Privacy Policy

Zootric LLC ("Zootric", "we", "us") makes and runs Zaprik.

You can reach us about privacy at the email address above. We have not appointed a data protection officer, and we have not appointed a representative in the European Union or the United Kingdom. If the law requires us to appoint either before we start a kind of processing, we will appoint them before that processing starts and name them here.

• For account data, meaning the details of the people who are invited to use Zaprik and how they sign in, Zootric LLC decides why and how the data is used. In data protection terms we are the controller (in California, the business).
• For tenant data, meaning the business information, contacts, prospects, conversations and content that our customers put into or create with Zaprik, the customer decides why and how it is used and we process it on the customer's instructions. In data protection terms the customer is the controller and we are the processor (in California, the service provider).
• If you are a person whose details a Zaprik customer holds or has used to contact you, the customer is the one responsible to you. Ask them first; we will help them answer you.

When we process tenant data for a customer, we commit to the following. This is the data processing agreement between us and the customer, and it forms part of the Terms of Service.

• We process tenant data only to provide Zaprik to the customer, on the customer's documented instructions, which are the customer's use of Zaprik and the settings it chooses, and our written agreements with it. We do not use tenant data to train AI models, to improve Zaprik for other customers, or for advertising. If we ever want to, we will ask first.
• Everyone at Zootric who can see tenant data is bound to keep it confidential.
• We apply the security measures described in Section 10, and no others are promised.
• We use only the subprocessors in Section 7, and we give 30 days' notice before adding one (see Section 7).
• We help the customer answer requests from the people whose data it holds, as far as we reasonably can, and we pass such requests on to the customer.
• We tell the customer about a personal data breach affecting its tenant data as Section 11 says.
• When the customer ends its account, we delete its tenant data within 30 days of the request, and send it a copy first if it asks. We keep only what the law requires and the audit log entries described in Section 9.
• On request we give the customer the information we reasonably hold that shows we are meeting these commitments. We do not currently offer on-site audits.
• If a customer needs standard contractual clauses or a signed agreement in a particular form, it can ask at hello@zootric.com and we will work with it in good faith before we process regulated personal data for it from the European Economic Area, the United Kingdom or Switzerland.

This is what the application stores now, from the code and database design in the repository.

• Accounts: a name, an email address and, for password sign-in, a password hash. Accounts are created by invitation, not by public sign-up.
• Passwords are hashed by the authentication library (scrypt) and are not stored in plain text.
• Sessions: a session token, its expiry and timestamps. A session record also holds an IP address and a user agent, but only if a trusted proxy header has been configured for the deployment; otherwise IP tracking is switched off and neither is stored.
• Sessions last seven days and are refreshed daily.
• Failed sign-in counters are keyed with a keyed hash (HMAC), so that table holds neither the email address nor the client address.
• The audit log records who or what acted, the action, the entity, the result, a decision summary, cost and correlation ids. It does not hold chain-of-thought or secrets.
• The audit log can only be added to by the application; it cannot be edited or deleted by it.
• The audit log identifies a person who acted by an internal account identifier.
• Workspace data: the business profile, founder identity settings, goals, plans, tasks, approvals, budgets, reservations and usage events.
• Logs are structured and redacted, and carry a tenant id and run reference rather than free-form content.
• The early-access request on the public page is a mailto link that opens your own mail app. The site itself collects and stores nothing from visitors.

If you email us, we keep the email and our replies. Our hosting providers keep their own technical logs (see Section 7).

Today no real message, call, post or advertisement has been sent through Zaprik, and no outside platform account is connected, because every connection is a labelled simulation.

• No connection to an outside platform has made a real provider call. The only connector is a labelled simulation that sends nothing and contacts nothing.

None of the following is happening yet. It is what the product is designed to handle once connections are real. We will update this policy and our list of providers before any of it starts.

• Prospects and contacts: name, channel, address, where they were found, the basis for contacting them, their region and any opt-out; and the conversations and calls with them.
• Calls: a transcript reference, a consent reference and a retention date are designed in. Voice, recordings and transcripts are only to be used with a consent record, and retention and consent are requirements of the voice feature, which is not built.
• Likeness and voice: a rights record holds who granted permission, for what, the evidence and any revocation. Revoked consent blocks use at once.
• Payments: card payments are planned through Stripe, which is not integrated. Card numbers are not to be stored in transcripts; payment is by secure link.

Zaprik does not collect face scans, voiceprints or other biometric identifiers today. Before any feature does, we will say so here and ask for the consent the law requires. Customers must not load such identifiers into Zaprik without the notice and written consent the law requires (Terms of Service, Section 8).

The public pages (the home page, the Terms and this policy) set no cookies. Signing in sets two cookies. Changing a display setting in the signed-in app (theme, table density, sidebar, keyboard shortcuts) sets up to four more, and no others:

• better-auth.session_token

  Type

  Strictly necessary

  Purpose

  Keeps you signed in. It holds a signed session token that matches a session record in our database.

