Privacy Notice

Interim English summary — last updated 12 September 2026

1. Who processes your data

Zapyo is operated by Flamin Joe Studio Dominika Kasprzyk, VAT ID (NIP) 5792303226 (contact: hej@flaminjoe.studio). Write to this address for any question about your data, including account or data deletion requests.

2. What we collect, in short

• Account email — to create your account and sign you in (password, Google account or one-time code).
• Content you enter — your clients, quotes, reminders and notes — so the app can store and show them back to you.
• Feedback you submit — to improve the product and reply to you.
• Push subscription — a device/browser identifier, only if you turn push notifications on.
• Billing data — email, customer ID at the payment provider, payment and invoice history, invoice details — to bill a paid plan, handle refunds and complaints, and meet tax and accounting duties (contract, Art. 6(1)(b), and legal obligation, Art. 6(1)(c) GDPR).
• Sign-in protection — IP address and browser characteristics checked by Cloudflare Turnstile on the login page, to keep bots out (legitimate interest, Art. 6(1)(f) GDPR).
• “Leak test” quiz answers on zapyo.app — score, answers, and optionally your email and a note (IP only to rate-limit submissions). If you leave an email, we send you the result with a repair plan and a reminder about the founding price (consent by providing the email, Art. 6(1)(a) GDPR); without an email the answers are anonymous.

We do not sell your data or build advertising profiles inside Zapyo. Measurement differs by surface: on the public zapyo.app marketing pages, Google Analytics and Meta Pixel may, after consent, measure page views, interactions and campaign source. Meta Pixel is disabled in the app.zapyo.app application. After consent, the app starts Google Analytics only when it submits an account-created event, with automatic page views, Google Signals and ad personalisation disabled. The event we submit contains the sign-up method (email or Google), an empty referrer and a fixed safe page address. It does not contain your email, Supabase user ID, client records, app content or the actual application route. The Supabase ID is used only in browser storage to prevent the same event from being sent twice and is never sent to Google.

The public marketing pages also use cookie-free Ahrefs Web Analytics for aggregate traffic measurement. Ahrefs stores the page URL and referrer, browser/device data, language and approximate location; the raw IP address is discarded and the daily hash is not a persistent identifier. This is based on our legitimate interest in evaluating our marketing pages (Article 6(1)(f) GDPR).

Google Analytics and Meta Pixel operate on the basis of your consent (Article 6(1)(a) GDPR and the applicable rules on storing information on a device). Refusing or later withdrawing consent does not limit the application. The providers nevertheless receive technical connection data such as IP address, browser and device information, and their own cookie/measurement identifiers; on marketing pages they may also receive the visited URL and referrer. Recipients are Google Ireland Ltd / Google LLC and — for the marketing surface only — Meta Platforms Ireland Ltd / Meta Platforms Inc. Ahrefs Pte Ltd also receives aggregate marketing-page measurement data. Depending on the provider and transfer, transfers outside the EEA rely on Standard Contractual Clauses (SCCs) or the EU–US Data Privacy Framework; Google Ireland Ltd processes Google Analytics data on our behalf as a processor. Consent is handled by the website's own mechanism (the open-source CookieConsent library): your choice is stored only on your device, in the cc_cookie file, and is not sent to any external provider. You can change or withdraw consent at any time through the “Cookie settings” button (in the footer of the marketing pages and in the account menu of the app); withdrawal removes Google Analytics and Meta Pixel cookies and does not limit your account. Withdrawal does not affect the lawfulness of earlier processing.

3. Your clients' data

If you store your own clients' details in Zapyo, you are the controller of that data and we process it only on your behalf and instructions, as a data processor. We don't look into it or use it for our own purposes, and it is deleted together with your account.

4. Where data lives

• Database: Supabase (Supabase Pte. Ltd.), Ireland region (AWS eu-west-1) — your data stays within the European Union, and GDPR applies in full.
• App hosting: Vercel Inc. — serves the application code, and every connection passes through it, so it processes technical request data (IP address, requested path, browser headers). We run no analytics there, and the contents of your database are neither copied nor stored on Vercel's side.
• Push delivery: your browser's own push service (Apple, Google, Mozilla); notification content is encrypted in transit.
• Payments: Stripe Payments Europe, Ltd. (Ireland) — handles payments and subscriptions. We pass on your email address and account identifier so a payment can be matched to an account. We neither receive nor store card details.
• Sign-in and system emails: Resend (Plus Five Five, Inc., USA) — delivers the messages with your sign-in code or link, sent from an address in the zapyo.app domain; it receives your email address and the message content. Sending happens from EU infrastructure (Ireland).
• Sign-in protection: Cloudflare, Inc. (USA) — the Turnstile check on the login page verifies that a request comes from a person; it processes the IP address and browser characteristics and sets no cookies on our domain.

Where a provider sits outside the EEA, transfers rely on Standard Contractual Clauses (SCCs) and a data processing agreement is in place.

5. How long we keep it

For as long as you keep your account. Deleting your account permanently deletes your data (including your clients' data) from the live database; database backups roll over on a cycle of up to 30 days.

Billing data and accounting records (at the payment provider and in our books) are kept after account deletion for the period required by tax and accounting law: 5 years from the end of the year in which the tax obligation arose.

“Leak test” answers are kept until the result has been sent and the founding offer has ended, then deleted; we delete them earlier on request. The IP address used for rate limiting serves that purpose only. Data processed by Cloudflare Turnstile is subject to Cloudflare's retention; we do not store it.

Google Analytics event and user data is subject to a retention setting of no more than 14 months. Under Meta's terms, Business Tools Event Data may be retained for up to two years. The app's local pending confirmed-signup event is removed after refusal or after the tag invokes its delivery-completion callback; without that callback it remains and is retried on the next app start. The consent choice and local duplicate-prevention marker remain until you change the privacy setting or clear the browser's site data. Ahrefs may retain aggregated measurement history without a fixed end date; you may object to that measurement by contacting the controller.

6. Your rights

Under GDPR you have the right to access, rectify, delete, restrict processing of, and port your data, and to object to processing. To exercise any of these — including deleting your account and all its data — email hej@flaminjoe.studio. We reply within 30 days, usually much sooner. We make no decisions about you based solely on automated processing, including profiling, that would produce legal or similarly significant effects (Art. 22 GDPR). You may also lodge a complaint with your local data protection authority, or with Poland's UODO (uodo.gov.pl), the supervisory authority for the controller named above.

7. Security

Connections are encrypted (TLS) and database access is isolated per user via Row Level Security — every user can reach only their own records. Passwords are stored only as cryptographic hashes (Supabase Auth); you can also sign in with a Google account or a one-time email code.

8. Changes

We'll announce material changes by email or in the app. The current version of both this summary and the binding Polish policy is always available at these addresses.