Summary of changes — September 2026
We have updated this Privacy Policy. The main changes are:
This policy explains what personal data ZYMIX collects about you, why we collect it, how we use it, and what rights you have over it.
This policy is a privacy notice rather than a contract in its own right: it tells you how we process your personal data, and your rights under data protection law. Please read it carefully and contact us if anything is unclear.
We have written it in plain English. Where we use legal terms, we explain what they mean.
Questions? Contact us any time at privacy@zymix.ai
ZYMIX is a social and community platform for user interaction, content sharing, social discovery, messaging, and community engagement. The platform is operated by:
| Company | FLICKNMIX LTD |
| Registered address | 15 Fitzroy Street, London, England, W1T 4DG |
| Privacy contact | privacy@zymix.ai |
| Support contact | support@zymix.ai |
| ICO registration | Registered with the UK Information Commissioner's Office as a data controller. |
Throughout this policy, 'ZYMIX', 'we', 'us', and 'our' refer to FLICKNMIX LTD. 'You' means anyone who uses the ZYMIX app, website, or related services (together, the 'Platform').
As data controller, we decide how and why your personal data is used. This carries legal responsibilities under the UK GDPR, the UK Data Protection Act 2018 and, where applicable, the EU GDPR, and we take those responsibilities seriously.
We only collect information that we genuinely need. Here is a full account of what we collect and how.
When you use the Platform, we and our service providers automatically collect the following:
If you give us permission, we can access your device's contact list to help you find people you know on ZYMIX. We always ask before accessing your contacts. You can withdraw permission at any time through your device settings.
Some information about you reaches us from services operated by other organisations. For example, on supported Apple devices we may also receive an age range associated with your Apple Account through Apple’s Declared Age Range API (see Section 2.7).
If you report content or another user, or if content you have posted is reported to us, we collect information about that report and any moderation review that follows. See Section 12 for more on how moderation works.
If you choose to connect Apple Health to your Health Agent, ZYMIX reads the following seven daily summary metrics from Apple HealthKit, depending on which ones you allow: step count, walking and running distance, active energy burned, exercise minutes, total sleep duration, average resting heart rate, and water intake.
How collection works. Health data is read only after you explicitly connect Apple Health in App Connectors and grant permission through the iOS Health authorization screen. ZYMIX is read-only and never writes any data to Apple Health. We collect daily aggregated summaries only — we do not collect raw samples, real-time heart rate, workout routes, or sleep-stage details (such as deep or REM sleep). We process this data on the basis of your explicit consent (Article 6(1)(a) and 9(2)(a) of the UK GDPR and EU GDPR), which you may withdraw at any time by disconnecting Apple Health. You can use ZYMIX without connecting Apple Health.
How we use it. Your health summaries are transmitted securely to our servers and used solely to power your Health Agent conversations. We do not use health data for advertising, marketing, or data mining; we do not use it to build advertising profiles; we do not use it to train AI models; and we never sell it or share it with advertisers or data brokers.
Third-party AI processing. To generate Health Agent responses, your health summaries are processed through OpenRouter, which provides the AI infrastructure used by the Health Agent. OpenRouter and the model provider act as our data processors under contractual confidentiality and data-protection obligations. They are prohibited from using your health data for their own purposes, including the training of AI models. We configure the services used for the Health Agent so that health data is not used to train general-purpose AI models. These providers may process your data outside of the UK and EEA, including in the United States; the safeguards we apply to such transfer are described in Section 7 (International Data Transfers) of this policy.
Retention and deletion. We retain health summaries for as long as your Apple Health connection remains active. When you disconnect Apple Health in App Connectors, we stop collecting health data immediately and delete health summaries from our active systems. Backup copies are deleted according to our backup retention schedule. You can also revoke ZYMIX’s access at any time in the iOS Health app (Profile > Privacy > Apps > ZYMIX) or in Settings > Privacy & Security > Health. If you delete your ZYMIX account, health summaries stored on our servers are deleted in accordance with Section 8 (How Long We Keep Your Information) of this policy.
ZYMIX is intended only for users aged 18 or over, as stated in our Terms of Use. When registering for a ZYMIX account, users are required to confirm that they are at least 18 years old. This initial age confirmation is based on information provided by the user and does not, by itself, constitute independent age verification.
As an additional input to our age-assurance process, on supported Apple devices ZYMIX may receive an age range associated with a user’s Apple Account through Apple’s Declared Age Range API, where this information is shared by the user or, where applicable, a parent or guardian, or otherwise made available by Apple where required under applicable law. The age range is based on age information provided to Apple by the user or their parent or guardian and, in some cases, may have been confirmed using an age-assurance method supported by Apple. ZYMIX does not independently verify the underlying Apple Account age information, and the Declared Age Range signal does not by itself establish that a user has completed ZYMIX’s own independent age-verification process. Where this signal is not available or not shared, ZYMIX does not treat its absence as confirmation that the user meets the minimum age requirement.
