Privacy Policy
Last updated: 22 April 2026
ZML SAS ("the Company," "we," "us," or "our") (5 Rue de Mogador, 75009 Paris, France) is the data controller for personal data processed through zmlai.org. This policy explains what data we collect, why we collect it, and what rights you have under the General Data Protection Regulation (GDPR) and applicable French data-protection law enforced by the CNIL (Commission Nationale de l'Informatique et des Libertes).
ZML operates a production ML inference orchestration platform: we route model inference workloads across GPU and accelerator hardware on behalf of infrastructure and platform teams. That technical scope shapes what data we actually process, and it is described specifically below.
1. Data Controller
ZML SAS (5 Rue de Mogador, 75009 Paris, France) is the data controller for personal data processed through zmlai.org. You can contact us at [email protected] for any data-protection matter, including to exercise the rights described below.
2. Personal Data We Process
ZML's core service routes ML inference workloads: the payload (model inputs and outputs) is infrastructure-layer data belonging to our clients, not personal data under our control. The personal data we collect relates to how you interact with our platform, not to the ML workloads themselves.
We process the following categories of personal data:
- Identity and contact data you submit when creating an account or contacting us (name, work email, phone, employer, role title);
- Account credentials (hashed passwords; API keys generated on your behalf);
- Billing and transaction data for paid plans (name, billing address, payment method summary; processed through our payment processor under its own privacy terms);
- Communications content (support messages, contact-form submissions, email exchanges);
- Technical data collected automatically when you access zmlai.org or the ZML API (IP address, browser type, operating system, pages visited, routing-event metadata);
- Usage and analytics data, where you have given consent.
We do not process the contents of ML inference payloads (model prompts, completions, or workload data) as personal data under our control. Clients bear responsibility for any personal data within their own inference workloads.
3. Purposes and Legal Bases (Article 6 GDPR)
| Purpose | Legal basis |
|---|---|
| Creating and managing your ZML account | Performance of contract (Art. 6(1)(b)) |
| Routing inference workloads and providing the orchestration service | Performance of contract (Art. 6(1)(b)) |
| Responding to your support requests and inquiries | Pre-contract steps / legitimate interest (Art. 6(1)(b)/(f)) |
| Operating and securing the platform, fraud prevention | Legitimate interest (Art. 6(1)(f)) |
| Billing and financial record-keeping | Legal obligation (Art. 6(1)(c)) / contract (Art. 6(1)(b)) |
| Legal compliance and regulatory obligations | Legal obligation (Art. 6(1)(c)) |
| Product and service improvement (aggregate, anonymised) | Legitimate interest (Art. 6(1)(f)) |
| Analytics cookies | Consent (ePrivacy Directive + Art. 6(1)(a)) |
4. Recipients and Transfers
Personal data is shared only with processors acting on our behalf under Article 28 GDPR data-processing agreements. Current processor categories include cloud hosting infrastructure, transactional email delivery, payment processing, and analytics (where you have consented). We do not sell personal data to third parties.
Where data is transferred outside the EU/EEA, we rely on Standard Contractual Clauses (Art. 46 GDPR) and assess additional safeguards as required by the Schrems II ruling. We document transfer impact assessments for sub-processors based outside the EEA and update them when processing arrangements change.
5. Retention
We retain personal data only for as long as necessary for the purposes described. Account data is retained for the duration of the account relationship and for up to 36 months after account closure to address any billing disputes or legal claims. Inquiry and support-form data is retained 24 months after last contact. API access logs are retained 90 days. Billing records are retained for the period required by French accounting law (generally 10 years).
6. Your GDPR Rights
- Right of access (Art. 15): confirm whether we process your data and obtain a copy;
- Right to rectification (Art. 16);
- Right to erasure / "right to be forgotten" (Art. 17), subject to limited exceptions (e.g., legal obligations);
- Right to restriction of processing (Art. 18);
- Right to data portability (Art. 20);
- Right to object (Art. 21), including to direct marketing without further conditions;
- Right not to be subject to automated decision-making with legal or similarly significant effects (Art. 22). We do not engage in such automated decision-making.
- Right to withdraw consent at any time, without affecting the lawfulness of processing based on consent before withdrawal.
To exercise any right, email [email protected]. We respond within one month of receipt, extendable by two further months for complex or numerous requests (with notification of the extension).
7. Right to Lodge a Complaint
Because ZML SAS is established in France, our lead supervisory authority is the CNIL. You have the right to lodge a complaint with the CNIL (Commission Nationale de l'Informatique et des Libertes, 3 Place de Fontenoy, 75007 Paris; www.cnil.fr). You may also lodge a complaint with any EU/EEA supervisory authority in your country of residence or employment. A list of EU/EEA authorities is available at edpb.europa.eu.
8. Cookies
See our Cookie Policy. Non-essential cookies (analytics) are not set until you give prior consent through our cookie banner, in line with the ePrivacy Directive and CNIL guidance. You can change your cookie choice at any time using the "Cookie preferences" link in the site footer.
9. Security
We implement technical and organisational measures appropriate to the risk, including TLS encryption in transit, encrypted storage for sensitive credentials, role-based access controls, and periodic security review. API keys are hashed server-side and are not recoverable after issuance.
10. Changes to This Policy
Material changes will be reflected by an updated "Last updated" date at the top of this page. Where required by law or the nature of the change, we will request renewed consent or provide advance notice.
11. Contact
ZML SAS5 Rue de Mogador, 75009 Paris, France
Email: [email protected]
Phone: +33 1 40 82 71 00