Privacy Policy

1. Who we are and when this policy applies#

Zero Human AI [registered entity name and number to be confirmed] (Zero Human, we) makes Ori, an AI ad agent, and Origin, the video model behind it. This policy explains how we handle personal data when you visit our websites, join the pilot or waitlist, use Ori or the Origin API, or contact us.

We have two roles:

• Controller. For account, sign-in, billing, waitlist, website, support and safety data, we decide how it’s used. This policy covers that data.
• Processor. For the content a business puts into its workspace (briefs, brand assets, product media and the ads Ori makes), we act on that business’s instructions under our Data Processing Addendum. If you’re a customer of one of our customers, their privacy notice applies, and we’ll help them respond to you.

2. What we collect#

What you give us

What we collect automatically

• Security and service logs: IP address, device and browser type, pages and API endpoints used, and errors. Used to keep Ori running, block abuse and investigate incidents.
• Sign-in activity and approximate location: each step of joining the waitlist or signing in (code requested, wrong code, signed in), with the country, region, city and time zone our hosting provider derives from your IP address, and your browser, operating system, device type and language. Used to run the pilot fairly across markets, decide who to invite, and spot unusual or fraudulent sign-ins.
• How you found us: the website that sent you (without its query string), the first page you visited, and campaign tags in the link, such as utm_source. Kept in your browser's memory for that visit only, with no cookie or local storage, and sent with your sign-in.
• Product analytics, without cookies: we record events such as “started a brief” or “approved a cut” on our own servers. For visitors who aren’t signed in, we use a daily-changing anonymous identifier made from a one-way hash, so we can count visits without tracking you across days or sites.
• Error reports: technical details of crashes, with personal data removed before they’re sent to our error-monitoring provider.

What we get from others

• Sign-in providers. If you use Google, Apple or Microsoft, they share your name, email address, whether the address is verified, and an account identifier. With Apple, this may be a private relay address. For a work or school account, Google shares your organisation's Workspace domain and Microsoft its tenant identifier. We also note the company domain of a work email address.
• Ad platforms you connect. Account and page details, and the performance of ads Ori publishes for you.
• People who invite you. A teammate or another pilot member may give us your email address to send you an invite.

3. How we use it, and our legal bases#

4. AI and your data#

• No training without opt-in. We don’t use your Inputs or Outputs, or likeness data, to train Origin or any other model unless your business opts in in writing. You can withdraw an opt-in at any time for future training.
• Brand memory is yours. The things Ori learns about your brand, its beliefs and rules, live in your workspace. They’re never shared with or used for other customers, and you can make Ori forget any of them.
• Human review is limited. If a brief or an ad is flagged by our safety checks, a trained reviewer may look at it to decide. Staff don’t otherwise browse workspaces; support staff open one only when you ask for help.
• Aggregated statistics only. To improve Ori we use de-identified, aggregated measures such as render times and error rates, never the content of your ads.

There’s more detail in How we use data for AI.

5. Automated decisions#

Our safety checks automatically block briefs and ads that break the Usage Policy. This doesn’t produce legal or similarly significant effects for individuals. If a check blocks you, a person reviews it when you appeal. We don’t use AI to make decisions about people’s employment, credit, housing or similar matters.

6. Faces and voices (biometric data)#

When a real person chooses to appear in ads made with Ori, we process data that can be biometric or otherwise sensitive. We do this only with that person’s own explicit consent, recorded during our consent flow, and:

• only to create and use their likeness for the brands, markets and period they agreed;
• never to identify, track or verify people for any other purpose;
• deleting ID document images within 30 days of a completed check, keeping only the result;
• deleting their face and voice models within 30 days of withdrawal of consent. We keep a record of the consent and its withdrawal as proof, for as long as ads made with it may be live, plus three years.

7. Who we share it with#

We don’t sell personal data, and we don’t share it for cross-context behavioural advertising. We share it only:

• with service providers who run parts of Ori for us, such as cloud hosting, GPU rendering, email delivery, bot protection, analytics and error monitoring, under contracts that limit their use of it. See Subprocessors;
• with platforms you choose: the ad accounts you connect and the sign-in providers you use;
• with your workspace: teammates you invite can see the workspace’s content;
• for legal reasons: when the law requires it, or to protect people from harm. We push back on requests that are too broad, and we tell the affected customer unless the law forbids it;
• in a business transfer: if Zero Human is merged or acquired, under this policy’s protections;
• with your consent, for anything else.

8. Where your data lives#

You choose a data region when you set up your workspace: the United States or the GCC. Enterprise workspaces can also choose the European Union. Workspace content is stored and rendered in that region.

Some account, security and support data is processed by providers in other countries. Where data leaves the GCC, the EU or the UK, we use the safeguards those laws require: adequacy decisions, standard contractual clauses, or the transfer mechanisms set by the relevant GCC authority.

9. How long we keep it#

10. How we protect it#

Encryption in transit (TLS 1.2+) and at rest (AES-256); multi-factor authentication and just-in-time access for staff; separated workspaces; monitoring with alerts; and a tested incident response plan. If a breach affects your personal data, we’ll tell you within 72 hours of confirming it. Details are in Security.

11. Your rights#

Wherever you are, you can ask us to access, correct, export or delete your personal data, or object to how we use it. Write to info@zerohuman.co. We’ll confirm it’s you, usually by sending a code to your account email, and reply within 30 days. If a request is complex, we may extend that once and tell you why. You can also withdraw consent you’ve given at any time.

Depending on where you live, you may have more specific rights:

UAE, Saudi Arabia, Bahrain, Qatar, Oman, Kuwait

Rights under the UAE’s Federal Decree-Law No. 45 of 2021, Saudi Arabia’s Personal Data Protection Law, Bahrain’s Law No. 30 of 2018 and the equivalent laws in Qatar, Oman and Kuwait, including access, correction, deletion and objection, and limits on transfers outside the country. You can complain to the national data protection authority.

European Union and United Kingdom

Rights under the GDPR and UK GDPR, including restriction and portability, and the right to complain to your supervisory authority.

United States

Under the CCPA/CPRA and other state privacy laws, the right to know, delete, correct and opt out. We don’t sell or share personal data for targeted advertising, and we don’t discriminate against anyone for using their rights. Authorised agents may make requests with proof of authority. If we decline a request, you can appeal by replying to our answer.

If your data is part of a customer’s workspace, we may pass your request to that customer and help them respond.

12. Children#

Ori is a business product for people aged 18 and over. We don’t knowingly collect personal data from children. Ori won’t feature anyone under 18 as a real person in an ad. If you think a child has given us personal data, write to info@zerohuman.co and we’ll delete it.

13. Emails and cookies#

Service emails, such as sign-in codes, invites and security notices, are part of the service. Marketing emails have an unsubscribe link in every message.

We use only essential cookies, and we don’t use advertising or analytics cookies. See the Cookie Notice.

14. Changes to this policy#

If we change this policy in a way that matters, we’ll tell you by email or in the product before the change takes effect. Every version is listed at the end of this page.

15. Contact#

Zero Human AI [registered entity name and number to be confirmed], [Registered office address to be confirmed]. Privacy questions and requests: info@zerohuman.co.

Version history