Privacy Policy

Lumetrix BV (“Zofa TV”, “we”, “us”, “our”), a company incorporated in Belgium, with registered office at Exelgaarden 20, 3550 Heusden-Zolder, Belgium, registered under company/VAT number BE 1029.601.154, is the data controller for the processing described in this Privacy Policy. This Policy explains how we handle personal data when you use the Zofa TV applications and the website zofa.tv (together, the “Service”), in accordance with the EU General Data Protection Regulation (GDPR) and Belgian data-protection law.

1. Our Approach (Privacy by Design)

Zofa TV is a media platform: it lets you organise and play media you supply yourself and launch third-party apps you already use. Your playlists, source URLs, credentials and media stay on your device and are used only to provide the Service to you. We do not sell your data, we do not sell your media, and we do not build a commercial profile of what you watch. We collect the minimum data needed to run the Service.

2. Data We Process

a) Account data: e-mail, password (hashed), display name, language, license type and status.

b) Device data: device identifiers, device names, model, OS and app version (to manage your device license).

c) Library and settings data: your playlists, favourites, profiles and settings are stored only on your device. We do not receive them.

Web player on zofa.tv. If you use the web player while signed in, we keep one encrypted copy of your sources, favourites and settings with your account, so that you get them back in another browser. That copy is encrypted in your browser with a recovery code that only you have (AES-256-GCM); we never receive that code and therefore cannot read the copy. It is deleted together with your account. The Zofa TV apps on TV, phone and tablet do not send this data to us; there everything stays on the device.

d) Diagnostic data: a technical log kept only on your device. We do not receive it automatically.

e) Usage/analytics data: aggregated, largely non-identifying information about feature use, only where you have consented (see Cookie Policy).

f) Connection data: IP address and session data, processed transiently for delivery, security and fraud prevention.

g) Purchase data: subscriptions are bought on zofa.tv and the payment is handled by Stripe, which processes your card details under its own privacy policy as an independent controller. We receive the subscription status, the invoice record and the last four digits of your card - never the full card number. Should a subscription in future be bought through an app store (Google Play or the Apple App Store), that store handles the payment and we receive only a purchase token and its status.

h) Trial data: you can try Zofa TV without creating an account. To do so we store a device identifier and the start and end dates of the trial. You may optionally give an e-mail address to extend the trial; we then store that address alongside the device record and use it only to grant the extra days and to remind you before the trial ends. The trial works without it, and you can ask us to delete it at any time via privacy@zofa.tv.

i) Sign-in provider data: if you sign in with Google or Apple, we receive from them your e-mail address and, where you permit it, your name. We never receive your password with them, and we never receive your contacts, calendar or any other data they hold. If you use Apple’s “Hide My Email”, we only ever see the relay address Apple generates for us and never your real address.

We do not intentionally collect the content of your private media, and we do not collect special categories of data (health, religion, etc.).

Provide the platform, accounts and device management: performance of a contract (Art. 6(1)(b)).
Verify subscriptions and unlock features: contract (Art. 6(1)(b)).
Providing a free trial, with or without an account: performance of a contract and pre-contractual steps taken at your request (Art. 6(1)(b)).
Sending the trial reminder you asked for by giving us your e-mail address: consent (Art. 6(1)(a)), which you may withdraw at any time.
Security, fraud prevention, enforcing limits: legitimate interests (Art. 6(1)(f)).
Diagnostics and stability: legitimate interests (Art. 6(1)(f)).
Analytics and any marketing: consent (Art. 6(1)(a)).
Legal, tax and accounting obligations: legal obligation (Art. 6(1)(c)).

4. AI Features (Future)

AI features such as AI-generated subtitles are not currently active or offered as part of the Zofa TV product. If such features are introduced in the future, audio would be processed entirely on your device to generate a text transcript. No audio or transcript data would leave your device. Transcripts would be displayed locally and not used to profile you.

5. Cloud Backup and Sync

Cloud backup and device synchronisation are currently not offered. If these features are introduced in the future, this Policy will be updated accordingly.

We do not sell personal data. We share it only with processors acting on our instructions under a data-processing agreement: Supabase (EU region) for database, authentication and backend functions, Vercel Inc. (United States) for website hosting and content delivery, Resend for transactional e-mail, and Stripe for payment processing. Where you choose to sign in with Google or Apple, that company learns that you signed in to Zofa TV and acts as an independent controller for your account with them; we share nothing further with them. We also share data with app-store platforms for any purchase made through them, with authorities where legally required, and with a successor in a corporate transaction under this Policy.

7. International Transfers

Some processors are established outside the EEA, in particular in the United States (Vercel for website hosting, Stripe for payments, Resend for e-mail). For these transfers we rely on appropriate safeguards: the EU–U.S. Data Privacy Framework adequacy decision where the processor is certified under it, and otherwise the European Commission’s Standard Contractual Clauses. A copy of the safeguards can be requested via the contacts below.

8. Retention

Account data: deleted immediately when you delete your account; copies in our encrypted backups disappear within 90 days.
Connection/security logs: 90 days.
Trial records (device identifier, trial dates and any e-mail address given to extend a trial): deleted 12 months after the trial ends, or sooner on request.
Records of e-mails we sent you: 24 months, or until you delete your account, whichever comes first.
Diagnostics/analytics: not applicable — diagnostics stay on the device.
Purchase and invoicing records: as required by Belgian tax law (up to 7–10 years).
Support messages: 24 months after closure.

9. Your Rights

You have the right to access, rectification, erasure, restriction, data portability, objection (including to any direct marketing at any time), and to withdraw consent at any time. We do not carry out solely automated decision-making with legal effects. Exercise your rights via privacy@zofa.tv; we respond within one month. You may lodge a complaint with the Belgian Data Protection Authority (Gegevensbeschermingsautoriteit), Drukpersstraat 35, 1000 Brussels, contact@apd-gba.be, www.gegevensbeschermingsautoriteit.be, or with your local EU supervisory authority.

10. Account Deletion and Data Export

You can delete your account in the Zofa TV phone and tablet apps (Settings > Delete account) and via zofa.tv/en/legal/account-deletion. You can download your data from your account page, or e-mail privacy@zofa.tv. See the Account Deletion and GDPR Statement pages for details.

11. Children

The Service is intended for users aged 18+ and is not directed at children. We do not knowingly collect data from children.

12. Security

We use appropriate technical and organisational measures, including encryption in transit, hashed passwords, access controls and data minimisation. We will notify you and the authorities of a personal-data breach where legally required.

13. Changes

We may update this Policy; the current version is always on zofa.tv with a revised date. Material changes are notified where required.

14. Contact

Lumetrix BV, Exelgaarden 20, 3550 Heusden-Zolder, Belgium — BE 1029.601.154

Privacy: privacy@zofa.tv
General: info@zofa.tv

15. Language

This Policy is published in several languages for your convenience. Where a translation differs from the English version, the English version applies.