Privacy Policy

1) Roles & Scope

• For Contact Data (your end-customers), we act as your processor/service provider; you are the controller/organization.
• For website, account, billing, security logs, and product analytics, we are a controller.
• This Policy covers our websites, app, APIs, and integrations (GBP, Zapier, direct APIs, carriers, CRM/POS connectors).

2) Information We Process

• Account & billing: admin details, identifiers, transactions.
• Google connection data: OAuth tokens, account/location IDs, review/reply content within approved scopes.
• Contact Data: names, phone numbers, emails, tags/segments.
• Messaging metadata: timestamps, delivery status, opt-ins/opt-outs, reply codes.
• Device/usage: IP, user agent, telemetry, logs, cookie-like identifiers.
• Support: tickets, chat/email transcripts; optional call recordings (with notice).
• Free Review Kit sign-up: see Section 2A.
• Personalized images (if enabled): ephemeral generation of images with overlaid first name or business assets; no biometric identification.

2A) Free Review Kit Funnel Data

When you use the Free Review Kit funnel at app.zappycards.com/review-kit, we collect:

• Business details: your business name and Google Place details (such as place ID, name, address, phone, website, rating and review count) returned by Google Places when you search for and select your business. Your search text is sent to Google to return results.
• Contact details: your name, email and phone number.
• Shipping details: your shipping address and the number of cards you choose.
• Funnel and attribution data: the steps you complete, your A/B variant, and campaign details such as UTM parameters and fbclid (see Sections 2D and 2E).
• Consent records: your IP address, timestamp, the text you accepted, and checkout and cancellation logs (see Terms Section 6G).

We use this data to check eligibility, create your account, ship your cards, start and bill your trial or subscription, prevent duplicate or fraudulent offers, measure our advertising, and provide support.

2B) Payments (Stripe)

Payments, including free-trial sign-ups that require a card, are processed by Stripe. You enter your card details on Stripe's secure checkout. We never store full card numbers; we receive from Stripe limited information such as the card brand, the last four digits, expiry date, billing details, and subscription and payment status. Stripe acts under its own privacy policy and terms.

2C) Order Fulfilment (Shopify and Shipping Partner)

We fulfil card orders through Shopify and a shipping partner. We share your name, shipping address, phone number, email and card quantity with them for shipping and delivery purposes only, and they may not use it for their own marketing.

2D) Advertising Measurement (Meta Pixel and Conversions API)

On our marketing pages and the Free Review Kit funnel we use the Meta Pixel (a script from Meta Platforms) in your browser and the Meta Conversions API from our servers to measure whether our ads lead to sign-ups and to improve ad delivery. They may receive page views and events (for example StartTrial and InitiateCheckout), the click identifier fbclid and Meta cookie values (_fbp, _fbc), your IP address and browser details, and hashed (SHA-256) email address and phone number for matching to Meta accounts. The data we send to Meta relates to visitors and sign-ups on our own site and funnel, not to your end-customers (Contact Data). Meta handles this data under its own privacy policy.

Opting out: you can block the Meta Pixel with your browser's privacy settings or a tracker-blocking extension, manage ad preferences and off-Meta activity in your Facebook or Instagram settings (facebook.com/adpreferences), or email support@zappycards.com and we will stop sending your data to Meta. See also our Cookie Policy.

2E) Funnel Analytics

To understand where people drop off in the Free Review Kit funnel, we record page-step events (for example landing, qualify, account, cards, checkout and thanks). The events are linked to a random visitor id stored in your browser's localStorage (and a per-tab session id in sessionStorage), the A/B variant you were shown, and attribution fields such as UTM parameters and fbclid, and are sent to our servers. The visitor id is random and is not your name or email, but we may link it to your account when you sign up. You can clear it at any time by clearing your browser's site data. See our Cookie Policy.

2F) SMS Data

We process phone numbers, message content, delivery status, opt-in and opt-out records (including STOP/HELP replies) and consent records for two programs: (a) account notifications to business owners (verification codes, trial setup reminders and billing reminders), and (b) review-request texts that a business sends to its own customers through ZappyCards. We use SMS providers and carriers to deliver messages. We do not sell phone numbers, and we do not use the phone numbers of a business's customers for our own advertising. See our SMS Consent Policy.

