Privacy Policy

1. Introduction

Welcome to Zippr ("we," "our," or "us"). We are committed to protecting your personal information and your right to privacy. This Privacy Policy explains how we collect, use, disclose, and safeguard your information when you use our platform at gozippr.com (the "Service").

Zippr is a B2B SaaS CRM and operations platform designed for apparel decoration businesses, including screen printing, embroidery, and promotional products companies. Our Service includes AI-powered features, integrations with third-party services, and comprehensive business management tools.

By using our Service, you agree to the collection and use of information in accordance with this Privacy Policy. If you do not agree with our policies and practices, please do not use our Service.

2. Information We Collect

2.1 Information You Provide Directly

We collect information that you voluntarily provide when using our Service:

• Account Information: Name, email address, password, company name, phone number, billing address, and payment information.
• Profile Data: User preferences, settings, communication preferences, and organizational role information.
• Business Data: Customer contact information (names, emails, phone numbers, addresses), quotes, invoices, work orders, production schedules, and business communications.
• File Uploads: Artwork files, documents, proofs, logos, and other files you upload to our platform. You are responsible for ensuring you own or are licensed to use the rights (including copyrights and trademarks) in the media you upload; Zippr does not review uploads for intellectual property status and is not responsible for uploaded content that infringes third-party intellectual property rights, as described in our Terms of Service.
• Communication Data: Messages, support inquiries, feedback, and correspondence with our team.
• Integration Data: Information from third-party services you connect (Gmail, Google Calendar, QuickBooks), including OAuth tokens and synchronized data.

2.2 Information Collected Automatically

We automatically collect certain information when you use our Service:

• Usage Data: Pages visited, features used, time spent on pages, navigation paths, and interaction patterns.
• Device Information: Browser type and version, operating system, device identifiers, screen resolution, and device settings.
• Location Data: IP address, general geographic location derived from IP address.
• Cookies and Tracking Technologies: Session cookies, preference cookies, analytics cookies, and similar tracking technologies. See our Cookie Policy for details.
• Log Data: Server logs, error reports, performance data, and security-related information.

2.3 Information from Third-Party Sources

• Authentication Providers: When you sign in using Google or other OAuth providers, we receive your name, email, and profile information.
• Integrated Services: Data synchronized from Google Workspace (Gmail, Calendar), QuickBooks, and other connected services.
• Payment Processors: Transaction data and payment confirmation from our payment processing partners.

3. How We Use Your Information

We use the collected information for the following purposes:

3.1 Service Provision and Performance

• Create and manage your account and organization
• Provide CRM, quoting, invoicing, and production management features
• Generate AI-powered mockups using Google AI services
• Process and store your business data securely
• Enable integrations with Google Workspace, QuickBooks, and other services
• Facilitate email automation and communication sequences
• Provide file storage and management capabilities

3.2 Communication

• Send transactional emails (account notifications, password resets, invoices)
• Provide customer support and respond to inquiries
• Send service updates, security alerts, and administrative messages
• Deliver marketing communications (with your consent, where required)

3.3 Improvement and Analytics

• Analyze usage patterns to improve our Service
• Monitor performance, diagnose technical issues, and fix bugs
• Conduct research and development for new features
• Generate aggregated, anonymized analytics and reports

3.4 Security and Compliance

• Detect, prevent, and address fraud, security breaches, and prohibited activities
• Enforce our Terms of Service and protect our legal rights
• Comply with legal obligations and regulatory requirements
• Maintain audit trails and activity logs for security purposes

3.5 Business Operations

• Process payments and manage subscriptions
• Conduct business transfers (mergers, acquisitions, asset sales)
• Manage customer relationships and provide account services

4. Legal Basis for Processing (GDPR)

If you are located in the European Economic Area (EEA), United Kingdom, or Switzerland, we process your personal data under the following legal bases:

• Contract Performance (Article 6(1)(b) GDPR): Processing necessary to provide our Service and fulfill our agreement with you.
• Legitimate Interests (Article 6(1)(f) GDPR): Processing for service improvement, fraud prevention, security, and business operations, where our interests do not override your rights.
• Consent (Article 6(1)(a) GDPR): Where you have explicitly consented to processing for specific purposes (e.g., marketing communications).
• Legal Compliance (Article 6(1)(c) GDPR): Processing necessary to comply with legal obligations, court orders, or regulatory requirements.
• Vital Interests (Article 6(1)(d) GDPR): Processing necessary to protect vital interests in emergency situations.