  Lasts

  Up to seven days, refreshed at most daily while you use the app; removed when you sign out.

  Flags

  HttpOnly, SameSite=Lax, Secure over HTTPS (the name is then prefixed __Secure-).

• zp_flash

  Type

  Strictly necessary

  Purpose

  Shows a one-line confirmation (for example, that a decision was recorded) on the next page you see after you press a button while signed in. It holds that short message and nothing else.

  Lasts

  Four seconds.

  Flags

  HttpOnly, SameSite=Lax.

• zp-theme

  Type

  Display preference you chose

  Purpose

  Remembers whether you chose the light, dark or system theme, so the page is drawn that way from the first paint. It holds one word.

  Lasts

  One year, or until you clear it.

  Flags

  Readable by the page, SameSite=Lax, set only when you change the setting.

• zp-density

  Type

  Display preference you chose

  Purpose

  Remembers whether you chose comfortable or compact tables. It holds one word.

  Lasts

  One year, or until you clear it.

  Flags

  Readable by the page, SameSite=Lax, set only when you change the setting.

• zp-shortcuts

  Type

  Display preference you chose

  Purpose

  Remembers if you turned the single-key keyboard shortcuts off. It holds the word off, and is only written when you change the setting.

  Lasts

  One year, or until you clear it.

  Flags

  Readable by the page, SameSite=Lax, set only when you change the setting.

• zp-sidebar

  Type

  Display preference you chose

  Purpose

  Remembers whether you collapsed the sidebar. It holds one word.

  Lasts

  One year, or until you clear it.

  Flags

  Readable by the page, SameSite=Lax, set only when you change the setting.

• These are the only cookies the application sets. The first two are strictly necessary: one keeps you signed in and the other shows a short confirmation. The four display-preference cookies each hold one short word and are written only when you change that setting. None is used for advertising or measurement.
• No cookie cache, account-data cookie or remember-me cookie is switched on, and the code does not use local storage or session storage.
• The web app includes no analytics, advertising or tracking package, so there are no cookies from those.
• Fonts are served from our own site, so loading them does not contact a third party.

Because the first two cookies are strictly necessary and the other four only store a display setting you chose yourself, we do not show a cookie banner. If we add analytics or anything non-essential, we will ask for consent first where the law requires it and update this list.

We use account data to create and secure accounts, let you sign in, run the service, keep an audit trail of what the platform did, talk to you about it, and meet our legal duties. We do not use personal data for advertising, we do not build advertising profiles, and we do not sell it.

Where the GDPR or the UK GDPR applies, these are the legal bases we rely on for account data:

• Performing the contract with you or taking steps you ask for before it (running your account, signing you in).
• Our legitimate interests in keeping the service secure, preventing abuse and keeping an audit trail, balanced against your rights (for example sign-in throttling and the audit log). You may object to this use (see Section 12).
• Legal obligation (for example tax, accounting and responding to lawful requests).
• Consent, where we ask for it, which you may withdraw at any time (nothing currently depends on consent).

For tenant data we act only on the customer's documented instructions, and the customer is responsible for having a legal basis for contacting and processing the people on its lists.

We do not sell personal data, and we do not share it for cross-context behavioural advertising. We use the providers below to run Zaprik. This is the complete list of providers that receive data today:

• Only the hosted web app and the hosted database exist. The workflow worker is not deployed, and no AI model, email, SMS, voice or payment provider is chosen or connected.

• Before a new provider receives tenant data, we will update this page and email the customers whose data it would receive at least 30 days ahead, unless the law or an emergency requires a faster change, in which case we will tell them as soon as we can.
• A customer that objects to a new provider on reasonable data protection grounds can email us within that time. If we cannot reasonably avoid using the provider for that customer, the customer may close its account and we will delete its data as Section 9 says.
• Vercel and Neon publish their own terms and privacy policies. We have not made any claim here about their certifications.

We may also disclose data where the law requires, to protect rights and safety, or to a buyer if the business is sold (with notice, and with this policy still applying).

Zootric is in the United States and our providers may process data in the United States and other countries. This page does not state where our providers' servers are, because we have not fixed or recorded that; ask us at hello@zootric.com and we will tell you what we know.

Where personal data from the European Economic Area, the United Kingdom or Switzerland is transferred to a country without an adequacy decision, we will use an approved safeguard, such as the standard contractual clauses and the UK addendum, or an adequacy framework such as the EU-US Data Privacy Framework for a provider that participates in it. We have not yet signed these safeguards with our providers or with customers. Until we have, early access is not meant for processing the personal data of prospects in those regions, and we will put the safeguards in place before we process such data as a processor.

We are early in building, and this is the honest position.

• Sessions expire after seven days.
• The audit log is insert-only, so the application itself cannot remove a row from it.
• Self-service export, deletion and cancellation are planned for Phase 2 and are not built.
• The backup method and schedule for the hosted database are not yet defined.

