Zipchat AI Privacy Policy
Last updated: 24 June 2026
1. Introduction
Zipchat Inc. ("Zipchat," "we," "our," or "us") values and respects your privacy. This Privacy Policy describes how we collect, use, share, and safeguard your personal data when you use our websites, applications, integrations, products and services (collectively, the "Services").
We comply with applicable privacy laws, including:
- General Data Protection Regulation (EU) 2016/679 (GDPR)
- UK GDPR & Data Protection Act 2018
- California Consumer Privacy Act (CCPA) as amended by CPRA
- Brazilian General Data Protection Law (LGPD)
- Canadian Personal Information Protection and Electronic Documents Act (PIPEDA)
- Australian Privacy Act 1988
- Other global privacy regulations where we operate
By using our Services, you agree to the practices described in this Policy.
Two categories of data — and our different roles
This Policy covers two distinct types of data, and Zipchat's responsibilities differ for each:
- Website & Account Data – information about visitors to our websites and about the merchants and businesses that hold a Zipchat account. For this data Zipchat acts as a data controller, as described in Sections 3–7.
- End‑Customer Conversation Data – the messages, and related data, of shoppers and end‑users who interact with an AI chatbot that one of our customers has deployed on their own store or channels. For this data, our customer (the merchant) is the data controller and Zipchat acts solely as a data processor, processing it only on the merchant's documented instructions in order to provide the Services.
Where this Policy describes advertising, marketing, analytics or profiling, those activities relate to Website & Account Data only. We do not use End‑Customer Conversation Data for advertising, and we do not use it to train AI models that serve other customers. The safeguards that apply to End‑Customer Conversation Data are set out in Section 21 (Our Role as a Data Processor & Data Processing Agreement).
2. Data Privacy Framework (DPF) Compliance
Zipchat Inc. complies with the EU‑U.S. Data Privacy Framework (EU‑U.S. DPF), the UK Extension to the EU‑U.S. DPF, and the Swiss‑U.S. Data Privacy Framework (Swiss‑U.S. DPF) as set forth by the U.S. Department of Commerce. Zipchat Inc. has certified to the U.S. Department of Commerce that it adheres to the EU‑U.S. Data Privacy Framework Principles (EU‑U.S. DPF Principles) with regard to the processing of personal data received from the European Union and the United Kingdom in reliance on the EU‑U.S. DPF and the UK Extension to the EU‑U.S. DPF. Zipchat Inc. has certified to the U.S. Department of Commerce that it adheres to the Swiss‑U.S. Data Privacy Framework Principles (Swiss‑U.S. DPF Principles) with regard to the processing of personal data received from Switzerland in reliance on the Swiss‑U.S. DPF. If there is any conflict between the terms in this privacy policy and the EU‑U.S. DPF Principles and/or the Swiss‑U.S. DPF Principles, the Principles shall govern.
To learn more about the Data Privacy Framework (DPF) program, and to view our certification, please visit https://www.dataprivacyframework.gov/.
3. Information We Collect
Information you provide
- Name, surname, job title and company information
- Email address, phone number and contact preferences
- Billing and payment details (processed by trusted third‑party providers)
- Store addresses and e‑commerce platform data (Shopify, WooCommerce, Magento, etc.)
Information collected automatically
- Log data (IP address, browser, operating system, device identifiers)
- Usage data (clickstream, time spent, pages viewed, referral links)
- Chat transcripts and interaction data. Where these are generated by shoppers interacting with a customer's chatbot, they are End‑Customer Conversation Data that we process as a processor on the customer's behalf (see Sections 1 and 21).
- Approximate geolocation (derived from IP address)
- Advertising identifiers (cookies, pixels, UTM parameters)
Information from third parties
- E‑commerce platforms connected to your account
- Marketing platforms (Google, Meta, LinkedIn, TikTok, etc.)
- Analytics and CRM providers
- Partners and resellers
4. How We Use Your Information
We use data for the following purposes under lawful bases of contract performance, legitimate interest, consent and legal obligation:
- Service provision – to deliver, operate and maintain our Services.
- Account management – to onboard customers, verify identity and provide customer support.