5. Data Sharing and Disclosure

We do not sell your personal information. We may share your information in the following circumstances:

5.1 Service Providers

We share data with trusted third-party service providers who perform services on our behalf, including:

• Cloud infrastructure and hosting (Supabase, Amazon Web Services)
• Google (Gemini AI services; Maps route optimization for sales-route features)
• Email delivery services (Resend)
• Payment processing (Stripe)
• Analytics providers
• Customer support tools

5.2 Business Transfers

In connection with any merger, sale of company assets, financing, acquisition, or business transfer, your information may be transferred to the acquiring entity.

5.3 Legal Requirements

We may disclose your information if required by law, court order, subpoena, or government request, or to:

• Comply with legal processes and obligations
• Protect our rights, property, or safety
• Investigate fraud or security issues
• Enforce our Terms of Service
• Protect against legal liability

5.4 With Your Consent

We may share your information for other purposes with your explicit consent.

5.5 Aggregated or Anonymized Data

We may share aggregated, anonymized data that cannot reasonably be used to identify you for analytics, research, or marketing purposes.

6. Third-Party Services

Our Service integrates with and uses the following third-party services:

6.1 Supabase (Infrastructure)

We use Supabase for authentication, database, and file storage. Supabase processes data in accordance with their privacy policy and uses AWS infrastructure with encryption at rest and in transit.

6.2 Google (AI and Maps Services)

We use Google AI services for AI-powered features such as mockup generation. When you use AI features, your prompts and generated content may be processed by Google in accordance with their Privacy Policy and data processing terms. If you use sales-route features, the addresses and locations of your route stops are sent to Google's Maps and Route Optimization APIs to calculate and optimize routes. These services do not access your Google account.

6.3 Google Workspace

Google Workspace integrations are optional. Google sign-in uses your basic Google profile (name, email address, and profile picture) for authentication. Gmail send access lets Zippr send messages from the Gmail account you connect; this does not require inbox access. Messages you send through the Service — including automated email sequences you configure — may be sent from your connected Gmail account, and sent-message records may store the recipient, subject, delivery metadata, and your message content for CRM history. If you explicitly enable Gmail read or thread sync, Zippr can read selected Gmail message metadata and thread content to show inbox activity and log CRM history; enabling thread sync authorizes both reading and sending, while send-only and read-only connections request narrower permissions. By default, stored Gmail CRM records are limited to operational metadata such as message IDs, thread IDs, subject, participants, timestamps, and snippets or user-selected excerpts, not full message bodies or attachment contents; full message content is processed transiently when syncing tracked threads and when you view a thread, but is not stored by default. Google Calendar access is used to list connected calendars and read or create calendar events when you use calendar features; calendar records store the selected calendar ID, calendar name, timezone, and sync status, and event details are fetched from Google when you use calendar features.

We store Google OAuth tokens (including refresh tokens) securely for connected integrations so that features you enable — such as scheduled email sequences and background sync — can operate on your behalf even when you are not actively using the Service. We use Google user data only to provide or improve visible email and calendar features. Google connections are personal to the user who authorizes them. Authorized organization members may see CRM records created through enabled features, but cannot select another member's Gmail account for a new send. We maintain an audit log of integration authorization activity (connections and disconnections) for security and troubleshooting purposes.

You can review your connected Google accounts, the specific permissions you have granted, and a summary of the Google-derived data we store in your integration settings, and you can disconnect Google integrations there at any time. Disconnecting removes local token material and requests revocation of Zippr's access at Google (you can also revoke access directly in your Google Account settings); you may also choose to have stored Google-derived CRM data deleted or redacted when disconnecting. Google-derived metadata and user-selected excerpts are retained for up to 180 days unless deleted sooner or retained as required for security, legal, or operational reasons. Zippr's use of information received from Google APIs adheres to the Google API Services User Data Policy, including the Limited Use requirements.

6.4 QuickBooks

When you connect QuickBooks, we access and synchronize accounting data through their API. We store OAuth tokens securely and comply with Intuit's data handling requirements.

6.5 Resend (Email Delivery)

We use Resend for transactional email delivery. Email addresses and message content are processed through their service.

