Privacy Policy

Who we are

Zappush is operated by Zappush LLP. Our registered office and contact details are in the Contact us section at the end of this policy.

For any question about privacy, or to make a request about your information, write to us at [email protected]. We read everything sent there.

The two roles we play

When you are our customer

When we manage account information, business contacts, billing, our own website or marketing, we decide why and how that information is used. We act as the controller for those activities. Ask us anything about them and we will answer you.

Shopper information on our customers' stores

Where a store has connected Zappush, we process information about its shoppers on that store's behalf. The store decides what is collected, how it is used, and where it is sent. We act as its processor, follow its instructions and do not use that information for our own purposes. The store is the controller and its own privacy notice explains its purposes, lawful basis and the choices available to its shoppers.

Shoppers should contact the store they purchased from. We assist the store with those requests as set out in our DPA.

Information we collect from our customers

• Account information: your name, work email address, company name, role, and a cryptographic hash of your password. We never store your password itself.
• Workspace configuration: your store domains, the platforms you connect, the advertising accounts you connect, and your settings.
• Billing information: your plan, billing cycle, invoices, and payment status. Card and bank details go directly to our payment providers. We never see them and never store them.
• Product usage: which pages you open in the dashboard, which features you use, and what you do there, so we can see what is working and what is not.
• Support communication: the messages, attachments, and screenshots you send us.
• Technical information: your IP address, browser and device type, and log records of requests your session makes to our services.

We receive account and business-contact information from you, from the organisation that invites you to an account, and from your use of our websites and platform. Payment providers and enabled integrations also supply information needed to manage the service.

Information needed to create an account, provide the requested service or issue an invoice is required for those purposes. Without it, we may be unable to provide the relevant service. Optional marketing and non-essential tracking are not required to hold an account.

Information we process on behalf of our customers' stores

When a store connects Zappush, the platform records what happens on that store and builds a profile for each shopper, so the store can understand its customers and measure its advertising. Depending on what the store sends us and how it has configured the platform, that can include:

• Contact details: email address, phone number, first name, and last name.
• Order information: orders, line items, quantities, values, currency, and refunds.
• Address details: city, state or region, postal code, and country.
• Behaviour on the store: pages viewed, products viewed, items added to a cart, checkouts started, purchases completed, and similar actions.
• Technical information: IP address, browser and device type, and identifiers held in cookies or local storage.
• Approximate location worked out from the IP address: country, region, city, and postal code.
• Consent and preference signals supplied by the store or its consent tools.
• Further attributes where the store chooses to send them: date of birth, gender, and the store's own customer identifier.

We receive this through the tracking script the store installs, through the connectors the store enables, such as its e-commerce platform, and through files the store uploads itself.

We do not ask for and do not want government identifiers, payment card numbers, passwords, health records or other sensitive information. The platform is not intended to hold them, and our agreement with our customers asks them not to send them unless we have expressly agreed otherwise in writing. This includes product details, URLs or event fields that reveal health or other sensitive information. If we discover such information, we will work with the store to restrict and remove it.

How we use information

To provide the platform:

• Record what happens on a store and turn it into a usable record of each shopper.
• Recognise a returning shopper across visits and devices, so a store's reporting and customer profiles are accurate rather than counting the same person many times.
• Deliver conversion and audience data to the advertising platforms a store connects, in the form each platform requires.
• Produce the analytics, reports, and segments shown in the dashboard.

To run the business:

• Keep the service secure, and detect and prevent fraud, abuse, and unauthorised access.
• Provide support and answer questions.
• Bill for the service and keep the records the law requires us to keep.
• Send service notices, and tell customers about changes and new features. Marketing email is optional and every one of them carries an unsubscribe link.
• Improve the product, by understanding which parts of the dashboard are used and where people get stuck.

We do not sell personal information. We do not share it with anyone for their own marketing. Every customer's data is held separately from every other customer's, and we do not use one customer's data to produce results for another.

The legal bases we rely on

Where the GDPR applies to information for which we act as controller, we rely on the following bases:

When we rely on legitimate interests, we assess whether those interests are outweighed by your rights and freedoms. You can ask us about that assessment and object to the processing. We do not use legitimate interests to bypass consent where consent is required.

For shopper information, the store determines the lawful basis. We process it under the store’s instructions and our DPA; the bases above do not give us a separate right to use shopper information for our own purposes.

