Z U M A
Privacy Policy
Last updated: 19 October 2026 · Lunita Equity AB, Sweden
ZUMA keeps your real identity out of other people's databases. This page says exactly what ZUMA holds, for how long, who helps us run it, and what you can do about it. Every sentence is meant to be literally true of the code that runs the service.
Who is responsible
Lunita Equity AB, Sweden, is the controller of the personal data described here. Contact: privacy@zumaidentity.com.
Your account
- Accounts made in the app have no email, name or phone number. The account is a random identifier and a passkey. The passkey's private key stays in your iCloud Keychain; ZUMA stores only its public key, to check your Face ID signatures.
- Accounts made with an email code (the earlier invite-only beta) also hold that email address.
- Because an app account has no email, ZUMA cannot recover it for you. Your passkey in iCloud Keychain is the way back in.
What ZUMA holds
- Private addresses: each address ZUMA makes for you, and the website it was made for.
- Saved logins: the address and a generated password per website. Passwords are encrypted (AES-256-GCM), and ZUMA can open them, so AutoFill and the AI agents you approve can sign in for you.
- Personal details, only if you add them (name, phone, date of birth, addresses): kept either in your iPhone's Keychain, where ZUMA cannot read them, or encrypted in ZUMA's database, where ZUMA holds the key. The app says which.
- Agents and approvals: the AI agents you connect, what you allow them, the requests they make and the ones you approve with Face ID, in a hash-chained ledger you can read in the app.
- Disclosures: a log of every time something of yours was handed to a website or an agent, shown to you under Profile → Your data.
Your inbox
- When an email reaches one of your ZUMA addresses, ZUMA reads it once: to sort it by sender, to check it for phishing, and to find a sign-in code.
- It is then sealed with a key that only your Apple devices hold, and your iPhone fetches it. Once your iPhone has stored it, ZUMA deletes the sealed content immediately and the rest of the record (sender and any sign-in code) within 15 minutes.
- A sign-in code stays readable to ZUMA for at most 15 minutes, so AutoFill can fill it, and so an AI agent you approved can finish the sign-up it asked for. Each code handed to an agent is logged for you.
- Sealed mail your iPhone never fetches is deleted after 30 days.
- On your iPhone, mail is stored in the app's protected storage and is part of your phone's own backup. Deleting the app or your account deletes it.
- ZUMA does not send your mail to any AI service.
What ZUMA never does
- Sell or share your personal data, in any form.
- Give a website or an agent your real email, name or phone number. They get a private address made for them.
- Use your data for advertising or profiling.
- Handle your payment details. If you subscribe to ZUMA for agents, Apple takes the payment; ZUMA receives only Apple's transaction ids, the product and its dates, never your name, Apple ID or card.
Who helps run ZUMA
| Supabase | Database and sign-in. Data stored in the EU (Ireland). |
| Vercel | Runs ZUMA's servers, in the EU (Dublin). |
| Resend (with Amazon SES) | Receives mail for ZUMA addresses and sends ZUMA's own sign-in emails. Resend keeps its own copy of received mail for a limited time under its retention settings. |
| Apple | Passkeys and the inbox key in your iCloud Keychain; the App Store, including subscription payments. |
Some of these companies are based in the United States. Where data may be reached from outside the EU, it is covered by the EU Standard Contractual Clauses or the EU–US Data Privacy Framework.
Why we may process it
- To provide the service you asked for (GDPR art. 6(1)(b)): your account, addresses, logins, inbox and agent requests.
- To keep ZUMA safe (art. 6(1)(f), legitimate interest): phishing checks, limits on how often requests can be made (which briefly count requests per IP address), and keeping abuse out.
How long
| Account, addresses, logins, details | Until you delete them or your account. |
| Mail content | Until your iPhone has it; at most 30 days if never fetched. |
| Sender and sign-in code | At most 15 minutes after your iPhone has the mail. |
| Approval ledger and disclosure log | Until you delete your account. |
| Subscription record (Apple's transaction ids, product, dates, and a random purchase id for your account) | Until you delete your account. |
| Request counters (IP addresses) | Deleted within ten minutes after each limit window ends; windows last at most an hour. |
Your rights
- Delete: Profile → Delete account permanently removes your account and everything above, on ZUMA and on your iPhone.
- See and revoke: Profile → Your data shows every disclosure; one tap cuts off any website or agent.
- Access, correction, a copy of your data, objection: write to privacy@zumaidentity.com from the app's Contact link. As an app account has no email, include a reply address you choose.
- Complain: you can contact the Swedish Authority for Privacy Protection (IMY), imy.se.
Security incidents
If a breach puts your data at risk, we tell IMY within 72 hours and tell you in the app, since an app account has no email to write to.
Children
ZUMA is not meant for children under 13.
Changes
When this policy changes in a way that matters, the app tells you before the change takes effect. The date at the top shows the current version.