Zapeat

Privacy Policy

Last updated: 30 June 2026

This Privacy Policy explains how Zapeat (“we”, “us”, “our”) collects, uses, shares and protects your information when you use https://zapeat.in and our website-building services (the “Service”). We act as the data controller for your account data and as a data processor for the content you publish through the Service. This policy is written to comply with the EU/UK General Data Protection Regulation (“GDPR”) and India’s Information Technology Act, 2000 and the rules made under it (including the SPDI Rules, 2011).

1. Information we collect

  • Account information — your name, email address, phone number (if provided) and password (stored only as a salted hash) when you sign up.
  • Business and website content — the text, images, media, links and settings you add to the sites you build with us.
  • User-generated content — anything you create, upload, generate or edit within the Service, including AI-assisted content you accept and publish.
  • Enquiries and leads — messages that visitors submit through forms on the sites you publish. These are lead-capture only; we do not process payments or store card details on your published sites.
  • Connected accounts — when you choose to connect Google, Facebook, Instagram or LinkedIn, we receive the access tokens and the specific permissions you grant (see “Third-party integrations” below).
  • Payment information — when you subscribe to a paid plan, buy a domain or purchase add-ons, payments are handled by our payment processor, Razorpay. We receive limited billing metadata (such as plan, amount, currency, order and payment identifiers and status); we do not receive or store your full card number, CVV or bank credentials.
  • Usage and device data — basic analytics such as page views, feature usage, approximate location derived from IP, browser type and log data, used to operate, secure and improve the Service.

2. How we use your information

  • To provide, operate, maintain and secure the Service and the sites you build.
  • To generate website content and layouts with AI based on the prompts and details you provide.
  • To publish content to your connected Google, Facebook, Instagram or LinkedIn accounts only when you explicitly ask us to.
  • To process subscriptions, domain purchases, renewals and add-ons through Razorpay.
  • To respond to your requests, provide support and send service-related communications.
  • To detect and prevent fraud and abuse, and to comply with legal obligations.

3. Legal bases for processing (GDPR)

Where GDPR applies, we rely on: performance of a contract (to provide the Service you sign up for); consent (for example, when you connect a social account or accept non-essential cookies — you may withdraw consent at any time); legitimate interests (to secure, improve and support the Service, balanced against your rights); and legal obligation (for example, to meet tax, accounting and law-enforcement requirements).

4. Cookies

We use essential cookies to keep you signed in and to operate the Service, and limited analytics cookies to understand usage and improve the product. Essential cookies are necessary for the Service to function; other cookies are used only where permitted. You can control or delete cookies through your browser settings, though disabling essential cookies may prevent you from signing in.

5. Third-party integrations

We only use the data obtained from the platforms below to perform the actions you request, and we never sell it or use it for advertising. You can disconnect any account at any time from your dashboard, which revokes the tokens we hold.

Google OAuth and Google Business Profile API

If you connect a Google account, we use Google OAuth to request only the scopes needed to manage the Google Business Profile you authorise (for example, to read and update your business listing on your behalf). Zapeat’s use and transfer of information received from Google APIs adheres to the Google API Services User Data Policy, including the Limited Use requirements. We do not use Google user data for advertising, and we do not transfer it to third parties except as needed to provide the feature you requested, for security, or to comply with law.

Facebook Login and Instagram Graph API (Meta)

If you connect a Facebook Page or Instagram account, we use Facebook Login and the Meta Graph APIs strictly to perform the actions you request — such as reading the list of Pages you manage, resolving the linked Instagram business account, and publishing posts you create. We store the access tokens securely and use them only for these purposes, in accordance with the Meta Platform Terms and Developer Policies. We never post without your action. You may remove Zapeat’s access from Facebook → Settings and Privacy → Settings → Business Integrations. To delete data we obtained through Facebook or Instagram, see our Data Deletion page.

LinkedIn OAuth

If you connect LinkedIn, we use LinkedIn OAuth to request only the permissions needed to publish the content you create to your authorised profile or page, in accordance with the LinkedIn API Terms of Use. We do not read your connections or message data.

6. AI-generated websites and content

The Service uses AI models (operated by us and by trusted AI providers) to generate website copy, layouts and images from the prompts and business details you provide. Prompts and the content needed to fulfil your request may be processed by these providers under contractual safeguards solely to return your result. You are responsible for reviewing AI-generated output before publishing. We do not use your private business content to train third-party foundation models without your consent.

7. Payments

Subscriptions, domain registrations and renewals, and add-ons are processed by Razorpay, a PCI-DSS-compliant payment processor. Card and banking details are collected and stored by Razorpay, not by us. We retain only billing metadata needed for invoicing, fraud prevention, tax and accounting. Your use of Razorpay is subject to Razorpay’s own privacy policy and terms.

8. How we share information

We do not sell your personal information. We share it only: (a) with service providers who help us run the Service (hosting, AI providers, email, analytics, and the payment and integration platforms named above), under appropriate safeguards; (b) when required by law, court order, or to protect our rights, users and the public; and (c) as part of a business transfer (such as a merger or acquisition), with notice where required.

9. International data transfers

We and our service providers may process data in countries other than yours, including outside the EU/UK and India. Where we transfer personal data internationally, we use appropriate safeguards such as Standard Contractual Clauses or equivalent mechanisms.

10. Data retention

We retain your information while your account is active and as needed to provide the Service. When you delete your account or specific content, we delete or anonymise the associated data — including access tokens, uploaded media and enquiries — within a reasonable period (typically within 30 days), except where we must retain limited records to meet legal, tax or dispute-resolution obligations.

11. Security

We use industry-standard measures to protect your data, including encryption in transit (HTTPS/TLS), hashed passwords, encrypted storage of third-party access tokens, access controls and monitoring. No method of transmission or storage is 100% secure, but we work continuously to protect your information and will notify affected users and authorities of a breach where required by law.

12. Your rights

Subject to applicable law (including GDPR and Indian data-protection rules), you may: access the personal data we hold about you; correct inaccurate data; delete your data (“right to be forgotten”); export a portable copy; object to or restrict certain processing; and withdraw consent at any time. To exercise these rights, email support@zapeat.in or use our Data Deletion page. You also have the right to lodge a complaint with your local supervisory authority.

13. Data deletion

You can disconnect social accounts, delete individual sites, pages, media or enquiries, or delete your entire account at any time. To request full deletion of the personal data we hold — including data obtained through Google, Facebook, Instagram or LinkedIn — follow the instructions on our Data Deletion page. We action verified requests within 30 days.

14. Compliance with Indian IT laws

We handle personal and sensitive personal data in accordance with the Information Technology Act, 2000 and the Information Technology (Reasonable Security Practices and Procedures and Sensitive Personal Data or Information) Rules, 2011, and applicable Indian data-protection law. Grievances relating to the processing of your information may be sent to our grievance contact at support@zapeat.in, and we will respond within the timelines prescribed by law.

15. Children

The Service is not directed to children under 16, and we do not knowingly collect their personal data. If you believe a child has provided us data, contact us and we will delete it.

16. Changes to this policy

We may update this policy from time to time. We will post the updated version here and revise the “Last updated” date above; material changes will be notified where reasonable.

17. Contact

Questions about this policy, or to exercise your rights? Email us at support@zapeat.in or visit our Contact page.