3) How We Use Information

Provide/operate the Services; fulfill your instructions; send configured messages; post authorized GBP replies. Safety/program integrity (security monitoring, fraud/abuse prevention, rate limiting, spam mitigation). Improve features (aggregated/anonymized analytics). Legal compliance; carrier/platform requirements; service notices. Ship cards, process payments, and measure our own advertising (Section 2D). No sale of Contact Data; no ads based on Google-sourced data.

3A) AI-Assisted Features

Some features use artificial intelligence to help you, including suggested replies to Google reviews and drafted review-request text messages. Inputs can include the text of a review (and the public reviewer name shown with it), your business name and details, and the instructions or preferences you give. Outputs are draft replies and messages that we show to you.

To generate these drafts, inputs and outputs may be processed by third-party AI providers that act as our service providers/subprocessors under confidentiality and data-protection obligations, and only to provide the feature to you. We do not use customer data to train public AI models. AI Features do not make decisions that have legal or similarly significant effects on any person; they only create drafts, and you decide whether to use them. Please do not enter payment card numbers, government identifiers, health information or other sensitive data into AI Features. See Section 20 of our Terms of Service.

3B) Testimonials & Customer Showcase

Testimonials, review counts and results shown on our websites or in our marketing are individual experiences; results vary and are not guaranteed (see Sections 18 and 19 of our Terms of Service). We display a business's name, logo, review counts or testimonial only as permitted by the Terms, and we do not use Contact Data (your end-customers' information) in marketing. You may ask us to stop at any time by emailing support@zappycards.com.

4) Data Minimization & Retention

• Pass-Through Mode (default): process CRM Contact Data ephemerally; retain only (i) message logs and (ii) suppression/opt-out records.
• Minimum-Retention Mode (optional): limited storage to support sequencing/analytics with an admin-controlled window (default 90 days, configurable 0--365 days).
• Account/billing: retained for life of account + up to 7 years for tax/audit.
• Free Review Kit and orders: shipping, order and consent records are retained with your billing records (up to 7 years for tax/audit) and for as long as needed to handle warranty claims, billing disputes and fraud prevention.
• Funnel analytics and advertising data: kept only as long as needed for the purposes described above, then deleted or aggregated. Clearing your browser's site data removes the visitor id from your device.
• SMS records: message logs and opt-in/opt-out and consent records are retained as needed to honor opt-outs and demonstrate consent (including the Pass-Through and Minimum-Retention settings above for Contact Data).
• We retain limited data where required by law or to resolve disputes; suppression logs are retained to honor opt-outs.

4A) Retention Criteria

We keep personal information only as long as needed for the purposes in this Policy. Our retention periods are set using these criteria:

• Relationship duration: for as long as you have an account or active relationship with us, plus a reasonable period afterwards to wind down the account and handle questions.
• Legal and tax obligations: records we must keep under tax, accounting, consumer-protection, anti-spam and other laws (for example billing records for up to 7 years, as noted in Section 4).
• Limitation periods and dispute defence: information we may need to establish, exercise or defend legal claims, respond to regulators, or answer chargebacks and billing disputes, for the period in which a claim could be brought.
• Consent and opt-out records: consent, acceptance and billing records (IP address, timestamp, accepted text, checkout and cancellation logs) are kept at least as long as needed to answer billing disputes, and suppression/opt-out records are kept for as long as needed to honor opt-outs.
• Deletion or de-identification: when information is no longer needed for these purposes, we delete it, or de-identify or aggregate it so it no longer identifies you, subject to backup cycles.

5) Lawful Basis & Regional Notes

• Canada (PIPEDA/CASL): express consent where required; implied-consent windows for existing business relationships (~24 months) or inquiries (6 months) must be tracked; each CEM includes identification and a functioning unsubscribe.
• EU/UK (GDPR/UK GDPR): for Contact Data we act as processor; for account/site data we are controller. We support data-subject rights and use SCCs/IDTA for restricted transfers.
• U.S. (TCPA/state laws): prior express consent (informational) or prior express written consent (marketing) for automated texts; recipients can revoke consent by any reasonable means.
• HIPAA: PHI is prohibited unless a BAA is executed in advance.

5A) Lawful Bases (EEA, UK and Swiss GDPR)

Where the GDPR, UK GDPR or the Swiss Federal Act on Data Protection applies and we act as controller (for example, for website, account, billing, security and funnel data), we rely on these lawful bases:

• Contract: to create and run your account, provide the Services, process orders, ship cards, and take payments and renewals.
• Consent: where required, for example for non-essential cookies and advertising measurement (Sections 2D and 2E), certain marketing communications and any optional features. You can withdraw consent at any time without affecting processing before withdrawal.
• Legal obligation: to meet tax, accounting, consumer-protection and other legal requirements, and to respond to lawful requests from authorities.
• Legitimate interests: to secure and protect the Services, prevent fraud and abuse (including duplicate or fraudulent offers), improve and measure our products, communicate with customers about our services, and establish, exercise or defend legal claims, where these interests are not overridden by your rights. You can object to processing based on legitimate interests (see Section 9D).

