Privacy Policy
Updated September 1, 2026
Zipilot (“we,” “us,” or “our”) operates the Zipilot platform, available at zipilot.com and app.zipilot.com. This policy explains what data we collect, how we use it, and your rights.
1. Who we are
Zipilot LLC, a company registered in the United States, operates Zipilot. If you have questions, email us at privacy@zipilot.com.
2. What we collect
Account data. When you register, we collect your name, email, company name, country, and password, which is stored as a hash.
Business information. Services, prices, policies, documents, and other data you upload or enter during setup. This data is private to your account. We do not share it with other accounts or use it to train shared AI models.
Customer conversations. Messages between your AI assistant and your customers on connected channels, such as website chat and WhatsApp. This data belongs to you. We store it on your behalf.
Usage data. Pages visited, features used, API call counts, and error logs. We use this data to operate and improve the platform.
Payment data. We use Stripe to process payments. We do not store card numbers. Stripe's privacy policy governs payment data.
Pilot requests. If you ask to participate, we collect your name, work email, business name, and any optional details you share. We use them to review your request and contact you about the pilot. We delete requests that are not selected or receive no response after 90 days.
3. How we use your data
- To provide and operate the Zipilot platform
- To give your AI assistant the information it needs about your business
- To send transactional emails, including account verification, payment receipts, and activity summaries
- To detect and fix errors and performance issues
- To review and respond to pilot requests
- To comply with legal obligations
We do not sell your data. We do not use your business information or customer conversation data to train shared AI models.
4. How we store and protect your data
We store all data on Amazon Web Services (AWS). It is encrypted with AES-256 when stored and TLS when sent. Access permissions depend on each user's role. We keep an audit log of data access and changes where entries can only be added, not changed or removed.
Each account's data is kept separate. Other accounts on the platform cannot access yours.
5. Security
Our infrastructure and processes are designed to meet the SOC 2 Trust Service Criteria for security, availability, and confidentiality. Formal certification is in progress.
We encrypt stored data and data in transit. We limit access by role, keep each account's data separate, and maintain audit logs where entries cannot be changed. Backups run automatically and use Object Lock to protect them from changes and deletion.
6. Services from other providers
These providers help us run the platform.
- Amazon Web Services (AWS) provides infrastructure, storage, authentication, and AI models.
- Anthropic (through AWS Bedrock) processes language model requests. Data is processed with zero retention by default.
- Stripe processes payments.
- Google provides business search through the Google Places API.
- Firecrawl reads websites during business setup.
These services have their own privacy policies. We choose providers based on their data protection practices.
7. Data retention
We keep your data while your account is active. If you delete your account, we start deleting all associated data, including business information, conversation history, and user records. Backups are kept for up to 90 days after deletion.
8. Your rights
You can ask to access, correct, or delete your personal data at any time.
If you are in California, the CCPA gives you the right to know what data we collect, request its deletion, and opt out of its sale. We do not sell data. To exercise these rights, email privacy@zipilot.com. We respond within 30 days.
9. Cookies and local storage
We only use functional cookies and local storage. On this site, local storage remembers your light or dark theme preference. We do not use advertising or tracking cookies.
10. Children
Zipilot is a business platform. We do not knowingly collect data from anyone under 18 years old.
11. Changes to this policy
We may update this policy if the platform changes. We will email account holders about material changes. The date at the top of this page shows the current version.
12. Contact
For questions about this policy or your data, email privacy@zipilot.com.
Zipilot LLC · zipilot.com