Where age information made available to ZYMIX, whether from Apple’s Declared Age Range API or from other age-assurance measures applied by ZYMIX, indicates that a user is under 18, the user may be prevented from accessing ZYMIX or relevant services in accordance with our Terms of Use and applicable age-assurance requirements.
We only use your personal data where we have a valid legal reason to do so — known as a 'lawful basis'. The table below explains the lawful bases we rely on and when we use each one.
| Lawful basis | When and why we use it |
|---|---|
| Contract | Running the Platform, specifically:
|
| Legitimate interests |
|
| Consent |
We will always ask before relying on consent, and you can withdraw it at any time. |
| Legal obligation |
|
| Vital interests | Protecting someone’s life or physical safety in urgent circumstances, for example, escalating a credible risk of serious harm to the emergency services. |
Under UK and EU data protection law, you have a number of important rights over your personal data. These are set out below. To exercise any of them, contact us at privacy@zymix.ai or use the relevant in-app tools. We will respond within one calendar month.
| Your right | What it means in practice |
|---|---|
| Right to access | Ask us for a copy of all the personal data we hold about you, along with details of how and why we use it. |
| Right to rectification | If any information we hold is inaccurate or incomplete, ask us to correct it. You can also update most profile details directly within the app. |
| Right to erasure | Ask us to delete your personal data. For example, where it is no longer needed for the purpose it was collected, or where you withdraw consent. To delete your account: Me > Account > Delete Account, or email us. We may retain some data where legally required (e.g. financial records, safety records). A 30-day cancellation window applies to account-deletion requests (see Section 8). |
| Right to data portability | Where we process your data based on consent or contract, ask us to provide it in a structured, machine-readable format, or to transfer it directly to another provider where technically possible. |
| Right to restriction | Ask us to pause or limit processing of your data. For example, while we investigate a dispute about its accuracy. |
| Right to object | Object to us processing your data based on our legitimate interests, including for profiling and recommendations. We will stop unless we have compelling grounds that override your interests. |
| Right to withdraw consent | Withdraw any consent you have given at any time. This does not affect anything that happened before you withdrew it. |
| Automated decisions | Where we make decisions about you based solely on automated processing that have a significant effect on you, ask for human review, express your view, or challenge the decision. |
| Right to complain | Lodge a complaint with the UK ICO (ico.org.uk / 0303 123 1113) or, if you are in the EU, with your local data protection authority. We would always welcome the chance to resolve your concern first — please email privacy@zymix.ai. |
ZYMIX is a social platform, so some of your information is visible to other users. This section explains what is public and what you can control.
ZYMIX currently offers, and intends to develop further, features that allow you to discover other users nearby. If you enable location or proximity-based features:
Location sharing is always opt-in. We will ask for your explicit permission before enabling it, and you can turn it off at any time through your device settings or within the app.
Accounts that have not completed age assurance: Location and proximity-based features are off by default and are not available. We strongly encourage you to keep location features switched off unless you actively choose to use them. You can contact us at privacy@zymix.ai at any time if you have concerns about location settings.
We offer settings within the Platform to control who can see your profile, content, and activity. These controls are expanding as the Platform develops. We encourage you to review your privacy settings regularly and to think carefully about what you share publicly.
We do not sell your personal data to anyone. We may share it in the following circumstances:
We use trusted third-party companies to help run ZYMIX. Most of them are processors, which means they act only on our instructions, may use your information solely to provide the service we have engaged them for, and are contractually required to keep it secure. A few, identified below, are independent controllers, which means they decide for themselves how the data is used, under their own privacy policies. We describe our providers by the category of service they provide to us, because the provider we use may change from time to time as the Platform develops. A current list of named providers is available on request from privacy@zymix.ai.
Platform infrastructure. Our primary cloud platform, hosted in the United Kingdom, holds the primary user data stored on the Platform, account and profile information, the content you post, and application logs. Auxiliary infrastructure providers, hosted in the EU, receive only encrypted user messages and limited technical data, such as technical statistics, licence validation when the app starts. A content-delivery and network-security provider handles traffic between your device and our systems and sees your IP address, device and connection data. Error-monitoring, logging and performance-monitoring providers receive device and app information, IP addresses and error logs, which may include your ZYMIX user ID.
Communications and media features. A phone-verification provider receives your phone number to deliver SMS verification codes and is not used as ZYMIX's user-data storage platform; a transactional-email provider receives your email address and the content of the service emails we send you; a real-time voice and video provider carries voice and video streams, together with the session, device and connection data needed to run calls; and an audio-transcription provider receives audio you upload or send, for transcription.
