What personal data Zappila collects, why, and the choices you have.
This policy explains how Zappila ("Zappila", "we") handles personal data. We follow the Information Technology Act, 2000, the rules made under it, and the Digital Personal Data Protection Act, 2023, and we apply the same care to customers in other countries.
Our own data (we decide why and how it is used). Information about people who visit our website, sign up, pay, contact us or use the workspace as an owner or admin.
Customer Data (you decide, we host it). Information that a customer puts into their workspace, such as their affiliates, advertisers, employees, visitors' clicks and conversions. For this data the customer is in charge and Zappila acts as its processor under our Data Processing Terms. If you are an affiliate or advertiser inside someone's workspace, please contact that network about your data.
We do not sell personal data, and we do not use Customer Data for advertising.
Only service providers that help us run Zappila, under confidentiality and security duties: the payment partner (currently Razorpay Software Private Limited), email delivery, hosting and backup providers, and tools we use for support. We may disclose data when the law, a court or a government authority requires it, or to protect rights and safety. If the business is sold or merged, data may move to the new owner under this policy.
Data is stored on servers chosen by us and may be processed outside your country. Where data leaves India we use providers that give appropriate protection and we keep to the transfer rules that apply.
We keep account and billing records for as long as the account exists and afterwards for the period needed for tax, accounting and legal claims (generally up to 8 years for invoices). Workspace data is deleted after a closed workspace's export period ends. Security logs are kept for a limited time.
We use encryption in transit, separate databases per workspace, access controls, audit logs and backups. See our Security page. No system is perfectly secure; if a breach affects your data we will notify you and the authorities as the law requires.
You can ask us to access, correct, update or delete your personal data, to withdraw consent, and to nominate someone to exercise your rights if you cannot. Email [email protected]. We reply within 30 days. You can also complain to the Data Protection Board of India once it is operating for your matter.
The Service is for businesses and is not meant for anyone under 18. We do not knowingly collect data from children.
For complaints about how we handle your data, contact the Grievance Officer at [email protected], using the subject "Grievance". We acknowledge complaints within 48 hours and resolve them within 30 days.
We will post updates to this page and, if they are significant, email workspace owners.