Privacy policy

This Privacy Policy explains what personal data Zaptium collects, why we process it, who we share it with, and the rights you have. Zaptium is operated by Zaptium Technologies LLP, a limited liability partnership incorporated in India (LLPIN ACZ-6920), with its registered office at P.No. 60, Manglam City Ext, Hathoj, Jaipur, Rajasthan 302012, India (GSTIN 08AAEFZ5141R1ZG; PAN AAEFZ5141R) ("Zaptium", "we", "us"). It is written to meet the requirements of the Digital Personal Data Protection Act, 2023 ("DPDP Act") and the Digital Personal Data Protection Rules, 2025.

It applies to people who create a Zaptium account and use the service. If you are a member of the public who submitted your details through a business's Instagram automation, that business decides how your data is used — see section 2.

1. Overview

We collect only what we need to run the service, we protect it, and we do not sell personal data. We do not use your content, your messages, or the data you collect through Zaptium to train or fine-tune machine learning models, and we do not use it for advertising.

2. Who is responsible for your data

Zaptium plays two different roles, and it matters which one applies to you:

For Zaptium account holders — when you sign up, subscribe, contact support or use the app, Zaptium is the Data Fiduciary (controller). This policy governs that processing.
For people who submit details to a business through Instagram — the business running the automation is the Data Fiduciary and Zaptium is its Data Processor. We process that data only on that business's instructions. Its own privacy notice governs how your data is used, and you should direct requests to it. Our obligations to that business are set out in our Data Processing Agreement. Zaptium still gives you a page where you can view and delete what you submitted, and we act on deletions received through it.

Zaptium is not a Consent Manager registered under the DPDP Rules and does not act in that capacity.

3. Personal data we collect

Account data — your name, email address, and password (stored only as a salted hash). If you sign in with Google, we receive a limited set of identity details from Google — see section 6; we never receive your Google password.
Workspace data — your workspace name, settings, and the membership records linking users to workspaces.
Instagram data — for each Instagram Professional account you connect: the account's profile details, an access token issued by Meta, and the comments and direct messages needed to detect triggers and send the replies you configure. We also store a durable identity record and a copy of the profile picture for each person your automations interact with, so that your inbox and lead records remain readable after Meta's temporary image links expire.
Configuration and content — the automations, reply templates, inbox rules, knowledge-base documents, bio pages and other content you create.
Bio-page form submissions — the details a visitor enters in a form on one of your bio pages, such as a newsletter sign-up. We email them to you and delete them after 7 days; see section 10.
Lead data — the field values members of the public submit to your automations, together with the consent record for each submission. You control this data; see section 2 and the Data Processing Agreement.
Billing data — your plan, subscription status, invoices, billing address and GSTIN where you provide one. Payments are handled by our payment provider; we never receive or store your full card number.
Usage and technical data — log records of requests to the service, IP address, browser and device information, timestamps, and error diagnostics, used to operate, secure and troubleshoot the service.
Legal acceptance records — which version of these documents your workspace accepted, when, by which member, and from which IP address and browser. These records are append-only and are kept as evidence of consent.
Support communications — the content of messages you send us.

4. Why we process it, and on what basis

Under the DPDP Act we process your personal data on the basis of the consent you give when you create an account and accept these documents, and, where applicable, on the basis of the legitimate uses recognised by section 7 of that Act — including data you voluntarily provide to us for a purpose, and processing necessary to comply with law.

To provide the service — to run your automations, deliver replies to Instagram on your behalf, store your leads, ground automated answers in your knowledge base, and publish your bio pages.
To operate and secure the service — authentication, session management, rate limiting, abuse prevention, diagnostics and incident response.
To respect Instagram's rules — enforcing messaging windows, rate limits and safe sending pace so your connected account is not restricted.
To bill you — managing subscriptions, processing payments, issuing GST-compliant invoices, and meeting tax and accounting obligations.
To communicate with you — service and security notices, billing notices, notice of changes to these documents, and responses to your support requests.
To meet legal obligations — including retaining financial records and responding to lawful requests.