Consent

Where a store must obtain consent before tracking its shoppers, it is responsible for obtaining that consent and explaining the processing. We follow the consent and withdrawal signals supplied through the agreed integration and configuration. When the store tells us a shopper has not consented to marketing, we do not forward that shopper’s information to advertising platforms.

Where our own processing relies on consent, you can withdraw it at any time through the relevant consent controls, the unsubscribe link in a marketing email, or by contacting us. Withdrawal does not affect processing that was lawful before you withdrew. Accepting our Terms is not a substitute for consent where the law requires it.

Who we share information with

We share information with the providers needed to run the service and the destinations our customers choose, as described below. Providers acting as our processors are contractually restricted to the agreed purposes. Some recipients, including advertising platforms and payment providers for certain activities, act under their own legal responsibilities and privacy terms.

Service providers

These providers process shopper information on our behalf. They are the sub-processors under our Data Processing Agreement.

• Google Cloud Platform: hosting, databases, storage, encryption keys, logs and backups for the platform. Processed in: United States, or the regions specified in an agreed EU-hosting schedule for the covered services.
• Cloudflare: content delivery, script caching and DNS in front of our services. Browser requests may include IP addresses and request metadata. Processed in: United States and global edge network.
• IPLocate: resolving an IP address to an approximate location. It receives the IP address without accompanying shopper names, email addresses or order information. Processed in: Australia, with servers in Europe, the United States, Singapore and Australia.

We also use providers for our own business: hosting and infrastructure, payment processing, transactional email, product and website analytics, and protection against automated abuse. They receive no shopper information, so they are not sub-processors under the DPA and we are the controller for that processing. Customers can ask us for the current list of those providers at any time.

Sub-processor list last updated: 9 August 2026

The providers used depend on the features and integrations enabled; not every provider receives shopper information. We update this list when it changes. For providers processing shopper data on our behalf, the notice and objection process in our Data Processing Agreement applies, including at least 30 days’ advance notice of a new or replacement sub-processor.

Advertising platforms our customers connect

When a customer connects an advertising platform, we send that platform the conversion and audience data the customer has configured. Contact details are converted to an unreadable one-way value before they are sent, in the format the platform requires, so the platform receives a hash rather than an email address or a phone number.

The customer decides which platforms to connect, which events are forwarded, and can disconnect at any time. The platform’s subsequent use is governed by its own terms and privacy policy. Hashes and other identifiers can still be personal information, particularly when used to match a shopper to an existing account; hashing does not remove applicable consent or transfer requirements.

Everyone else

We may disclose necessary information to professional advisers, courts or authorities where lawfully required or necessary to establish or defend legal rights. If our business is acquired or merged, relevant information may transfer as part of that transaction, subject to confidentiality and applicable law, and we will provide the required notice.

For shopper information, these disclosures remain subject to our DPA, the applicable transfer safeguards and data protection law. This section does not give us an independent right to use shopper information.

Where information is stored and transferred

Our standard platform runs on Google Cloud Platform infrastructure in the United States, and our team works from India. Other providers process information in the locations listed above.

If you need your data held in a particular region, such as the EU, we can agree a dedicated deployment as an additional service. The hosting schedule sets out the regions and which data, processing, databases, logs and backups are covered. Support access and external services, including connected advertising platforms, may still involve other locations, so a hosting region does not remove every international transfer.

When information crosses borders and the law requires a safeguard, we use the mechanism appropriate to the countries involved: an adequacy decision where one applies, and otherwise Standard Contractual Clauses or an equivalent recognised mechanism, together with any supplementary measures the transfer assessment calls for. For shopper information, the safeguard that applies to your deployment is recorded under our DPA. Transfers by other providers are covered by their own arrangements.

We claim participation in a certification scheme, such as the EU–US Data Privacy Framework, only where the Zappush entity you contract with is certified and your agreement says so.

Write to [email protected] for details of the safeguards relevant to your information, or to request a copy with permitted redactions.

How long we keep information

We keep information only for as long as needed for the purpose it serves, subject to applicable law and customer instructions.

A backup may therefore expire after the live-system deletion date. We restrict its use and reapply deletion instructions if a backup is restored. Any legal retention exception is limited to the necessary information and purpose. Applicable law and the DPA’s transfer obligations take priority over inconsistent retention periods.

Our Data Retention Policy provides further detail. You can ask us about the period applicable to a particular record.

How we protect information

Data is encrypted in transit and at rest. Access tokens for your connected platforms are encrypted with a managed key service and bound to the record they belong to. Every read and every write in the platform is scoped to a single workspace, so one customer's data cannot be reached from another's. Access to production systems is limited to the people who need it.