For Contact Data, we act as processor and you, as controller, are responsible for identifying the lawful basis for processing it.

6) Google APIs; OAuth; E-SIGN

Google APIs and OAuth: ZappyCards accesses Google Business Profile data only after you explicitly authorize access via Google OAuth. The data we access may include business profile information such as business name, address, phone number, website, business hours, and customer reviews associated with your Google Business Profile.

We use this Google-sourced data solely to provide user-facing featureswithin the ZappyCards platform, such as displaying and managing business information and reviews. We do not sell, share, or use Google user data for advertisingor any purpose unrelated to the functionality you explicitly enable.

Access to Google data is limited to the approved OAuth scopes, restricted to authorized systems, and protected using industry-standard security controls. You may revoke ZappyCards’ access to your Google account at any time through your Google Account permissions.

Electronic communications (E-SIGN). By creating an account, you consent to receive notices and disclosures electronically (via email or in-app). You may withdraw this consent by contacting support; however, withdrawal may limit or prevent your ability to use certain services.

7) Sharing & International Transfers

• We share information with subprocessors (cloud hosting, SMS delivery, analytics, support tools) under contract; integration partners you connect; Stripe (payments), Shopify and our shipping partner (fulfilment), and Meta (advertising measurement, Section 2D); advisers/authorities as required; and during corporate transactions with safeguards.
• Data may be processed outside your province/country; for restricted transfers we use SCCs/IDTA and supplementary measures.

7A) International Transfers

We are based in Canada and process personal information in the United States and Canada, and in other countries where our service providers and subprocessors operate. If you are in the EEA, the UK or Switzerland, your information is therefore transferred outside those regions.

Where required, we protect these transfers with appropriate safeguards, such as the EU Standard Contractual Clauses (SCCs), the UK International Data Transfer Agreement or UK Addendum and the Swiss addendum, together with supplementary measures where appropriate (see also Addendum B of our Terms of Service). You can ask us for information about these safeguards by emailing support@zappycards.com.

8) Security; Vulnerability Reporting

• We maintain administrative, technical, and physical safeguards appropriate to risk, including encryption in transit, least-privilege access, MFA for admin access, logging/monitoring, vendor due diligence, secure development, and backups/DR.
• To report a security issue, contact security@zappycards.com; we will acknowledge good-faith reports and coordinate remediation.

8A) Security Measures

We use administrative, technical and physical safeguards appropriate to the risk, as described in Section 8 and in Addendum B (Security) of our Terms. These include access controls and least-privilege access, MFA for administrative access, encryption in transit, logging and monitoring, vulnerability management, secure development practices, vendor due diligence, and backups and disaster recovery. We limit access to personal information to people and providers who need it and who are bound by confidentiality obligations.

No method of transmission or storage is completely secure, so we cannot guarantee absolute security. Please keep your login credentials confidential and tell us promptly at support@zappycards.com if you suspect your account has been compromised. We will respond to security incidents and give notices as described in Section 11 and as required by law.

9) Your Rights & Choices

Depending on region: access, correction, deletion, portability, restriction/objection, and marketing opt-out. End-contacts should contact our Customer (controller); we assist controllers with requests. Manage cookies in your browser and any in-product controls. Additional rights for California and Canadian residents are in Sections 9A and 9B.

9A) California Residents (CCPA/CPRA)

If you are a California resident, you have the right to know what personal information we collect, use and disclose; to delete it; to correct inaccurate information; to opt out of the sale or sharing of your personal information; to limit use of sensitive personal information (we do not use it beyond what is permitted); and not to be discriminated against for exercising these rights.

Categories we collect (from you, your devices, Google, and our service providers): identifiers (name, email, phone, IP address, visitor id); commercial information (orders, subscription and billing status); internet and device activity (funnel events, cookies and similar identifiers); business and professional information (business name, Google Place details); and shipping address. We disclose these to service providers (hosting, Stripe, Shopify, shipping, SMS delivery, analytics) for business purposes.