Safety and age assurance. Checkstep, our content-moderation partner, receives the content you post, reported messages, moderation reports and account identifiers to provide the AI screening and moderation tooling described in Section 12. Yoti, our age-assurance partner, processes the selfie you provide to estimate your age band and returns only the age band and a timestamp; we do not receive or store your image (see Section 10). Both act as our processors.
Health Agent. OpenRouter, and the AI model provider it routes to (currently OpenAI), process the Apple Health daily summaries you choose to connect and your Health Agent conversation content, as our processors, to generate Health Agent responses (see Section 2.6).
App Promotion and Advertising Attribution. With your consent only, Adjust, our attribution processor, collects device information, IP address, and install, session and in-app event data through its SDK so that we can measure how our advertising campaigns perform, and limited data of this kind is shared with Meta Platforms so that Meta and we can measure whether Meta ads led to installs or activity on ZYMIX. Where you separately consent, hashed identifiers are shared with Meta so that it can show ZYMIX ads to our users or to similar audiences (audience matching). Meta uses this data as an independent controller under its own privacy policy; for the audience-matching step, we and Meta act as joint controllers under Meta’s business-tools terms. Consent is the only legal basis we rely on for these promotion link and ads activities. You can withdraw it at any time in your device or app settings, and we never share the content you post, your messages or your contact list with Meta or any other advertising partner.
Payments. Mangopay, our payment partner, processes payments on ZYMIX and carries out the identity-verification (KYC) checks its own legal obligations require, as an independent controller under its own privacy policy. It receives the payment and transaction details and the KYC information you give it; we receive only the KYC outcome, which we may rely on for age assurance (see Section 10).
Where our providers are located. Our core platform data is hosted in the United Kingdom, and auxiliary infrastructure in the EU. Some of the providers described above are based in, or process data in, other countries. Where personal data leaves the UK and EEA, the safeguards described in Section 7 apply.
Information you choose to make public — your profile, username, and public posts — is visible to other users of the Platform as described in Section 5. Please think carefully about what you share.
We may share your information with regulators, law enforcement agencies, courts, or other public authorities where we are legally required to do so, or where we reasonably believe it is necessary to:
If FLICKNMIX LTD is involved in a merger, acquisition, restructuring, or sale of assets, your personal data may be transferred as part of that transaction. We will take reasonable steps to ensure any such transfer is subject to appropriate protections and that you are informed of any material changes to how your information is handled.
We may share aggregated or anonymised information — data that cannot reasonably be used to identify you — with research, analytics and business partners for research, analysis, or business purposes.
Your personal data is stored and processed primarily in the United Kingdom and the EU. Some of our service providers are located in other countries, including the United States. Where personal data is transferred outside the UK or the EEA, we ensure that appropriate safeguards are in place before any transfer takes place. These may include:
We will update this section if our international transfer arrangements change.
We keep your personal data for as long as we genuinely need it. The table below sets out our approach by data type.
| Type of information | How long we keep it |
|---|---|
| Account and profile information | While your account is open. Deleted when your account deletion completes (see below), except where the law requires us to keep it. |
| Content you have posted | Until you delete it or your account is deleted. Some content may be retained longer after deletion for safety reasons. |
| Payment and transaction records | Up to 7 years, required by financial and tax law. |
| Moderation and safety records | As long as necessary for the relevant safety, security, legal, or enforcement purpose, including preventing re-registration after a ban. Generally, no longer than 3 years. |
| Analytics and usage data | Generally, no longer than 24 months. Aggregated or anonymised data may be retained for longer. |
| Contact list | While your permission remains in place; deleted when you withdraw it or when your account deletion completes. |
| Apple Health summaries (Health Agent) | While your Apple Health connection remains active; deleted when you disconnect Apple Health or when your account deletion completes (see Section 2.6). |
| Age-assurance results | While your account is open. Deleted when your account deletion completes (see Section 10). |
| Legal compliance records | As long as required by applicable law or regulation. |
To delete your account, go to Me > Account > Delete Account in the app, or email privacy@zymix.ai. When you submit a deletion request, you then have 30 days to cancel it — if you change your mind within that window, your account can be restored. Once the 30 days have passed, the deletion process will be initiated, and your account cannot be recovered. It may take up to 90 days from the beginning of the deletion process to complete it. While we’re deleting your account, it's not visible or accessible to other users.
ZYMIX uses automated systems to personalise your experience and to keep the Platform safe. This section explains what those systems do and how they affect you.
Our recommendation system analyses your activity on the Platform — what you engage with, what you skip, how you interact with other users — to suggest content, people, and events you are likely to find interesting. This is a form of automated profiling. Our recommendations are currently based on your activity within ZYMIX only. We do not currently use third-party data for this purpose.
Recommendations and profiling are off by default for accounts that have not completed age assurance. You can object to profiling or modify your personalisation settings at any time by using in-app tools or contacting us at privacy@zymix.ai.