6.6 Stripe (Payment Processing)

We use Stripe to process payments and manage subscriptions. When you make a payment or subscribe to our Service, Stripe collects and processes your payment information (such as credit card details, billing address, and transaction history) directly. We do not store your full payment card details on our servers. Stripe's use of your personal information is governed by their Privacy Policy. Stripe is PCI-DSS Level 1 certified, the highest level of payment security certification.

Important: These third-party services have their own privacy policies. We encourage you to review their policies to understand how they handle your data. We are not responsible for the privacy practices of third-party services.

7. Data Retention

We retain your personal information for as long as necessary to fulfill the purposes outlined in this Privacy Policy, unless a longer retention period is required or permitted by law.

Retention Periods:

• Account Data: Retained while your account is active and for 90 days after account closure (unless you request immediate deletion).
• Business Data: Retained according to your data retention settings, with a maximum of 7 years for compliance with tax and accounting regulations.
• Transaction Records: Retained for 7 years to comply with financial regulations and tax requirements.
• Usage Logs: Retained for 12 months for security and analytics purposes.
• Security Logs: Retained for 24 months for fraud prevention and security investigations.
• Marketing Data: Retained until you unsubscribe or withdraw consent, then deleted within 30 days.

After retention periods expire, we securely delete or anonymize your personal information. Some information may be retained in backups for up to 90 days before permanent deletion.

8. Data Security

We implement industry-standard security measures to protect your personal information:

Technical Safeguards:

• Encryption: Data encrypted in transit (TLS/SSL) and at rest (AES-256)
• Access Controls: Role-based access control (RBAC) and row-level security (RLS)
• Authentication: Strong password requirements, OAuth 2.0, and optional multi-factor authentication
• Network Security: Firewalls, intrusion detection, and DDoS protection
• Regular Audits: Security assessments, vulnerability scanning, and penetration testing

Organizational Safeguards:

• Limited employee access to personal data on a need-to-know basis
• Confidentiality agreements with employees and contractors
• Regular security training and awareness programs
• Incident response and breach notification procedures
• Vendor security assessments and contractual safeguards

Data Breach Notification: In the event of a data breach affecting your personal information, we will notify you and relevant authorities within 72 hours as required by applicable law, unless notification would impede a criminal investigation.

While we strive to protect your personal information, no method of transmission or storage is 100% secure. You are responsible for maintaining the security of your account credentials and should notify us immediately of any unauthorized access.

9. Your Privacy Rights

Depending on your location, you may have the following rights regarding your personal information:

General Rights:

• Right of Access: Request a copy of the personal information we hold about you
• Right to Rectification: Request correction of inaccurate or incomplete information
• Right to Deletion: Request deletion of your personal information (subject to legal exceptions)
• Right to Restrict Processing: Request limitation on how we use your data
• Right to Data Portability: Receive your data in a structured, machine-readable format
• Right to Object: Object to certain types of processing, including direct marketing
• Right to Withdraw Consent: Withdraw previously given consent at any time

How to Exercise Your Rights:

To exercise any of these rights, you can:

• Access your account settings to update or delete information
• Use the data export feature to download your data
• Contact us at hello@gozippr.com with your request
• For GDPR requests, contact our Data Protection Officer (contact details below)

Response Time: We will respond to your request within 30 days (45 days for California residents under CCPA). We may require additional information to verify your identity before processing your request.

Right to Lodge a Complaint: You have the right to file a complaint with your local data protection authority if you believe we have violated your privacy rights.

10. International Data Transfers

Zippr operates in the United States. If you are located outside the United States, please be aware that information we collect will be transferred to, stored, and processed in the United States and other countries where our service providers operate.

Safeguards for International Transfers:

When transferring personal data from the EEA, UK, or Switzerland to the United States or other countries, we implement appropriate safeguards:

• Standard Contractual Clauses (SCCs): We use EU Commission-approved Standard Contractual Clauses for data transfers
• Adequacy Decisions: We rely on adequacy decisions where applicable
• Data Processing Agreements: Our service providers sign data processing agreements ensuring GDPR-compliant data handling
• Additional Security Measures: Encryption, access controls, and regular security audits

By using our Service, you acknowledge and consent to the transfer of your information to the United States and other countries for processing as described in this Privacy Policy.

