Privacy Policy

The personal data processing shall mean any operation or a set of operations which is performed on personal data or on sets of personal data, whether or not by automated means, such as collection, recording, organisation, structuring, storage, adaptation or alteration, retrieval, consultation, use, disclosure by transmission, dissemination or sharing in another way, alignment or combination, restriction, erasure or destruction.

ziptie.ai plays two different roles depending on the data involved.

• Data controller. For the personal data We collect to run Our business, We decide why and how it is processed and We are the data controller. This covers account and profile data (your email, name, and company name), billing data, marketing data, product analytics, and server logs.
• Data processor. When you use the ziptie.ai application you submit content and instructions that We process on your behalf and under your control, for example the prompts and monitored queries you configure, brand and competitor lists, content briefs, files and images you upload, and messages you send to the in-app AI assistant and to support (together, the “Customer Content”). For Customer Content, you (or the organisation whose workspace you use) are the data controller and ziptie.ai acts as a data processor.

Our processing of Customer Content is governed by Our Data Processing Agreement (the “DPA”), which incorporates the European Commission’s Standard Contractual Clauses (Commission Implementing Decision (EU) 2021/914). The DPA is available on request using the contact details in Section 21. Where the DPA and this Policy conflict in respect of Customer Content, the DPA prevails.

ziptie.ai processes personal data of Its current and prospective customers and of visitors to Its webpages.

Account and profile data. To create and operate your account We process:

• your email address (collected when you register);
• your password, stored only as a secure one-way hash (We never store it in a readable form);
• your name and company name, if you choose to add them to your profile;
• your role or persona, timezone, and avatar, if you provide them;
• for sign-in with Google, the account identifier Google returns to Us.

We do not collect a telephone number.

Billing data. If you subscribe to a paid plan, Our payment processor (Stripe) collects your name, email, and payment-method details and returns to Us the subscription state and payment-method tokens. We do not store full card numbers.

Customer Content. When you use the application you submit content that We process on your behalf, which may include prompts, monitored query text, brand and competitor names, content briefs, generated and uploaded files and images, and messages to the in-app AI assistant and to support. This content may contain personal data where you choose to include it.

When you visit our marketing website (ziptie.ai) or use the ziptie.ai application (logged-in customers), We additionally process product usage data:

• identifiers we generated for you: your user ID and workspace ID;
• actions you take in the app: pages you view, features you use, buttons you click;
• signals that help us spot friction: errors you encounter, rage-click patterns, repeated failed actions;
• technical context: browser type, country (derived from IP and then the IP itself is discarded), referring page.

We do not record the text you type into prompts, briefs, content pieces, support threads, or any form fields against these analytics events. We do not record your IP address, email address, or telephone number against these events.

Special-category data. We do not ask for, and We ask that you do not submit, special-category personal data (data revealing racial or ethnic origin, political opinions, religious or philosophical beliefs, trade-union membership, genetic or biometric data, or data concerning health, sex life, or sexual orientation) or data relating to criminal convictions and offences. Channels such as file and image uploads, the in-app AI assistant, and support messages are free-form and We do not screen their contents, so you are responsible for not placing special-category data into them. We do not intentionally collect or process special-category data, and We do not use it to make decisions about you.

ziptie.ai processes the personal data in order to:

• provide the ziptie.ai AI Search monitoring service and the optional content and API add-ons that you order via ziptie.ai and the application;
• process the prompts, monitored queries, and content you submit, and return the results, insights, and scores you request;
• adjust specific products and/or services to the customers’ order(s) and/or need(s);
• improve products and services being offered by Us;
• communicate with you about your account, billing, security, and support;
• ensure the security of the personal data being already collected;
• send to Our customers a personalised marketing content;
• understand how visitors and customers use our marketing website and the ziptie.ai application so We can improve content, conversion paths, product quality, and identify friction points (product analytics).

In the case of direct (personalised) marketing, We may send Our customers offers being tailored to their needs and interests in a manner to which the given customer has already agreed to (gave consent).