- Service improvement – to analyze interactions and improve the quality, safety and performance of the Services. Each customer's chatbot answers only from that customer's own configured knowledge base and data, which is logically isolated per account; one customer's data is never exposed in another customer's conversations. We do not use End‑Customer Conversation Data to train shared or foundation AI models, and the AI providers that process this data on our behalf do not use it to train their models.
- Analytics and insights – to understand usage patterns, trends and performance.
- Advertising and marketing – to deliver personalized content, email campaigns, retargeting and measure ad effectiveness. These activities use Website & Account Data only and never End‑Customer Conversation Data.
- Compliance and security – to detect fraud, enforce Terms of Service and comply with legal obligations.
- Research and development – to develop new features and enhance user experience.
5. Cookies and Tracking
We use cookies, pixels, tags and similar technologies for:
- Conversion tracking and campaign optimization
- Website performance and session management
- Analytics (Google Analytics, Mixpanel, Amplitude)
- Advertising and retargeting (Google Ads, Meta Pixel, LinkedIn Ads, TikTok Ads)
You can manage cookie settings via your browser or through our Cookie Preferences Tool. For EU/UK users, no non‑essential cookies are deployed without consent.
6. Sharing of Information and Onward Transfer Liability
We do not sell personal data. We share limited data with trusted providers, including:
- Cloud infrastructure: Amazon Web Services (AWS), Google Cloud
- Analytics: Google Analytics, Mixpanel, Amplitude
- Advertising: Meta, Google Ads, LinkedIn, TikTok
- CRM/Marketing: HubSpot, Intercom, Customer.io
- Automation: Zapier, Segment
- Payments: Stripe, PayPal and other processors
- Compliance & Security: Anti‑fraud and security monitoring tools
Each third‑party provider is bound by confidentiality and data processing agreements. When transferring personal data to a third party acting as our agent, Zipchat Inc. remains responsible under the DPF Principles if that agent processes such personal data in a manner inconsistent with the Principles, unless we prove that we are not responsible for the event giving rise to the damage.
End‑Customer Conversation Data is treated differently. The advertising, analytics and marketing partners listed above receive Website & Account Data only. We do not share End‑Customer Conversation Data with advertising networks, ad exchanges or data brokers, and we do not use it for cross‑site retargeting or to build advertising profiles. The chatbot embedded on a customer's store does not load third‑party advertising or retargeting pixels. End‑Customer Conversation Data is shared only with the limited infrastructure and AI sub‑processors strictly necessary to deliver the chatbot, each engaged under a data processing agreement and permitted to process the data solely on documented instructions. A current list of sub‑processors is available on request.
7. International Data Transfers
As a U.S.-based company, data may be transferred internationally.
- For EU/EEA/UK customers, transfers are based on Standard Contractual Clauses (SCCs) and UK Addendum where applicable.
- For Swiss customers, transfers follow the Swiss Federal Act on Data Protection (FADP).
- For other jurisdictions, we apply equivalent safeguards.
8. Data Retention
We keep data only as long as necessary for the purposes outlined in this Policy:
- Account and billing data: retained for 7 years (legal obligation).
- Chat logs and End‑Customer Conversation Data: retained for the period configured by the relevant customer (controller) and anonymized or deleted thereafter, unless longer retention is required for security, legal or operational needs. Deletion requests for this data are handled as described in Section 21.
- Marketing data: retained until you opt out or withdraw consent.
9. Data Security
We implement industry‑leading security measures:
- Encryption (in transit and at rest)
- Role‑based access control
- Multi‑factor authentication for internal systems
- Regular audits, monitoring and penetration testing
While no system is 100% secure, we continuously improve safeguards.
10. Your Privacy Rights and Choices
Depending on your jurisdiction, you may have the following rights:
- Right of access – to obtain a copy of your personal data and information about how we process it.
- Right to correction or deletion – to have inaccurate information corrected or deleted when permitted by law.
- Right to restriction – to limit processing under certain circumstances.
- Right to portability – to request a copy of your personal data in a structured, machine‑readable format.
- Right to object or withdraw consent – to object to processing based on legitimate interests or withdraw consent at any time where consent is the legal basis.
Rights under the Data Privacy Framework:
- Individuals have the right to access their personal data and to correct, amend or delete information where it is inaccurate or processed in violation of the DPF Principles.