We do not carry out automated decision-making that produces legal or similarly significant effects on you.

5. Instagram and Meta data

When you connect an account, you authorise Zaptium directly with Meta. You never share your Instagram password with us. We request only the permissions needed to read and respond to comments and messages, we use the data solely to provide the service to you, and we do not use it for advertising or sell it.

Access tokens issued by Meta are encrypted before storage. If you disconnect an account, or if Meta tells us you have removed Zaptium's access, we stop processing for that account and delete the associated data in line with section 10. We also honour Meta's data-deletion callbacks.

Zaptium cannot delete messages held by Instagram itself. The underlying conversation remains on Meta's platform under Meta's own terms and retention.

If you choose to create an account or sign in using Google, we use Google Identity Services. Google returns a signed identity token to us, and from it we receive only:

Your Google account identifier
Your email address and whether Google has verified it
Your first and last name
The URL of your Google profile picture

We do not request or receive a Google access token or refresh token, and we cannot read or write any other Google service — not Gmail, Drive, Contacts, Calendar, Photos or anything else. We request only the basic sign-in scopes (openid, email, profile). We use this information solely to create and authenticate your Zaptium account and to show your name and picture in the app.

Zaptium's use and transfer of information received from Google APIs to any other app will adhere to the Google API Services User Data Policy, including the Limited Use requirements. We do not sell this information, do not use it for advertising, do not use it to train or fine-tune machine learning models, and do not transfer it to others except as described in section 8.

You can revoke Zaptium's access at any time from your Google account permissions page. Revoking access stops you signing in with Google, but does not by itself delete your Zaptium account or data — to do that, see section 12.

7. Automated and AI-assisted processing

Zaptium uses Google's generative AI service to classify incoming messages, extract the field values you have configured, and draft answers grounded in your knowledge sources.

Before lead field values are sent to the AI service, values we detect are replaced with opaque tokens, and detokenisation happens within Zaptium.
The prompts sent to our AI provider and the responses it returns are not retained after processing. Inbound message content is stored so you can see your conversations and so automations can follow them, and is deleted as described in section 10.
Values we detect as payment card, Aadhaar, PAN, passport or bank account numbers, or as UPI IDs, are rejected and are neither stored nor logged.
Google does not use data submitted through our Google Cloud access to train or improve its models.

Detection is automated, pattern-based and best-efforts — it is not exhaustive, and we do not represent it as such. We identify these values by matching recognised formats and, where applicable, verifying checksums. A value written in an unusual way — in words instead of digits, unusually spaced or punctuated, split across messages, or in a format we do not yet recognise — may not be detected, in which case it is treated like any other text and may be stored and sent to our AI provider. Message content sent for classification and answering is not tokenised at all and may contain whatever personal data was written in it.

If you run automations, do not configure them to ask for these categories, and tell the people you interact with not to send them.

Where this processing takes place is described in section 9.

We do not sell personal data. We share it only with the following categories of recipient, each bound by confidentiality and data-protection obligations, and only to the extent needed:

Meta Platforms — to read and deliver comments and messages through the Instagram Graph API. Meta is the platform operator and holds its own copy of the conversation under its own terms.
Cloud infrastructure providers — for hosting, databases, queues, object storage and email delivery.
Our generative AI provider — for the classification, extraction and answering described in section 7. Lead field values are tokenised before they are sent; message content is not.
Our payment provider — to take payment and manage subscriptions.
Professional advisers and authorities — where required by law, to establish or defend legal claims, or to protect the rights and safety of users and the public.
An acquirer — if Zaptium is involved in a merger, acquisition or sale of assets, subject to this policy continuing to apply.

The current list of the sub-processors that handle data we process on your behalf, together with their purpose and location, is maintained in our Data Processing Agreement. We give at least 30 days' notice before adding or replacing one.