The legal grounds upon which We are allowed to process personal data are dependent on the purpose for which given data was collected. ziptie.ai processes personal data for the purposes deemed as the follows:

• to provide its customers with the monitoring, content, and API services –
  • on the grounds of the consent being given and/or
  • on the grounds of necessity for the execution or preparation of a contract to which the customer is a party;
• to adjust specific products and/or services to its customers’ needs –
  • on the grounds of the consent being given, and/or
  • on the grounds of necessity for the execution or preparation of a contract to which the customer is a party;
• to improve products and services being offered –
  • on the grounds of Our legitimate interest in improving Our services;
• to ensure the security of the personal data being already gathered –
  • on the grounds of ziptie.ai’s and Our customers justified interest being the integrity and security of personal data already collected;
• to send to its customers a personalised marketing content –
  • on the grounds of the consent being given.
• to understand how the ziptie.ai marketing website is used (product analytics) –
  • on the grounds of the consent being given via the cookie preferences banner, which the visitor may withdraw at any time by clicking “Cookie preferences” in the footer.
• to understand how the ziptie.ai application is used (product analytics) –
  • on the grounds of Our legitimate interest in improving the product, with the customer’s right to object at any time via Settings > Privacy.

For Customer Content, which We process as a data processor, the legal ground is determined by you as the controller; We process it only on your documented instructions under the DPA.

To deliver its core service, ziptie.ai sends certain content to specialist AI and data providers. This is central to how the product works, so We describe it here in detail.

• AI model gateway (OpenRouter). Customer Content that has to be analysed or generated by a large language model (for example content briefs, prompts, public content you ask Us to work with, and in-app AI assistant messages) is sent to OpenRouter, which routes it to the underlying AI model providers needed to produce your result. Where that content contains personal data, that personal data is processed by OpenRouter and by the routed model providers.
• AI answer collection (BrightData). To measure how your brand appears in AI Search engines, the monitored query text you configure is submitted into ChatGPT, Microsoft Copilot, Perplexity, and Google Gemini through BrightData, which returns the public AI-generated answers and citations that power your reports. The query text you choose is therefore shared with BrightData and with the AI engine it is submitted to.
• AI answer collection (DataForSEO). For the remaining engines We monitor - Google AI Overviews, Google AI Mode, and Bing AI Overview - the same monitored query text is submitted through DataForSEO, which returns the public AI-generated answers, citations, and organic search results that power your reports. The query text you choose is therefore shared with DataForSEO and with the AI engine it is submitted to.

No training on your content. ziptie.ai does not use your Customer Content, prompts, or monitored queries to train AI models. We select and configure Our AI providers with the objective that your content is used only to generate the results you request and is not used by those providers to train their own models. We share only the content needed to perform the task, and Our agreements with these providers require them to protect it.

These providers are listed in Section 10 (Subprocessors), and international transfers are addressed in Section 11.

How long We keep personal data depends on the legal basis for processing and on the type of data. ziptie.ai does not process personal data for a period longer than is necessary, which shall be deemed as the following:

• personal data gathered on the grounds of the consent being given – until the consent is withdrawn;
• account data and Customer Content – for as long as your account is active. If you cancel, We retain your account and workspace data for a 90-day grace window (so that you can reactivate) and then purge it;
• monitoring history (the AI Search results collected for your prompts, and the scores and reports built from them) – kept for as long as the workspace is active. We do not delete monitoring history on a timer: it accumulates from your project’s first check onwards, and We do not reconstruct history for the period before you started tracking. Inside the application the date filters look back at most 365 days, so older results are retained but not selectable there. Deleting a prompt, a project, or the workspace deletes its history with it;
• export files (the CSV, XLSX, and PDF reports you generate, and any public share link you create for one) – deleted 14 days after the export is created, which also stops the share link working;
• personal data gathered on the grounds of the justified (legitimate) interest – until such interest exists, or until the customer whose data is processed successfully objects to such processing, whatever appears first;
• personal data We must keep to meet a legal obligation – until the end of the applicable statutory period or of the relevant proceeding(s).

Residual copies. After deletion, some data persists for a limited time in operational records that We do not use to profile you:

• server and application logs are retained for 365 days;
• encrypted backups run daily on a 14-day rolling cycle, so an encrypted copy of deleted data can remain in them for up to 14 days after deletion, until the cycle deletes it.

ziptie.ai shares personal data with third parties only where necessary to run the service, and always under a contract that requires them to protect it – their confidentiality, integrity, and security. In each such contract We embed terms and safety mechanisms to ensure Our standards for data protection, and We retain control over the method and scope of processing carried out on Our behalf. Depending on the processing, the recipients may include:

• Our subprocessors, listed in Section 10 (payments, email, AI model and AI-answer providers, hosting, content delivery, backup storage, and sign-in);
• professional advisers such as accountants and legal and tax advisers;
• public authorities, where We are legally required to disclose.

