Privacy policy
LAST UPDATED: OCT 12, 2026
1. Who We Are (Data Controller)
Zora Player (“we,” “us,” or the “Developer”) is the data controller responsible for the personal data described in this Privacy Policy. For any question or request regarding your data, contact us at soporte@zoraplayer.com.
2. What Data We Collect
Your email and password (encrypted) for your account; your IPTV list data (provider URL, username, and password), stored encrypted; and basic technical data such as your activated devices and playback progress, used for sync.
3. Legal Bases for Processing
We process your personal data on the following legal bases under Article 6 of the GDPR: (a) performance of a contract, to create and operate your account and provide the Service you requested; (b) your consent, for session recording (Session Replay), which is off until you turn it on and which you can withdraw at any time; and (c) our legitimate interest in keeping the Service secure, understanding how it is used, and improving it, where that interest does not override your rights and freedoms. You can object to processing based on our legitimate interest from My account, under Privacy. Analytics starts when the site loads, so identifiers are stored in your browser from your first visit; you can turn it off at any time from My account, under Privacy.
4. How We Use Your List Credentials
Your provider's credentials are stored encrypted and used only to connect your player to your server. You can delete them anytime from My account.
5. Payments
Payments are processed through PayPal. We don't store your card details; PayPal handles that information under its own policy.
6. Who We Share Data With, We Don't Sell Your Data
We do not sell or rent your personal data to anyone, under any circumstances. We only share the minimum data necessary with the infrastructure, payment, and analytics providers required to operate the Service (for example, our hosting provider, PayPal, and Amplitude), each bound by its own data protection obligations.
7. Analytics and Session Replay
We use Amplitude to understand how the product is used and to improve it. We collect usage events from the moment the site loads, on the basis of our legitimate interest, and you can turn them off at any time from My account, under Privacy. Those events carry a device identifier and, if you sign in, your internal account identifier (never your email or password), so we can understand how an account uses the Service across sessions; this data is not anonymous, it is pseudonymised. On this website we may also use Amplitude Session Replay to record on-page interactions: it is off, and it only starts if you turn it on yourself under Privacy, and form fields are always masked, passwords included. The TV app collects usage events only, no Session Replay. This data is processed by Amplitude on EU-based servers, used solely to understand and improve the product, and never sold. You can request deletion of this data at soporte@zoraplayer.com.
8. International Data Transfers
Your analytics data is processed on servers located in the European Union. If any of our providers were to transfer personal data outside the European Economic Area, that transfer would be safeguarded through the European Commission's Standard Contractual Clauses (SCCs) or another mechanism recognized as providing an adequate level of protection.
9. Data Retention
We keep your data while your account is active. When you delete your account, we erase your list credentials and personal data, except where the law requires us to retain it for a longer period.
10. Your Rights Under the GDPR
If the GDPR applies to you, you have the right to: access the personal data we hold about you; request rectification of inaccurate data; request erasure of your data; request restriction of processing; receive your data in a portable format; object to processing based on our legitimate interest; and withdraw your consent at any time, without affecting the lawfulness of processing carried out before the withdrawal. To exercise any of these rights, write to us at soporte@zoraplayer.com. If you believe your rights have not been respected, you also have the right to lodge a complaint with the Spanish Data Protection Agency (Agencia Española de Protección de Datos, AEPD), at www.aepd.es.
11. Cookies and Local Storage
We don’t use tracking cookies or third-party cookies. The portal stores the following in your browser: your session token and the profile you picked, in sessionStorage, which are cleared when you close the tab; your privacy choices (whether you want analytics and whether you turn on session recording), in localStorage, so we don’t ask you again and so a refusal is remembered; the identifiers and configuration Amplitude needs for analytics, for its in-product messages and for session recording if you turn it on, also in localStorage; and a cookie with the language you chose. You can turn analytics and recording off from My account, under Privacy, and clear whatever is left by clearing this site’s data in your browser. None of this is used to track you across other websites.
12. Minors
The Service is not directed at, or intended for use by, minors under the legal age applicable in their country of residence. We do not knowingly collect personal data from minors.
13. Users Outside the EU/EEA
If you are located outside the European Union or the European Economic Area, the laws of your own country may grant you additional or different data protection rights; this Policy applies to everyone using the Service in addition to, and without limiting, any such rights.
14. Contact
Privacy questions: soporte@zoraplayer.com.
Privacy controls
Usage data is collected by default to understand how the product is used. Session recording captures how you move around the screen and is only enabled if you accept. Everything is processed on servers in the European Union and never includes your email or password.