 4th St N, Ste 300, St. Petersburg, FL 33702, USA, requests@lomray.com. We decide how your personal data is used for the service and are responsible for it (the controller).
  2. What we store. The ids of the sign-in methods you link (your Telegram account id, Apple's and Google's account ids for this service, your passkeys' public keys) and their display names, and your interface language; for Apple, a token kept encrypted only to end the link when you remove it or delete your account; the assistants you configure (name, purpose, language, timezone, style); the data your assistant keeps in your own space on our server, including messages it processes and files it works with; encrypted tokens of the AI provider accounts and Telegram bots you connect; your subscription state and dates; operational logs without message content. Your assistant keeps notes about your life in your Files, written from your own messages; what people you introduce tell it stays private to them. When you share your location with your assistant, from the Zhorvel app on your iPhone or in Telegram, it keeps those points in your space to answer you and to keep its clock on your local time. When a person you introduced shares their location with it in their own chat, it keeps their points apart for 30 days, uses them only for that person's requests, tells no one where they are, you included, unless that person agreed in their chat, and deletes them when that person asks. When you share Apple Health data from the Zhorvel app on your iPhone, only the kinds of data you allow reach your space, and only the assistants you choose may read them, to answer you about your health and activity. Health data is never used for advertising or marketing, never sold and never shared with anyone else. You can stop sharing in the app at any time, and you can delete what an assistant received from the app or your account. When your assistant calls or texts someone for you, the number, the time, a transcript and a summary of the call and the messages stay in your space; when recording is on, the call audio is kept by our voice provider for the retention period your settings show, 30 days unless you change it. In a call in the Zhorvel app, what your camera shows is used during the call only and is not kept, unless you ask your assistant to keep a picture. Faces and voices your assistant learns to recognize are handled as the Biometric and Voice Notice describes. What you write to our bot and the photos and short videos you send it with your words, a summary your assistant writes and shows you before sending it on with your consent, and the reports of errors your assistant meets, which carry only the tool's name and the kind of error and which you can ask your assistant to stop sending, reach our team with the technical details of the assistant and no other message content; photos and videos are kept without their location and camera details, and we keep all of it until it is handled and for 90 days after we have told you the outcome. When your assistant learns a working habit that would help any assistant, such as checking a date before booking, it may share it with the service as a short general rule rewritten so that it contains no names, places, numbers, links, quotes or anything you said; a rule that several accounts learn on their own may then guide every assistant of the service. Your conversations and your words never leave your account. You can switch this off in Settings → Privacy → Assistant learning. The Zhorvel bot answers questions about the service automatically. It keeps your messages to it and its answers for 24 hours to follow the conversation, then deletes them; a question it cannot answer goes to the team as feedback, and a message that looks like a password or key is deleted at once. When you join the waiting list before you have an account, we keep the id of the sign-in you used, its display name, your language and an email address: the one Apple or Google shares when you sign in with it, or one you leave yourself. We use the address only to tell you once that you can sign in, and we delete it when we have told you, when you sign in or when you ask us. To improve the service we record how it is used (which screens are opened, which steps are completed and where something goes wrong) under a random identifier that is not your Telegram account. This never includes your name, messages, files, or anything you or your assistant write; screens are recorded with all text and entries hidden, and payment, key and terms screens are never recorded. On our public pages we count visits without cookies or identifiers. You can switch this off in Settings → Privacy → Product improvement, which also deletes what was recorded. For card payments, Stripe's identifiers for your customer record and your payments. For payments through @CryptoBot, the invoice number, the asset and the amount.
  3. A saved card. A saved card is held by Stripe; we keep only its reference.
  4. What we do not store. We do not store your payment credentials. We never ask Telegram for your phone number, and we ask Apple and Google for your email only to tell you, while you are on the waiting list, that you can sign in; an account keeps no email. Stripe collects your payment details as our payment processor under its own privacy policy. @CryptoBot processes your payment under its own terms and privacy policy.
  5. What we never do. We do not sell your personal data and do not share it for advertising that follows you across services. We do not use your messages, files, calls or connected accounts to train AI models, and we do not build profiles of you for anyone else. When your own AI account answers your assistant, that provider's terms decide what it keeps.
  6. Our three promises. The AI that writes to you never trains on your chats: we say so only while your assistant, our help desk and the general working rules drawn from assistants' habits run on the included AI and it sends requests only to providers that do not collect them for training. Phone calls and spoken replies go through a voice provider under its own terms and are outside this promise, and when your own AI account or key answers your assistant, that provider's terms decide. It spends only what you allow, with a tap: every payment waits for your tap, or for a standing permission that you gave with a tap. Delete your account and your data goes with it: your space and the people, notes and files your assistant keeps are deleted; what stays is described under How long, the payment records accounting law requires under a pseudonymous key, call recordings until their retention period ends and copies in backups until they expire.