Product analytics data collected on the ziptie.ai marketing website and within the ziptie.ai application is processed by Us using OpenPanel, an open-source analytics tool that We self-host on Our own servers. This product analytics data is not shared with any third party. This statement is specific to product analytics and does not limit the sharing of other data described in Sections 7 and 10.

We engage the following subprocessors to help Us provide the service. Each is bound by a data processing agreement.

Processing locations shown are indicative primary locations; some providers process data in additional regions. See Section 11 for the safeguards We apply to international transfers.

Self-hosted components. ziptie.ai also runs OpenPanel (product analytics), n8n (backup scheduling), and the Camoufox browser engine (public-web scraping) on Its own infrastructure. These are not third-party subprocessors and do not transfer your data to a third party.

Attestations. Most of Our subprocessors hold independent security attestations (for example SOC 2 Type II or ISO 27001). OpenRouter does not currently hold a public security attestation. It is used across the Service, including the sentiment analysis behind your scores, the AI insights on your dashboard, the UGC Impact analysis, and the Content Add-On, so switching off any single feature does not remove it from the processing path. Where a customer contract requires a fully attested AI gateway, contact Us using the details in Section 21 and We will discuss the options available for that workspace.

Changes to this list. The table above is Our published subprocessor list, and it is how We announce changes: when We add or replace a subprocessor We update the table and the “Last updated” date at the top of this Policy, so checking this section is the reliable way to follow who processes your data. Where We process Customer Content as your processor, Our DPA sets out the advance notice We give you before an intended addition or replacement takes effect, and your right to object to it on reasonable data protection grounds; if We cannot resolve your objection, you may terminate the affected part of the service. Request the DPA, or ask about a planned change, using the contact details in Section 21.

Most of the subprocessors to which We transfer personal data are based outside the European Economic Area (hereinafter referred to as: the “EEA”) and the United Kingdom, in particular within the United States of America. Our production infrastructure is located in the United States, so all platform data at rest, and the encrypted backups of it, are held there. If you are in the EEA or the United Kingdom, using the Service therefore involves a transfer of your personal data to the United States.

ziptie.ai remains committed to minimise the range, amount, and value of the personal data being transferred outside the EEA and the UK. Where We do transfer personal data outside the EEA or the UK, We rely on one or more of the following safeguards:

• the European Commission’s Standard Contractual Clauses (Commission Implementing Decision (EU) 2021/914, the modular clauses), for transfers from the EEA;
• the UK International Data Transfer Agreement, or the UK Addendum to the Standard Contractual Clauses, for transfers from the United Kingdom;
• the EU-US Data Privacy Framework (together with its UK Extension and the Swiss-US Data Privacy Framework), where the recipient is certified under it. Several of Our US-based providers, including Amazon Web Services, Google, Cloudflare, and Stripe, are certified under the Data Privacy Framework.

The main recipient country for transfers is the United States. Our dedicated hosting runs there with IBM Cloud Classic, the encrypted backups are held there by Amazon Web Services, and some providers (such as BrightData) operate internationally. For the hosting of the platform itself We rely on the Standard Contractual Clauses for transfers from the EEA, and on the UK International Data Transfer Agreement or the UK Addendum for transfers from the United Kingdom, rather than on the Data Privacy Framework. You may request a copy of the relevant transfer safeguard from Us using the contact details in Section 21.

If you are a resident of a US state with a comprehensive privacy law, including California (the CCPA, as amended by the CPRA), Texas (the Texas Data Privacy and Security Act), Virginia, Colorado, Connecticut, and other states with similar laws, you have rights over your personal information.

Categories of personal information We collect. In the past 12 months We have collected: identifiers (such as email and account identifiers); commercial information (subscription and billing records); internet or other network activity (product usage and log data); and the content you submit to the application. We collect these for the business purposes described in Section 5. The sources of this information, and the parties We disclose it to, are described in Sections 4, 9, and 10.

Sale and sharing. We do not sell your personal information, and We do not share it for cross-context behavioural advertising, as those terms are defined under the CCPA and similar laws.

