Privacy policy

Zipper is an app that helps businesses manage orders that come in through Instagram direct messages. It is operated by Zipper Software Inc. (“Zipper”, “we”, “us”), a Canadian federal corporation at 103 Stubbswood Sq, Scarborough, Ontario M1S 2K7, Canada. This policy covers the Zipper iPhone app, the web app at usezipper.app/app and this website. It explains what we collect, why, who we share it with, how long we keep it and the choices you have.

Our Privacy Officer is responsible for this policy. Questions and requests: usezipperai@gmail.com (see Contact us below).

What we collect

From you, the business

• Your sign-in email address.
• Business details you enter: name, what you sell, country, time zone, e-Transfer email addresses, payment instructions, products and prices, notes for suggested replies and saved replies.
• Orders, payment requests, payment records, customer notes and tags you create in Zipper.
• Email addresses of teammates you invite (up to 5 people per business). Everyone on a business's team can see the team's email addresses and the business's chats, orders and payments.

From Instagram, with your permission

When you connect an Instagram professional account, Meta shares the data covered by the permissions you approve (instagram_business_basic and instagram_business_manage_messages):

• Your Instagram account ID, username, name and profile picture.
• Direct messages in your account's inbox: text, links to photos and other attachments, and when they were sent.
• For the people who message you: their Instagram-scoped ID, username, name and profile picture, as provided by Meta.

Zipper imports the chats in your inbox from the period you choose (7 or 30 days) and new messages after that, including personal chats. Messages can contain anything your customers choose to share, such as addresses or phone numbers. You can hide a chat to take it off your board and keep it away from AI; hidden chats stay stored in Zipper.

Automatically

• Technical information our providers record when you use Zipper or this website, such as your IP address, browser or device type and the time of each request, in service logs and sign-in records. We use it to keep Zipper secure and working.
• If you turn on notifications in the phone app: a notification address for your phone, so we can send you the reminders you set. It's removed when you sign out of that phone.
• The days each person opens the app, and for which business, so we can see how Zipper is used (for example, how many businesses use it each week). We record the day only, not what you do in the app, and we don't use an outside analytics company.
• Records of AI use (which chats were summarized, the amount of text processed and its cost), to apply plan limits and track our costs.
• Your business's App Store subscription status, from Apple through RevenueCat: the product, its status, dates, price, country of purchase and transaction IDs. We don't receive card details.
• A one-way code made from your Instagram account ID with a secret key, so each Instagram account gets only one free 30-day Pro period. We use it for nothing else.
• In the web app, your sign-in session is kept in your browser's local storage so you stay signed in. We don't use advertising or analytics cookies.

Payments

When you request an Interac e-Transfer, Zipper shows your customer your e-Transfer email address and a payment reference, and you mark the payment as paid. If you connect Stripe (card payment links may not be available yet), we send Stripe your business name, country and sign-in email to set up your Stripe account, and Stripe tells us when a payment link is paid. Your customers enter card details directly with Stripe; we never see or store card numbers.

How we use it

• To show your conversations, organise them into stages and keep them up to date.
• If you allow AI: to create summaries, next steps, order details, stage suggestions and suggested replies.
• To send the messages and payment requests you choose to send.
• To track orders and payments and show you your analytics and weekly summary.
• To sign you in and send you sign-in codes and service emails.
• To run plans, subscriptions and the free Pro period, prevent abuse, keep Zipper secure and provide support.
• To understand how Zipper is used, in total across businesses, and improve it.

We do not sell your data or your customers' data, use it for advertising, or message anyone on your behalf without you tapping send.

AI processing (only if you allow it)

Zipper's AI features are off until the business owner allows them. When you set up Zipper, we ask whether AI may read your chats. If you allow it, Zipper sends our AI provider, Anthropic (the Claude model), the last 30 messages of each chat with their times, your notes about that customer, the order and payment details recorded for it, and your business name, notes and product list. Anthropic uses it only to return summaries, next steps, order details, stage suggestions and reply drafts. Anthropic doesn't train its models on this data.

Hidden chats are never sent. On the free plan, AI covers 20 chats a month. Only the owner can turn AI on or off, in Settings → AI; once it's off, no chat text is sent to Anthropic. AI never sends anything to your customers; you choose what to send.