  7. Why. To run your assistant and do what you ask of it, to bill you, to send reminders about your subscription through the channel you use, such as our Telegram bot, to keep the service secure, to improve it as described above, and to meet legal duties including accounting and sanctions law. Where the GDPR applies, we rely on our contract with you to run the service, on your consent for location, health and biometric data and for anything else you switch on, on our legitimate interest in security and improvement, and on legal obligations.
  8. Where. On servers we rent for the service, with backups you may connect to storage of your own. Messages sent to the included model are processed by our AI model providers. Requests are routed only to providers that do not collect prompts and responses for training. Requests are routed only to endpoints with zero data retention. Usage records are processed by an analytics service in the European Union.
  9. Who processes data for us. We use service providers that process data only on our instructions and under contracts that protect it: the companies whose servers we rent, AI model providers that answer your assistant, voice and telephony providers for calls and text messages, web search and browsing providers, our analytics service, an email delivery service for waiting-list emails, and the payment processors named on this page. Telegram and Apple deliver your messages and notifications under their own terms. When you connect your own AI account, phone number, storage or other service, that provider processes the data under its own terms with you.
  10. International transfers. We are based in the United States, and our providers may process data in the United States, the European Union and other countries. When we transfer personal data out of the European Economic Area, the United Kingdom or Switzerland, we use the safeguards the law provides, such as the European Commission's standard contractual clauses.
  11. How long. While your account exists and for 30 days after it is paused; then we delete it. We keep payment records for as long as accounting law requires, under a pseudonymous key that we cannot turn back into your sign-in ids without a secret held on our server, and a record that a trial was used for that key, and, under the same key, which version of our Terms of Service you accepted, when, and whether in Telegram or in the browser; and a general working rule that was derived in part from your assistant's habits may remain after your account is deleted; it contains nothing of yours. Usage records for up to 12 months and screen recordings for up to 30 days. A paused account that still holds credits is kept, paused, until the credits are refunded or its owner deletes it. Backups expire on their own schedule after the data is deleted from your space.
  12. Connected accounts. You choose which accounts and services your assistant may use, and you can disconnect each of them at any time. When you disconnect one, your assistant loses access at once and we delete its tokens. What your assistant already saved from it, such as notes or files, stays in your space until you delete it or ask your assistant or us to delete it.
  13. Google accounts. If you connect your Google mail or calendar, your assistant uses that data only to do what you ask of it; we do not sell it, use it for advertising or use it to train AI models, and disconnecting removes your assistant's access.
  14. Children. The service is only for people 18 and older. We do not knowingly collect data from anyone under 18. If we learn that we hold data of a child, we delete it.
  15. Security. We encrypt data in transit, keep the keys and tokens you connect encrypted at rest, keep each account in its own space and limit who on our team can reach data. No system is perfectly secure. If a breach affects your personal data, we tell you and the authorities as the law requires, and where the GDPR applies we notify the authority within 72 hours.
  16. Your rights. You can read your data through your account page and your own backups, pause or remove assistants, and ask us at requests@lomray.com to delete your account; where the law gives you rights of access, rectification, portability and objection, write to the same address. You can also delete your account in its settings, get a copy of your data within 30 days of asking, withdraw a consent at any time and appeal our answer by writing to us again. We answer within the time the law sets and do not treat you differently for using your rights.
  17. California and other US states. If you live in California, Texas, Virginia, Colorado, Connecticut or another state with a privacy law, you have the right to know what we collect and why, to get a copy, to correct and to delete it, and to opt out of sale, sharing and targeted advertising, which we do not do. The categories we collect are identifiers, the content of your messages, files and calls, approximate and precise location, health data you share, biometric data under the Biometric and Voice Notice, payment records and usage records. We use sensitive data only to provide the service you ask for. You or an agent you authorize can make a request at requests@lomray.com; we verify it through your Telegram account.
  18. European Union, United Kingdom and Switzerland. You have the rights of access, rectification, erasure, restriction, portability and objection, and the right to withdraw consent. You can complain to the data protection authority where you live or work.
  19. Data from Telegram. Our bots receive from Telegram only what you or the people you introduce send them and your account id. We do not use chats to build data sets for AI. Deleting your account deletes what our bots hold about you, except the records described above.
  20. Changes. We post changes on this page; material changes are announced on your account page.
  21. Contact. Questions and requests about your data: requests@lomray.com.

The English text governs.

All documents: Terms of Service · Privacy Policy · Acceptable Use Policy · Refund and Cancellation Policy · AI and Autonomy Disclosure · Call Recording and Telephony Notice · Family and Shared Assistant Consent · Biometric and Voice Notice