Your rights. Subject to the applicable law and to verification of your identity, you may:

• know about and access the personal information We hold about you;
• correct inaccurate personal information;
• delete your personal information;
• obtain a portable copy of your personal information;
• opt out of any sale or sharing and of targeted advertising (We do not engage in these);
• appeal a decision on your request, where the applicable state law provides for an appeal.

We do not use your personal information to make decisions that produce legal or similarly significant effects about you, and We will not discriminate against you for exercising your rights. To exercise these rights, contact Us using the details in Section 21. You may use an authorised agent where the law allows.

Global Privacy Control. We honour the Global Privacy Control signal. If your browser or an extension sends a Global Privacy Control signal (Sec-GPC: 1), We treat it as a valid opt-out of product analytics for that browser, and We do not process analytics events from it.

Do Not Track. The Do Not Track (DNT) standard was never finalised and carries no agreed legal meaning, so We do not treat it as a binding opt-out inside the ziptie.ai application. On Our marketing website a DNT signal does suppress product analytics: no analytics script is loaded and no cookie banner is shown. Alongside it We rely on the Global Privacy Control signal above, on the in-app control in Settings > Privacy, and on the cookie preferences banner on Our marketing website as the ways to opt out of product analytics.

ziptie.ai shall not be deemed responsible for data privacy protection rules applied by other websites than ziptie.ai, to which links are provided at the ziptie.ai websites. Users are requested to familiarise themselves with the data privacy policies and/or statements being placed at Our partners’ website(s).

The ziptie.ai service is automated. Its main automated processing is the analysis of AI Search results: We use AI models to assess the sentiment of how a brand is portrayed in AI-generated answers (positive, neutral, or negative) and to compute an AI Success Score, a composite metric that combines brand-mention, citation, and sentiment signals, with the sentiment component weighted by how often the brand is mentioned. This processing operates on the brands, websites, and queries you configure and on the public AI answers collected for them, not on a profile of you as an individual.

We do not carry out automated decision-making that produces legal or similarly significant effects about you within the meaning of Article 22 GDPR. Where any processing of your personal data is automated and you have questions or wish to object, you may contact Us using the details in Section 21.

Cookies

To a limited extent, we may process personal data automatically by using the cookie files. Cookies are small text files saved on your computer or mobile device whilst using the internet. These files are used to explore some of the functionalities provided by Our website or act as confirmation that a certain user saw a particular website’s content. We use cookie files that are required for ziptie.ai to operate, a cookie that records your cookie-banner choice, and, where you have accepted product analytics, first-party analytics cookies. The required cookies are used to ensure:

• that the user’s session is maintained;
• proper usage of log-in data.

We set the following first-party analytics cookies:

• op_anon_id - a randomly generated identifier that lets Us link your activity across our marketing website and the application for product analytics. First-party, scoped to .ziptie.ai, 2-year lifetime. May be cleared at any time via the cookie preferences banner on the marketing site, or via Settings > Privacy in the application.
• ziptie_attr - records the campaign parameters (utm_source, utm_medium, utm_campaign, utm_term, utm_content) carried by the web address you first arrived on, so We can tell which campaign brought you to Us. It holds no identifier of its own and is keyed to nothing but the first address of your visit. First-party, scoped to .ziptie.ai, 90-day lifetime. We set it only after you accept product analytics, and We clear it when you reject via the cookie preferences banner on the marketing site.
• ziptie_consent_choice - records whether you accepted or rejected product analytics on the marketing website. First-party, scoped to .ziptie.ai, 1-year lifetime. We set this cookie regardless of your choice so We do not repeatedly ask you. Cleared by clearing your browser cookies.

Bot protection on Our contact form

The contact form on Our marketing website is protected by Cloudflare Turnstile. When the form is shown to you, your browser loads the Turnstile script from challenges.cloudflare.com, which means Cloudflare receives the technical request data any web request carries, including your IP address. When you submit the form, We send the challenge token that Turnstile produced together with your IP address to Cloudflare’s verification endpoint, so that Cloudflare can score the submission as human or automated; if the score is negative the message is discarded and not delivered to Us. If Cloudflare cannot be reached, We skip the check and deliver your message anyway. We use Turnstile only to keep automated abuse off the contact form. We do not use it for advertising and We do not use it to build a profile of you. Cloudflare acts as Our subprocessor for this, as listed in Section 10.