11. Children's Privacy

Zippr is a B2B service intended for business use by adults. Our Service is not directed to individuals under the age of 18, and we do not knowingly collect personal information from children under 18.

If you are a parent or guardian and believe your child has provided us with personal information, please contact us at hello@gozippr.com. If we discover that we have collected personal information from a child under 18, we will delete that information promptly.

12. California Privacy Rights (CCPA/CPRA)

If you are a California resident, you have specific rights under the California Consumer Privacy Act (CCPA) and California Privacy Rights Act (CPRA):

Your California Rights:

• Right to Know: Request disclosure of personal information collected, used, shared, or sold in the past 12 months
• Right to Delete: Request deletion of your personal information (subject to exceptions)
• Right to Correct: Request correction of inaccurate personal information
• Right to Opt-Out: Opt out of the "sale" or "sharing" of personal information (we do not sell personal information)
• Right to Limit Sensitive Personal Information: Limit use of sensitive personal information
• Right to Non-Discrimination: Equal service and pricing, regardless of privacy rights exercise

Categories of Personal Information We Collect:

• Identifiers: Name, email, phone number, IP address, account ID
• Commercial Information: Purchase history, billing information, subscription details
• Internet Activity: Browsing history, usage data, interactions with our Service
• Professional Information: Company name, role, business information
• Inferences: Preferences and characteristics derived from usage patterns

How to Exercise Your California Rights:

To exercise your California privacy rights, contact us at:

• Email: hello@gozippr.com
• Subject line: "California Privacy Rights Request"

Verification: We will verify your identity before processing requests. We may request additional information to confirm your identity and California residency.

Authorized Agents: You may designate an authorized agent to make requests on your behalf. The agent must provide proof of authorization.

Do Not Sell My Personal Information: We do not sell personal information as defined by CCPA. We do not share personal information for cross-context behavioral advertising.

13. GDPR Rights (EU/UK Residents)

If you are located in the European Economic Area (EEA), United Kingdom, or Switzerland, you have additional rights under the General Data Protection Regulation (GDPR):

Your GDPR Rights:

• Right of Access (Article 15): Obtain confirmation of processing and a copy of your personal data
• Right to Rectification (Article 16): Correct inaccurate or incomplete personal data
• Right to Erasure (Article 17): Request deletion ("right to be forgotten") in certain circumstances
• Right to Restrict Processing (Article 18): Limit processing in specific situations
• Right to Data Portability (Article 20): Receive your data in a structured, machine-readable format
• Right to Object (Article 21): Object to processing based on legitimate interests or direct marketing
• Rights Related to Automated Decision-Making (Article 22): Not be subject to solely automated decisions with legal or significant effects
• Right to Withdraw Consent: Withdraw consent at any time where processing is based on consent

Data Protection Officer:

For GDPR-related inquiries, you may contact our Data Protection Officer:

• Email: hello@gozippr.com
• Subject line: "GDPR Data Protection Officer"

Right to Lodge a Complaint:

You have the right to lodge a complaint with your local supervisory authority if you believe we have violated GDPR. Contact information for EU supervisory authorities can be found at: https://edpb.europa.eu/about-edpb/board/members_en

Response Time:

We will respond to GDPR requests within one month of receipt. This period may be extended by two additional months where necessary, considering the complexity and number of requests. We will inform you of any extension within one month of receipt of the request.

14. Changes to This Privacy Policy

We may update this Privacy Policy from time to time to reflect changes in our practices, technology, legal requirements, or other factors. When we make changes, we will:

• Update the "Last Updated" date at the top of this policy
• Notify you via email if changes are material (where we have your email address)
• Display a prominent notice on our Service
• For significant changes affecting GDPR rights, obtain your consent where required

Your continued use of the Service after changes become effective constitutes acceptance of the updated Privacy Policy. If you do not agree with changes, you should discontinue use of the Service and contact us to close your account.

We encourage you to review this Privacy Policy periodically to stay informed about how we protect your information.

15. Contact Us

If you have questions, concerns, or requests regarding this Privacy Policy or our privacy practices, please contact us:

For GDPR-specific inquiries: Please include "GDPR Data Protection Officer" in your subject line.

For California privacy requests: Please include "California Privacy Rights Request" in your subject line.