Our Security page describes this in full, including what we do not claim.

Your choices and your requests

Depending on the applicable law and circumstances, you can ask us to:

• Confirm whether we process your information and give you access to it.
• Correct inaccurate or incomplete information.
• Delete information we no longer have a lawful reason to keep.
• Restrict processing while an issue is resolved or where the law provides that right.
• Provide information you supplied in a portable format, where the legal conditions apply.
• Stop processing based on legitimate interests, on grounds relating to your situation.
• Stop direct marketing, including profiling related to that marketing. You may object to this at any time.
• Withdraw consent where processing relies on it.
• Close your account.

Write to [email protected] from an address associated with your account, or provide enough information for us to locate the relevant records. We may request reasonable information to confirm your identity. There is no charge for making a request.

Where the GDPR applies and we are the controller, we respond without undue delay and within one month of receiving your request. If its complexity or the number of requests justifies an extension, the law allows up to two further months; we will explain the reason within the first month. If we cannot grant a request, we will explain why and how you can challenge that decision. Other applicable deadlines remain in place.

For shopper information, the store is the controller and handles these requests. We assist it as set out in our DPA.

Complaints

You can raise any privacy concern with us at [email protected]. You also have the right to complain to a competent data protection authority and seek a judicial remedy where applicable. Under the GDPR, this includes the authority in the country where you habitually live, work or where you believe an infringement occurred. You do not need to contact us first.

European authorities are listed on the European Data Protection Board’s website.

Privacy mode

Some of our customers cannot have their shoppers' contact details held in readable form by an outside party. For them we offer privacy mode, which converts identifying details to an unreadable one-way value the moment they arrive, so no readable name, email address, or phone number is ever written to disk. The platform still recognises a returning shopper and still reports accurately.

Privacy mode is set up with our support team rather than from a toggle, because it changes what some features can do. Write to [email protected] if you want to talk about it.

Cookies and similar technologies

On our own websites and dashboard, we use cookies and similar technologies for two purposes. Some are necessary for something you have asked for, such as staying signed in, keeping your preferences, and protecting forms from automated abuse. Others measure how our sites and tools are used so we can improve them. The third-party tools behind that measurement at any given time are listed under Service providers above, and that list shows the date it last changed. We may also use our own first-party measurement alongside or instead of a third-party tool; the same rules in this section apply to it.

We use non-essential cookies and similar technologies only where the law permits. Where the law requires consent, we obtain it before they are set and you can withdraw it at any time, through the consent control shown on the site or by writing to [email protected]. Your browser settings can also block or delete cookies, though this may affect functionality and does not control every technology, and clearing cookies does not by itself delete information already held on servers.

On our customers' stores, the store manages its own cookie notice and consent controls. Zappush may set a first-party identifier under the store's domain to recognise a returning shopper, subject to the store's consent configuration and applicable law. A first-party identifier is not automatically exempt from consent requirements.

Customer profiles and automated processing

Zappush uses automated processing to connect events and visits to a shopper profile, calculate attribution and customer metrics, and create segments on the store’s instructions. For example, linked identifiers and purchase history may help a store distinguish returning customers or measure which advertising led to a sale. These outputs can affect the audiences or marketing the store chooses.

The store decides which features and destinations it uses and must explain its profiling and uses in its own notice. Where a solely automated decision produces legal or similarly significant effects, the additional notices and safeguards required by law apply, including rights to human intervention and to contest a decision where applicable. Our role is to assist the store as set out in the DPA.

Children

Zappush accounts are intended for adults acting for businesses. Our standard service is not designed to collect children’s information. Customers must not knowingly send children’s information through the service. If you believe a child’s information has reached us, contact [email protected] and we will investigate and arrange removal with the relevant controller where needed.

Changes to this policy

We may update this policy to reflect changes in what we do, in the providers we use, or in the law. When we do, we update the date at the top of this page. If a change materially affects how we handle your information, we will tell our customers by email or in the dashboard before it takes effect. We follow the advance-notice requirements in our Terms for changes to the customer agreement and obtain new consent where the law requires it. Posting an update does not, by itself, authorise a new use of shopper information.

Contact us

For any question about this policy, to make a request about your information, or to raise a complaint, write to us at [email protected] or by post at:

Zappush LLP Desk No. WSA43, First Floor, B128, B Block, Sector 2, Noida Uttar Pradesh 201301, India Email: [email protected]