Sale and sharing. We do not sell personal information for money. Our use of the Meta Pixel and Conversions API (Section 2D) may be a "sharing" of identifiers and activity for cross-context behavioural advertising under California law. To opt out, email support@zappycards.com with the subject "Do Not Sell or Share My Personal Information". We do not knowingly sell or share the personal information of children under 16.

How to exercise your rights. Email support@zappycards.com. We will verify your request by matching the information you give us to our records, and we respond within 45 days (extendable once by 45 days where permitted). You may use an authorised agent. If you are the end-customer of one of our business customers, contact that business (see Section 9).

9B) Canadian Residents (PIPEDA)

We handle personal information in line with PIPEDA and applicable provincial privacy laws. You may access your personal information, ask us to correct it, withdraw consent (subject to legal and contractual restrictions, and noting that withdrawing may stop us providing the Services), and ask how we handle your information. Contact our privacy contact at support@zappycards.com or the postal address above; we respond within the time required by law (generally 30 days).

Your information may be processed outside your province or Canada (including in the United States) by our service providers, where it may be accessible to courts and authorities under local law. If you are not satisfied with our response, you may complain to the Office of the Privacy Commissioner of Canada or your provincial privacy regulator. Commercial electronic messages are sent in line with CASL (see Section 5).

9C) Quebec Residents (Law 25)

If you live in Quebec, the Act respecting the protection of personal information in the private sector (as amended by Law 25) also applies. In addition to the rights in Section 9B, you may ask us to access and correct your personal information, withdraw consent, receive your information in a structured, commonly used technological format where the law provides for portability, ask us to stop disseminating it or de-index it where the law allows, and ask for information about any decision made exclusively by automated processing of your information. Where we transfer personal information outside Quebec, we do so in line with the requirements of that law.

Our person in charge of the protection of personal information (privacy officer) can be reached at support@zappycards.com or the postal address above. If you are not satisfied with our response, you may complain to the Commission d'accès à l'information du Québec.

9D) EEA, UK and Swiss Residents: Your GDPR Rights

If the GDPR, UK GDPR or the Swiss Federal Act on Data Protection applies to your personal information, you have the right to:

• access your personal information and receive a copy;
• have inaccurate information corrected and incomplete information completed;
• have your information erased in certain circumstances;
• restrict our processing in certain circumstances;
• data portability, meaning to receive information you gave us in a structured, commonly used, machine-readable format, where the processing is based on consent or contract;
• object to processing based on legitimate interests and to direct marketing at any time;
• withdraw consent at any time, where we rely on consent;
• not be subject to a decision based solely on automated processing that has legal or similarly significant effects (we do not make such decisions); and
• lodge a complaint with your local data protection authority (for example, your national supervisory authority in the EEA, the UK Information Commissioner's Office, or the Swiss Federal Data Protection and Information Commissioner).

To exercise a right, email support@zappycards.com. We may need to verify your identity. We respond within one month, which we may extend by up to two further months for complex or numerous requests, as the law allows. If you are an end-customer of one of our business customers, we are their processor, so we will pass your request to that business (see Section 9). Nothing in this Policy limits any right you have under applicable law that cannot be waived.

10) Children

Business-use only; not for children under 16. Do not submit children's data.

10A) Children (18+)

The Services are for business use by adults aged 18 or older and are not directed to children. We do not knowingly collect personal information from anyone under 18 (and in no event from anyone under 16, as stated in Section 10). If you believe a child has given us personal information, contact support@zappycards.com and we will delete it. Business customers must not submit children's data through the Services.

11) Breach Notification

We will notify controllers without undue delay of breaches affecting Contact Data and assist with regulatory/individual notices (e.g., GDPR's 72-hour framework), consistent with our DPA.

12) Changes & Contact

We may update this Policy; material changes will be notified with a new effective date.

Questions/requests: support@zappycards.com or the postal address above.

12A) Changes to this Policy

We may update this Policy from time to time. We will post the updated Policy with a new Last updated date and, for material changes, notify you by email (to your account address) or in the app, and where the law requires it, ask for your consent. Your continued use of the Services after the effective date of an update means you accept it, to the extent the law allows.

12B) Contact; Privacy Officer

Our privacy officer and privacy contact is reachable at support@zappycards.com (or +1 (506) 248-0216). Postal address: Day Creatives Inc., d/b/a Zappycards, Riverview, New Brunswick, Canada (full postal address available on request by email). For security issues, see Section 8. See also our Terms of Service, Refund Policy, SMS Consent Policy and Cookie Policy.