Requests from public authorities. Police forces, courts, regulators and other public authorities sometimes ask a company to hand over personal data. We do not treat such a request as automatically binding. Before we disclose anything:

We require the request in writing, identifying the authority, the legal power relied on, and the specific records sought. We verify independently that it comes from who it claims to, that it is validly issued, and that the power relied on actually covers the data demanded.
We refuse, or formally challenge, a request that is not validly issued, exceeds the authority's powers or jurisdiction, is unclear as to what it demands, is disproportionate to its stated purpose, or would require us to breach the law or our obligations to you.
We disclose only the specific records compelled, for the people and the period named. We do not produce whole-table or whole-workspace exports, and we exclude data belonging to other customers and to people the request does not name.
We tell you when an authority asks for data relating to your workspace, unless we are legally prohibited from doing so — in which case we tell you as soon as that prohibition lifts. Where the authority can obtain the data from you directly, we say so and direct them to you, because for the data your automations collect you are the Data Fiduciary and we are only the processor.

We keep a record of every such request and of our response to it, including the ones we refuse. The single exception to the process above is an emergency involving a risk to someone's life, where we may act first; we then complete the review and record the outcome immediately afterwards.

9. Where your data is processed

Your account data, workspace data, lead data, message content and backups are held in databases hosted in India (Mumbai region). Files are the exception described below.

Two parts of the service may process data outside India. The generative AI features described in section 7 are delivered by Google, and personal data submitted for them may be processed outside India. Google commits to a machine-learning processing location only for certain regions and models, and gives no such commitment for the models we use. Files — documents and images you upload, copies of profile pictures, invoice PDFs, lead CSV exports and our application logs — are stored with our object storage provider, Cloudflare, which does not offer storage fixed to India, so they may be stored outside India; lead CSV exports are deleted within a day of being generated. Every request to the service also passes through Cloudflare's globally distributed network, which may handle it outside India on its way to our servers in India, and that network may cache published bio-page content, which is public by design, outside India. All other processing takes place in India.

Where we transfer personal data outside India we do so in accordance with section 16 of the DPDP Act and Rule 15 of the DPDP Rules, and we will comply with any restriction the Central Government notifies in respect of such transfers. We will update this policy and give notice before making any change to where personal data is processed.

10. How long we keep it

Account and workspace data — for as long as your account is open. On deletion, we erase or de-identify it within 30 days, except where we must keep it by law.
Instagram data and message content — for as long as the account is connected. On disconnection, on account deletion, or on a Meta deauthorisation or data-deletion callback, it is deleted within 30 days. After a disconnection or a deauthorisation we keep only the account's Instagram identifier and username: the username labels the leads, bio page and automations your workspace keeps, and the identifier means the account can be reconnected only to the workspace it belongs to, until that workspace is deleted. Leads captured through the account are lead data and are kept as described below.
Lead data — for the retention period the workspace configured, after which it is erased automatically. A person can delete their own submission at any time from the page linked to them.
Bio-page form submissions — emailed to the page's owner and deleted from Zaptium 7 days after submission.
Consent records and notice snapshots — kept for 3 years after the related data is erased, as evidence that consent was obtained and later withdrawn or acted upon. These contain no lead field values.
Legal acceptance records — kept for 8 years after the workspace closes, as evidence of the terms in force.
Billing and tax records — kept for 8 years, as required by Indian tax and company law.
Operational and access logs — kept for 1 year for detection, investigation and remediation. These record event type, actor, reference identifiers, timestamps, and the IP address and browser of each request, and do not contain lead field values or message content.
Backups — rotated on a 35-day cycle. Deleted data persists in backups until the cycle completes, after which it is unrecoverable.

