Privacy policy

Zipper (“we”, “us”) makes an app that helps businesses manage orders that come in through Instagram direct messages. This policy explains what we collect, why, who we share it with and the choices you have. Questions: usezipperai@gmail.com.

What we collect

From you, the business

• Your sign-in email address.
• Business details you enter: name, what you sell, country, e-Transfer email addresses, products and prices.
• Orders, payment requests, notes and tags you create in Zipper.
• Email addresses of teammates you invite. Everyone on a business's team can see the team's email addresses and the business's chats, orders and payments.

From Instagram, with your permission

When you connect an Instagram professional account, Meta shares the data covered by the permissions you approve (instagram_business_basic and instagram_business_manage_messages):

• Your Instagram account ID, username, name and profile picture.
• Direct messages in your account's inbox: text, links to photos and other attachments, and when they were sent.
• For the people who message you: their Instagram-scoped ID, username, name and profile picture, as provided by Meta.

Automatically

• Basic technical information (such as app version and device type) to keep the service working.
• The days you open the app, so we can see how Zipper is used (for example, how many businesses use it each week). We record the day only, not what you do in the app, and we don't use an outside analytics company.
• A one-way scrambled code of your Instagram account ID, so each business gets only one free trial.

Payments

If you forward Interac e-Transfer notification emails to Zipper, we read the sender's name, amount and reference to match payments to orders. If you connect Stripe, Stripe processes card payments and shares payment status with us. We never see or store full card numbers.

How we use it

• To show your conversations, organise them into stages and keep them up to date.
• To create AI summaries, next steps, order details and suggested replies.
• To send the messages and payment requests you choose to send.
• To track payments and show you your business analytics.
• To run subscriptions and free trials, prevent abuse and provide support.
• To understand how Zipper is used, in total across businesses, and improve it.

We do not sell your data, use it for advertising, or message anyone on your behalf without you tapping send.

AI processing (only if you allow it)

Zipper's AI features are off until you allow them. When you set up Zipper, we ask whether AI may read your chats. If you allow it, the text of your conversations (your messages and your customers'), with your business notes and product list, is sent to our AI provider, Anthropic (the Claude model), to write summaries, next steps, order details and reply drafts. Anthropic processes it only to return those results, under terms that don't allow it to train its models on your data.

You can turn AI off at any time in Settings → AI. From then on, no chat text is sent to Anthropic. AI never sends anything to your customers; you choose what to send.

Who we share it with

We use these service providers, only to run Zipper:

• Supabase: database and sign-in (data stored in Canada).
• Anthropic: AI summaries and suggestions, only if you allow AI.
• Meta: the Instagram API that delivers and sends messages.
• Vercel: this website.
• Stripe: card payments, if you connect it.
• Apple and RevenueCat: App Store subscriptions.

We may also disclose information if required by law.

How long we keep it

We keep your data while your account is active. When you delete your account in the app (Settings → Delete account), your account and business data are deleted right away; copies in our backups expire within 30 days. We keep only the scrambled trial code described above and records we must keep by law.

Your choices and rights

• You can disconnect Instagram at any time in Zipper or in Instagram's settings.
• You can turn AI processing on or off at any time in Zipper's settings.
• You can delete your account and data in the app, in Settings → Delete account.
• You can ask to access, correct or delete your data. See how to delete your data.
• People who messaged a business that uses Zipper can ask us to delete their messages at the same address.

We handle personal information in line with Canada's Personal Information Protection and Electronic Documents Act (PIPEDA) and applicable US state privacy laws.

Security

Data is encrypted in transit. Instagram access tokens are stored only on our servers, and each business can only access its own data.

Children

Zipper is a tool for businesses and is not directed to children under 16.

Changes

If we change this policy, we will update the date above and, for significant changes, tell you in the app or by email.