Who we share it with

We use these service providers, only to run Zipper:

• Supabase: database, sign-in and server functions (our database is stored in Canada).
• Vercel: hosts this website and the web app at usezipper.app/app.
• Resend: sends sign-in codes and service emails; it receives your email address.
• Anthropic: AI summaries and suggestions, only if the owner allows AI.
• Meta: the Instagram API that delivers and sends messages.
• Apple: the App Store and in-app subscriptions.
• Expo: delivers notifications to your phone (through Apple); it receives your phone's notification address and the reminder: the customer's name and your note.
• RevenueCat: tells us your business's subscription status; it knows the business only by its Zipper ID.
• Stripe: card payment links, if you connect it.
• Google: fonts on our website and web app; Google receives visitors' IP address.

We may also disclose information if required by law.

Where your data is processed

Our database is stored in Canada (Supabase, ca-central-1). Some processing, and our other providers (Anthropic, Vercel, Resend, RevenueCat, Apple, Meta, Google, and Stripe if you connect it), may be in the United States or other countries, where courts and authorities may be able to access the data under local law. Our providers must, by contract, protect your data at least as well as this policy does and use it only to provide their services to us.

How long we keep it

We keep your data while your account is active.

• When you delete your account in the app (Settings → Delete account) and you're the only person on the business, your account and all of the business's data are deleted right away: the Instagram connection and its access token, customers, chats, orders and payments.
• If teammates remain, only your login is deleted. The business and its data stay with them, and if you were the owner, the longest-standing teammate becomes the owner.
• When you disconnect Instagram, its access token is deleted. Chats already in Zipper stay until you delete your account or ask us to delete them.

After an account is deleted, we keep only:

• Records of App Store subscription events (product, dates and transaction IDs; no card details), for up to 6 years for tax and accounting.
• The one-way code made from your Instagram account ID, for as long as needed to stop repeat free Pro periods. It's used for nothing else.
• Copies in our providers' backups and service logs (including sign-in records with your email and IP address), which expire within 30 days.

If you message a business that uses Zipper

If you send a direct message to a business that uses Zipper, that business decides what to keep and why. Zipper processes your Instagram ID, username, name, profile picture and messages on the business's behalf, only to provide Zipper to that business. If the business has turned on AI, your messages are also processed by Anthropic as described above.

To ask about or delete your information, contact the business. You can also email us at usezipperai@gmail.com with your Instagram username and the business's name: we'll forward your request to that business or handle it ourselves as the law requires. Deleting messages from Zipper doesn't delete them from Instagram.

Your choices and rights

• The owner can disconnect Instagram at any time in Zipper (Settings → Instagram → Disconnect) or by removing Zipper in Instagram's settings.
• The owner can turn AI processing on or off at any time in Settings → AI.
• You can hide a chat to keep it off your board and away from AI.
• You can delete your account in the app, in Settings → Delete account, or by email. See how to delete your data.
• To access, correct or get a copy of your information, email usezipperai@gmail.com from the address you sign in with. We respond within 30 days.
• If you're not satisfied with our answer, you can complain to the Office of the Privacy Commissioner of Canada (priv.gc.ca).

We handle personal information in line with Canada's Personal Information Protection and Electronic Documents Act (PIPEDA) and other privacy laws that apply to us.

Do Not Track: Zipper doesn't track you across other websites or apps and has no advertising or analytics trackers, so it works the same way whether or not your browser sends a Do Not Track signal.

Security

Data is encrypted in transit and at rest by our providers. Instagram access tokens are stored only on our servers, and each business can only access its own data. Access by our own people is limited to those who need it for support or operations. If there's a breach of security, we'll notify affected businesses and the Office of the Privacy Commissioner as the law requires.

Children

Zipper is a tool for businesses and is not intended for anyone under 18.

Changes

If we change this policy, we will update the date above and, for significant changes, tell you in the app or by email.

Contact us

Privacy Officer, Zipper Software Inc.
103 Stubbswood Sq, Scarborough, Ontario M1S 2K7, Canada
usezipperai@gmail.com