Entry logs

We collect user information from their IP addresses by analysing entry logs. We use this information to diagnose problems related to server activity, possible security breaches, and website management. IP addresses are also used for statistical reasons, namely, to collect and analyse the demographic data of people visiting the website (i.e., regional information to define from where the given connection was made). On this basis, general, aggregated statistics may be produced. These do not contain any data enabling identification of a single user and, for this reason, shall not be deemed as personal data.

ziptie.ai makes all possible efforts to ensure all physical, technical, and organizational measures for personal data protection are in place in order to safeguard it against: accidental and/or deliberate destruction, accidental loss, alteration, and/or unauthorised disclosure. We maintain an information security program aligned to the SOC 2 Security, Availability, and Confidentiality criteria, including access controls, encryption, logging and monitoring, and vendor management. We also assure that each and every data processing being performed by Us is in compliance with all applicable laws, regulations, and policies.

If a personal data breach occurs, We act on it under Our incident response process. Where the breach is likely to result in a risk to your rights and freedoms, We notify the competent supervisory authority without undue delay and, where feasible, within 72 hours of becoming aware of it, in line with Article 33 GDPR. Where We act as a processor of Customer Content, We notify the affected customer without undue delay and, for confirmed exposure of customer data, within 24 hours, so that the customer can meet its own notification obligations. Where the breach is likely to result in a high risk to you, We also inform affected individuals as required by applicable law.

If you are in the EEA or the United Kingdom, once We collected your personal data you are vested with the following rights:

• to access your personal data;
• to rectify your personal data;
• to remove your personal data (right to be forgotten);
• to limit the personal data being processed;
• to transfer your personal data to another data controller;
• to file an objection against the way of personal data processing;
• to withdraw your consent to process your personal data at any moment without affecting the legitimacy of processing performed on the basis of your consent being given prior to such withdrawal;
• to file a complaint to the relevant Data Protection Authority, when you believe that personal data processing performed by Us violates the provision(s) of law.

To exercise any of these rights, contact Us using the details in Section 21. If you are a US resident, your rights are described in Section 12.

How to make a request, and how long it takes. Write to Us at privacy@ziptie.ai from the email address on your ziptie.ai account and tell Us which right you want to exercise. We may ask for information We need to verify your identity before We act. We acknowledge a request within 30 days and complete it within 90 days. There is no self-service personal data download inside the application: the Exports feature produces project reports, not a copy of the personal data We hold about you, so access and portability requests are handled by Us manually on the channel above.

Deleting your account. You can delete your own account at any time from Settings > Delete account, without contacting Us. Two conditions can hold a deletion, and both are preconditions you can clear rather than a permanent refusal. First, deletion is refused while you are the Owner of any workspace: transfer ownership of that workspace to another member, or delete the workspace yourself, which permanently removes its projects, prompts, monitoring history, and exports, and then retry the deletion. Second, deletion is refused while your account is the only emergency access account for a workspace that requires its members to sign in through an identity provider, because removing it would leave that workspace with no way back in if the provider locks people out: an Owner of that workspace can move the emergency access role to another Admin, or turn off enforced provisioning, and then retry the deletion. If you cannot clear either condition yourself, write to Us at privacy@ziptie.ai from the email address on your account and We will complete the deletion for you; We acknowledge such a request within 30 days and complete it within 90 days. Separately, if one of the safety checks on your account cannot be completed at the moment you ask, the deletion is refused without anything being deleted or changed, and you can try again shortly. After deletion, residual copies persist only for the limited periods described in Section 8.

ziptie.ai is a business service that is not directed to children. We do not knowingly collect personal data from anyone under the age of 16 (or the higher age of digital consent that applies in your country). If you are under that age, please do not use the service or provide Us with personal data. If We learn that We have collected personal data from a child without appropriate consent, We will delete it.

The personal data controller is ZIPTIE, INC., 108 Wild Basin Rd South, Suite 250, Austin, TX 78746, United States of America.

For privacy questions, or to exercise any of your rights, please contact Us at privacy@ziptie.ai (or contact@ziptie.ai).

You can also reach Us by post at the address above. Privacy requests are handled in English, and We answer them on the timescale set out in Section 19.

Updates in Our Policy usually reflect the technology development(s) and/or changes in the legal environment we operate in. We are also committed to follow the data protection guidelines and/or recommendations issued by the National and International Authorities.

For those reasons, we reserve the right to amend the current PP as needed. The date at the top of this Policy shows when it was last updated.