Privacy Policy — Barzil.ai

This Privacy Policy explains what information we collect, how we use it, and what rights you have, when you use the Barzil.ai website, application and AI audio tools (the "Service").

Barzil.ai is operated by Zohar Barzilai, registered in Israel, with its principal place of business in Israel. For the purposes of applicable data protection law — including the EU and UK GDPR and Israel's Privacy Protection Law, 5741-1981 as amended (the "PPL") — we act as the controller of the personal data described below.

1. The "No Training" Guarantee

2. Information We Collect

2.1 Information You Provide

• Account information: email address, username, and password (stored hashed, never in plain text).
• Third-party login data: if you sign in with Google or Facebook/Meta, we receive your name, email address, profile picture, and the provider's user ID in order to create and authenticate your account. We request only basic profile and email permissions. We do not access your friends, photos, or posts, and we never post on your behalf.
• Billing information: when you purchase credits through our payment provider, we receive transactional metadata such as purchase amount, date, and licence keys. We do not collect or store card numbers or raw financial details.
• Creative inputs: audio and video files, MIDI, sequenced patterns and any text you enter to generate or transform audio.
• Communications: information you provide when you contact support or report a bug.

2.2 Information Collected Automatically

• Usage data: features used, duration of generation requests, and error rates.
• Device and network data: IP address, browser type, operating system, and referring URLs, collected for security and basic analytics. Under the PPL as amended, IP addresses and similar online identifiers are treated as personal data, and we handle them accordingly.

2.3 What Happens If You Don't Provide It

Providing an email address and password (or using a third-party login) is a contractual requirement — without it we cannot create an account, hold your credit balance, or deliver your outputs. Providing audio or a pattern is necessary for the Service to function; there is no way to generate a result without an input. Everything else is optional, and declining to provide it will not affect your access to the Service.

3. How We Use Your Information, and On What Basis

Under the GDPR we must identify a lawful basis for each processing purpose. Ours are:

Automated decision-making: we do not use your personal data for automated decision-making that produces legal or similarly significant effects on you. The AI model processes your audio; it makes no decisions about you.

4. Retention

We are not an archival storage provider. You are responsible for downloading and backing up your generated audio. We may retain specific logs or files longer where necessary to investigate a security incident, debug a persistent failure, or comply with a legal obligation.

5. Cookies and Similar Technologies

We use a limited set of cookies, grouped into categories you can control:

• Strictly necessary — required to log you in, keep your session, and protect against abuse. These cannot be switched off.
• Functional — remember your preferences and settings. Optional.
• Analytics — help us understand which features are used and where things break. Optional, and set only with your consent.

Our consent banner offers a first-layer "Reject all" alongside "Accept all", with granular category controls, no pre-ticked boxes, and a way to withdraw consent at any time. Where you send a Global Privacy Control or similar opt-out preference signal, we treat it as a withdrawal of consent for optional cookies.

6. Sharing Your Information

We do not sell or share your personal data for advertising. We share it only in these circumstances:

Service providers (sub-processors), who process data on our behalf under data processing agreements. We use providers in the following categories:

• Authentication and account management
• Database hosting
• Application hosting and infrastructure
• Domain registration and DNS
• Payment processing
• GPU compute for running our models

The specific providers we currently use are:

We may change providers within these categories. We will update this page when we do, and you can email us to be told in advance.

• Legal and safety: where required by law, court order, or where we reasonably believe disclosure is necessary to protect the safety, rights, or property of Barzil.ai, our users, or the public.
• Business transfers: in a merger, acquisition, or sale of assets, subject to the promises in this Policy. We will notify you before your data becomes subject to a different privacy policy.

7. International Transfers

Barzil.ai is based in Israel. The European Commission has recognised Israel as providing an adequate level of data protection, most recently reaffirmed in January 2024, which means personal data can be transferred from the EEA to Israel without additional safeguards.

We also use global cloud infrastructure. Where we transfer personal data originating from the EEA or the UK to a country not covered by an adequacy decision, we rely on appropriate safeguards — typically Standard Contractual Clauses included in our providers' data processing agreements. You may request a copy of the relevant safeguards by emailing us.

8. Security and Data Breaches

We apply security measures appropriate to the sensitivity and volume of the data we hold, including encryption in transit, hashed credentials, access controls, and short retention windows for uploaded audio. No system is perfectly secure, and we cannot guarantee absolute security.

9. Your Rights

9.1 Everyone

• Access and portability — request a copy of the personal data we hold about you.
• Correction and deletion — have inaccurate data corrected or your data erased, subject to legal exceptions.
• Restriction and objection — object to or restrict certain processing.
• Withdraw consent — where we rely on consent, withdraw it at any time.
• Complain — lodge a complaint with your supervisory authority.

9.2 Israel (Privacy Protection Law)

If you are in Israel, the PPL gives you the right to inspect personal data held about you, to request correction of data that is incorrect, incomplete, unclear or out of date, and to have data deleted where it was unlawfully obtained or where retention is no longer justified. If we refuse a correction request, you may appeal to the competent court. You may also complain to the Israeli Privacy Protection Authority at the Ministry of Justice.

9.3 European Union and United Kingdom

Barzil.ai is a one-person operation based in Israel. If you are in the EEA or the UK, contact us directly at support@barzil.ai about anything relating to your personal data. Requests go straight to the person who runs the service, and we respond within the timeframes the GDPR requires — normally within one month.

You also have the right to lodge a complaint with the data protection supervisory authority in the country where you live or work, or where you believe an infringement occurred.

9.4 California and Other US States

We do not sell or share personal information as those terms are defined under the CCPA/CPRA, and have not done so in the preceding twelve months. We do not process sensitive personal information for purposes requiring a right to limit. Residents of California, Colorado, Connecticut, Virginia and other states with comparable laws may exercise rights to know, delete, correct, and appeal a denial, without discrimination. We honour Global Privacy Control signals.

To exercise any right, email support@barzil.ai. We will verify your identity using information already associated with your account, and respond within the timeframes required by applicable law.

10. Deleting Your Data

Email support@barzil.ai from your account address with the subject "Delete my account."

On a verified request, we will permanently delete your personal data — including any name, email, and profile information obtained through Google or Facebook login — within 30 days, except where we are legally required to retain certain records such as tax documentation. Data in routine encrypted backups is purged on our standard rotation. Deleting your account forfeits any unused credit balance; if you would like a pro rata refund instead, ask before you request deletion.

11. Children's Privacy

The Service is intended for adults aged 18 or older. We do not knowingly collect personal data from anyone under 18, or under a higher age threshold where local law sets one. If we discover we have collected data from a minor, we will delete it promptly. If you believe a minor has provided us with personal data, please contact us immediately.

12. Changes to This Policy

We may update this Policy to reflect changes in our practices or legal requirements. We will post the updated version here and revise the "Last updated" date. Where a change is material, we will notify you by email or through a prominent in-service notice at least thirty days before it takes effect.

13. Contact