We use AI-powered tools (provided by Checkstep) alongside human moderators to help keep the Platform safe. To avoid setting out the same information twice, full details of how our content moderation works are set out in Section 12.
The Health Agent uses AI models to generate responses based on the Apple Health summaries you choose to connect. It provides general wellbeing information only and does not make decisions about you that have legal or similarly significant effects. Section 2.6 explains the data involved, and Section 3.8 of our Terms of Use explains the limits of relying on it.
ZYMIX is intended for adults. You must be 18 or over to use the Platform. We use age-assurance measures and other safeguards designed to keep the Platform safe and to help prevent under-18s from using it. Our age and safety measures include:
Until you complete age assurance, your account has limited access:
We are developing an always-available option in the app that lets you complete age assurance at any time. Until it is released, we prompt you to verify when you first try to use a restricted feature.
On supported Apple devices we may also receive an age range associated with your Apple Account through Apple’s Declared Age Range API as an additional input to our age-assurance process. This signal does not by itself constitute independent age verification. See Section 2.7 of this policy for details.
If you are a parent or guardian with a concern, or if you believe a user under 18 is on the Platform, please contact us at privacy@zymix.ai. We will investigate and take appropriate action promptly.
Cookies are small text files stored on your device when you use the Platform. They help the Platform function, remember your preferences, and tell us how the Platform is being used. Similar technologies — including SDKs (software development kits built into the app), pixels, and device identifiers — work in a similar way and are covered by this section.
| Type | Your choice | What it does |
|---|---|---|
| Essential | Always on — cannot be switched off | Keeps you logged in, maintains session security, and enables core Platform features. |
| Analytics | We ask for your consent | Helps us understand how the Platform is being used so we can improve it. Collected via analytics tools and SDKs. |
| Behavioural / Preference | We ask for your consent | Remembers your settings and preferences and supports the personalisation of your experience. |
| Advertising | We ask for your consent | We use attribution and advertising-measurement technologies to measure how our advertising campaigns perform and to support ZYMIX’s advertising on advertising networks such as Meta. We do not show third-party advertising inside ZYMIX. |
You cannot opt out of essential cookies, as these are required for the Platform to function. For all other cookies and tracking technologies, you can manage your preferences through the settings within the app, your device's privacy controls, or by contacting us at privacy@zymix.ai. Please note that disabling certain technologies may affect some features of the Platform.
Keeping ZYMIX safe is one of our most important responsibilities. Here is how we approach it.
We use a combination of automated AI tools and human moderators to review content on the Platform. In practice, this means:
You can report any content or user you believe is violating our Terms of use or applicable law using the reporting tools within the app. We take all reports seriously and aim to respond promptly.
If we remove your content, restrict your account, or take other enforcement action, you may be able to appeal that decision through the complaints and appeals process in the app. We will provide further details about this process within the Platform.
As a user-to-user service accessible in the United Kingdom, ZYMIX is subject to the UK Online Safety Act 2023. This means we have legal duties relating to illegal content, children's safety, user reporting, and transparency. Our compliance programme is ongoing and we will continue to develop our practices as our obligations become fully applicable.
Where ZYMIX is accessible to users in the EU, relevant requirements of the EU Digital Services Act (DSA) apply — including obligations relating to content moderation transparency, recommender systems, and user redress. We are working towards full DSA compliance and will provide further information within the Platform as applicable.
We take the security of your personal data seriously. The measures we currently have in place include:
No system is completely immune to security risks. While we work hard to protect your data, we cannot guarantee absolute security. Keeping your account credentials secure also helps protect your data; your responsibilities in this respect are set out in our Terms of Use. If you believe your account has been compromised, please contact us at privacy@zymix.ai immediately.
The Platform may contain links to third-party websites, apps, or services. This Privacy Policy does not apply to those third parties, and we are not responsible for how they collect or use your information. We encourage you to check the privacy policies of any third-party services before sharing information with them.
We may update this Privacy Policy from time to time — to reflect changes in the Platform, in how we use personal data, or in applicable law.
If we make a significant change, we will notify you through the app or by other appropriate means before the change takes effect. The 'last updated' date at the top of this document always reflects when the policy was most recently revised.
The updated policy applies from the date shown at the top of this document. If you are not comfortable with how we handle your data after a change, you can exercise your rights (see Section 4), stop using the Platform, or delete your account.
If you have any questions, concerns, or requests about this Privacy Policy or the way we process your personal data, please get in touch:
FLICKNMIX LTD — Privacy Contact
15 Fitzroy Street, London, England, W1T 4DG
Privacy enquiries: privacy@zymix.ai
General support: support@zymix.ai
ICO registration number: ZC083088
We aim to respond to all privacy enquiries within 30 days.