- Individuals also have the right to opt out of:
- The disclosure of their personal data to third parties, or
- The use of their data for purposes materially different from those for which it was originally collected or subsequently authorized.
Under the CCPA/CPRA (California), LGPD (Brazil) and PIPEDA (Canada) you may have additional rights such as the right to know what data we collect and share, the right to non‑discrimination for exercising privacy rights and the right to challenge compliance. To exercise any of these rights, please contact us at support@zipchat.ai.
11. Complaints and Inquiries
In compliance with the EU‑U.S. DPF, the UK Extension to the EU‑U.S. DPF and the Swiss‑U.S. DPF, Zipchat Inc. commits to resolve DPF Principles‑related complaints about our collection and use of your personal information. EU, UK and Swiss individuals with inquiries or complaints regarding our handling of personal data received in reliance on these frameworks should first contact us at:
Email: support@zipchat.ai
12. Independent Recourse Mechanism
In compliance with the EU‑U.S. DPF, the UK Extension to the EU‑U.S. DPF and the Swiss‑U.S. DPF, Zipchat Inc. commits to cooperate and comply with the advice of the EU data protection authorities (DPAs), the UK Information Commissioner's Office (ICO) and the Swiss Federal Data Protection and Information Commissioner (FDPIC) with regard to unresolved complaints concerning our handling of personal data received in reliance on the DPF. This recourse is provided free of charge to the individual.
13. Investigatory and Enforcement Powers
Zipchat Inc. is subject to the investigatory and enforcement powers of the U.S. Federal Trade Commission (FTC).
14. Binding Arbitration
Under certain conditions, and after exhausting other available remedies, individuals may invoke binding arbitration for complaints regarding DPF compliance that are not resolved by other DPF mechanisms. Zipchat Inc. is obligated to arbitrate claims and follow the terms as set forth in Annex I of the DPF Principles, provided that the individual has invoked binding arbitration by delivering notice to Zipchat Inc. and following the procedures and conditions described in Annex I. For more information, please visit:
15. Legal Compliance and Disclosure to Authorities
We may disclose personal data in response to lawful requests by public authorities, including to meet national security or law enforcement requirements. We also may disclose data when required by law, regulation, court order or to enforce our Terms of Service.
16. Children's Privacy
Our Services are not intended for individuals under 16. We do not knowingly collect personal data from minors. If we discover such data, we will delete it immediately.
17. Third‑Party Links
Our Services may contain links to external websites. We are not responsible for the privacy practices of third parties.
18. Automated Decision‑Making & Profiling
We may use automated tools, including AI algorithms, to personalize recommendations, trigger marketing campaigns and assess engagement. Significant decisions impacting individuals are subject to human oversight where required by law.
19. Do Not Track & Opt‑Out Mechanisms
We honor Do Not Track (DNT) signals where legally required. You can opt out of targeted advertising via the Network Advertising Initiative (NAI) or Digital Advertising Alliance (DAA) opt‑out pages.
20. Changes to This Policy
We may update this Policy periodically. Major updates will be communicated via email or in‑app notifications.
21. Our Role as a Data Processor & Data Processing Agreement (DPA)
When we provide the chatbot and related Services to a business customer, that customer determines the purposes and means of processing End‑Customer Conversation Data and is the data controller; Zipchat acts as a data processor (and our infrastructure and AI providers act as sub‑processors). In that capacity we commit to:
- process End‑Customer Conversation Data only on the customer's documented instructions and solely to provide the Services;
- not use that data for our own purposes, including advertising or training shared or foundation AI models;
- keep each customer's data logically isolated so it is never exposed in another customer's conversations;
- impose confidentiality and equivalent data‑protection obligations on every sub‑processor, and make the current sub‑processor list available on request;
- apply Standard Contractual Clauses (and the UK Addendum) to international transfers, as described in Section 7;
- assist the customer in responding to data‑subject requests and, on termination, delete or return the data subject to legal retention requirements.
Business customers — particularly those subject to the GDPR or UK GDPR — may enter into a Data Processing Agreement (DPA) with us that sets out these obligations contractually, including the list of sub‑processors and the Standard Contractual Clauses. To request our DPA, contact support@zipchat.ai.
22. Contact Us
Zipchat Inc.
407 East Ayre Street
Wilmington, DE 19804, USA
Email: support@zipchat.ai