11. Your rights

As a Data Principal under the DPDP Act, you have the right to:

Access a summary of the personal data we process about you and the processing activities involved.
Correction, completion and updating of inaccurate or incomplete data. You can update most account details in the app; write to us for anything else.
Erasure of your personal data, unless retention is required by law.
Withdraw consent at any time, with the same ease as it was given. Withdrawing consent does not affect processing carried out before withdrawal, and may mean we can no longer provide the service.
Nominate another individual to exercise your rights in the event of your death or incapacity. Write to us to record a nomination.
Grievance redressal — see section 17. You may complain to the Data Protection Board of India if you are not satisfied with our response.

Within the app you can also export your leads, disconnect an Instagram account, review your workspace's history of accepted legal documents, and delete your account. We respond to rights requests within 30 days.

You are responsible for the accuracy of the data you give us, and for not impersonating another person or making a false or frivolous request — the DPDP Act imposes duties on Data Principals in these respects.

12. Deleting your data

You can delete your account and its data at any time from your account settings, or by writing to privacy@zaptium.in. We confirm when deletion is complete. Deletion removes your workspace's data, including automations, leads, knowledge sources and connected-account records, subject to the retention exceptions in section 10.

If you removed Zaptium through Instagram rather than through us, Meta notifies us and we delete the associated data on the same basis. This is the data-deletion process referenced from our site footer.

13. Security

We apply technical and organisational measures appropriate to the risk, including:

Encryption in transit using TLS, and encryption at rest for databases, storage volumes and backups.
Application-layer encryption of lead field values with AES-256-GCM, using a key held separately from the application database.
Encryption of Instagram access tokens before storage.
Passwords stored only as salted hashes; we can never read your password.
Role-based access control, with each workspace's data logically isolated from every other workspace's.
Administrative access restricted to Zaptium staff authenticating through our corporate identity provider on a Zaptium-controlled domain, granted on a least-privilege basis and removed on role change or departure.
Logging of access and processing events, reviewed for signs of unauthorised access.
Masking of lead field values in list views, revealed only on an explicit, logged action.

No system is perfectly secure. If a personal data breach occurs, we will notify affected Data Principals and report to the Data Protection Board of India as required by Rule 7 of the DPDP Rules.

14. Children

Zaptium is not intended for anyone under 18, and we do not knowingly collect personal data from children. Lead capture asks every person to declare whether they are aged 18 or over before any notice is shown; where someone declares they are under 18, no notice is displayed, no consent is recorded and no lead data is collected; we keep only a record that the flow was stopped. We do not offer a verifiable parental consent mechanism, and the service must not be configured to collect data from children or to direct advertising or behavioural monitoring at them.

If you believe we hold data about a child, write to privacy@zaptium.in and we will delete it.

15. Cookies and local storage

We use cookies and browser local storage only for functional purposes: keeping you signed in, holding your session and authentication tokens, and remembering interface preferences such as whether the sidebar is collapsed. We do not use advertising or cross-site tracking cookies, and we do not run third-party analytics that profile you. Blocking functional cookies will prevent you from signing in.

16. Changes to this policy

We may update this policy — for example to reflect new features, a change of sub-processor, or a change in law. When we publish a new version we assign it an effective date and show it to you in the app before that date arrives, together with a summary of what changed and a link to the previous version.

Material changes — including changes to the purposes of processing, the categories of data collected, or where data is processed — require your acceptance, and we give at least 30 days' notice before they take effect. Section 11 of our Terms & Conditions describes how this works, including what happens if you have not accepted by the effective date. Your workspace's acceptance history is available in your workspace settings.

17. Contact & grievance redressal

For any question about this policy, to exercise a right, or to raise a grievance, contact our Grievance Officer:

Grievance Officer
Zaptium Technologies LLP (LLPIN ACZ-6920)
P.No. 60, Manglam City Ext, Hathoj, Jaipur, Rajasthan 302012, India
Email: privacy@zaptium.in

We acknowledge every grievance within 72 hours and aim to resolve it within 30 days. If you are not satisfied with our response, you may complain to the Data Protection Board of India.

For account and product support, contact support@zaptium.in. For billing and invoices, contact billing@zaptium.in.