There are no automated retention periods and no scheduled deletion yet. Today a person at Zootric does these things by hand, so the periods below are ones a person can keep.

• Account data and workspace data: kept while the account exists. When you ask us to close your account, or we close it, we delete this data within 30 days of the request, and send you a copy first if you ask, except what we must keep by law and the audit log entries described below.
• Deletion requests: if you ask us to delete your personal data without closing your account, we do it within 30 days of verifying who you are, except what we must keep, and we tell you what we kept and why.
• Audit log: the entries identify a person who acted only by an internal account identifier. They are kept so we can show what the platform did and why. When we delete your account we delete your name and email address, so the remaining entries no longer name you. We do this by hand, because there is no deletion tool yet.
• Emails to us: kept for as long as we need them to answer you and keep a record, and deleted on request subject to the law.
• Backups and provider logs: our hosting providers keep their own backups and request logs. We have not defined or reviewed their retention, so a copy of deleted data may remain in them until the provider's own cycle removes it.
• Opt-out and suppression entries (when contact handling is live): kept for as long as is needed to honour the opt-out, because deleting an entry would risk contacting the person again. Only the contact address and the fact of the opt-out are kept.
• Call recordings and transcripts (not built): each will carry a retention date and a consent record, and we will state the default period here before the feature starts.
• Payment and invoice records (billing not built): kept for as long as tax and accounting law requires.

What is built today:

• Each customer's data is separated in the database by row-level security that is forced on tenant tables, and the application role cannot bypass it.
• The tenant is never taken from a request supplied by the client.
• Sign-in is throttled and repeated failures lock out, and other authentication routes are rate limited.
• Passwords are hashed.
• Connections use HTTPS with HTTP Strict Transport Security, framing is denied, the referrer is limited and a content security policy with a per-request nonce is set.
• A policy check decides every action before it can leave the platform, and a real action needs a connection verified live. Secrets are designed never to go into prompts, logs or events.

What is not built yet:

• The secret store is not yet built, so the product does not yet store customers' third-party credentials. When it is built, secrets are designed to be encrypted with envelope AES-256-GCM. Until then, do not treat stored credentials as encrypted by Zaprik.
• Backups, key backup and restore drills on the hosted database are not yet defined.

We hold no SOC 2 report and no ISO 27001 certificate, and no independent security audit has been carried out. Our testing is our own. No system is perfectly secure, and we cannot promise otherwise.

We do not yet have a written incident-response plan. We commit to this regardless. If we become aware of a personal data breach affecting data we hold as a controller, or tenant data we process for a customer, we will investigate and limit the harm.

• We will tell each affected customer without undue delay after we confirm the breach, with what we know about what happened, what data is involved and what we are doing.
• Where we are the controller, we will tell the regulator and affected people within the time the law sets (72 hours to the regulator under the GDPR where it applies).
• We will tell customers what we know even if it is incomplete, and update them as we learn more.

You can ask us at hello@zootric.com to do any of the following, and we will not charge you for asking or treat you worse for doing it. Today we handle these requests by email and by hand; there is no self-service tool yet.

If the GDPR or the UK GDPR applies to you, you may ask us to:

• give you a copy of your personal data and information about how we use it;
• correct data that is wrong or incomplete;
• erase your data in the cases the law provides;
• restrict our use of your data in the cases the law provides;
• give you your data in a portable form, or object to our use of it, where the law provides; and
• stop relying on consent you gave. You may also complain to your data protection authority (in the UK, the Information Commissioner's Office).

If California law applies to you, you may ask us to tell you what personal information we collect, use, disclose and keep, to give you a copy, to delete it, to correct it, and to limit our use of sensitive personal information. We do not sell or share personal information as those words are defined in California law, so there is nothing to opt out of; if that ever changes we will say so and give you the choice. Zootric may be too small to be a business covered by California law, but we offer these rights to California residents anyway. You can use an authorised agent, and we may need to verify who you are. We offer the same rights, as far as the law of your state gives them, to residents of other US states.

If we hold your data only because a Zaprik customer put it in, tell us who contacted you and we will pass your request to that customer, who is responsible for answering it.

We will reply to a request within 30 days of receiving it. If a request is complex or we need to verify who you are, we may take longer where the law allows, and we will tell you why before the 30 days end.

Zaprik is for businesses and is not meant for anyone under 18. We do not knowingly collect personal data from children under 18. If you think a child has given us data, tell us and we will delete it. Customers must not use Zaprik to target children, and must remove from their lists anyone they know or have reason to believe is under 18, or is under the age at which the law of their country treats a child as unable to consent to being contacted.

We will update this policy as Zaprik changes, in particular before any new provider receives data or any of the planned processing in Section 4 starts. We will post the new version here with its version number and effective date, and tell account holders by email before a material change takes effect.

Questions, requests or complaints about privacy: