Privacy Policy

Overview

This Privacy Policy explains how Zipatch (“we,” “us”) collects, uses, and shares information when you use zipatch.com and the Zipatch dashboard (the “Service”).

1. Information we collect

We collect only what we need to run the Service:

• Account information — your mobile phone number, your Zipatch password, and any promo or referral code you use.
• Delivery-platform account information — the email address and password of the Amazon Flex account you link, verification codes you enter to connect it, and information from that account the Service needs to work, such as available offers, the blocks you accept, service areas and stations, and block pay.
• Your settings — search filters, schedules, preferred stations, and bot preferences.
• Purchase information — the pass you buy, its price, and payment status. Card payments are processed by Stripe; we never receive or store your full card number.
• Support communications — messages you send us, for example over WhatsApp.
• Support assistant conversations — if you use the in-app AI support assistant (“Ask Zipatch”), the messages you type, its replies, the screens it suggests, whether you rated an answer as helpful, and whether you asked to talk to a person. To answer, the assistant reads information already in your Zipatch account — your subscription status, bot status and recent activity, your settings and filters, and offer statistics for your stations. It does not read your passwords or payment card details.
• Technical and usage information — IP address, browser and device type, pages visited, and actions taken in the Service, collected through server logs and the analytics and advertising tools described below.

We do not access your device’s location, contacts, camera, or microphone.

2. How we use information

• To provide the Service: sign in to your delivery-platform account on your behalf, search for and accept blocks that match your settings, and show your activity and history.
• To verify your phone number, secure your account, and prevent fraud and abuse, including with reCAPTCHA and Turnstile checks.
• To process purchases and manage your pass.
• To send service text messages and answer support requests.
• To answer your questions in the support assistant and, if you ask to talk to a person, to give our support team the context of your conversation.
• To understand how the Service is used so we can improve it, and to measure how well our advertising works.
• To comply with the law and enforce our Terms of Service.

3. How we share information

We do not sell your personal information for money. We share it only as follows:

• Service providers that work for us under contract: the provider that operates our automation infrastructure (which stores your linked-account credentials so it can sign in on your behalf); hosting, database, and content-delivery providers, including Cloudflare; Stripe (payments); Google reCAPTCHA and Cloudflare Turnstile (bot protection); our customer-relationship and workflow tools, HighLevel and Make.com (your phone number, email address, and account milestones such as sign-up, account linking, purchases, and pass expiry); and text-message delivery providers.
• AI model provider — when you use the support assistant, your messages and the account information it needs to answer are sent to a third-party AI model provider that generates the reply. The provider may keep this information for a limited time under its own terms, for example to prevent abuse. We do not use your conversations to train AI models, and we only use providers whose terms do not allow them to train their models on it.
• Your delivery platform — when the Service signs in to and acts on your Amazon Flex account, your credentials and requests are sent to Amazon, which handles them under its own privacy policy.
• Advertising measurement — our website uses the Meta Pixel, which lets Meta collect information such as pages visited, sign-up and purchase events, and cookie or device identifiers. Meta may combine it with other information it has about you. Some state laws consider this “sharing” for targeted advertising; see “Your choices and rights” to opt out.
• Legal and safety — when required by law, or to protect the rights, safety, and property of Zipatch, our users, or others.
• Business transfers — as part of a merger, acquisition, or sale of assets, subject to this policy.

Text messaging: no mobile information will be shared with third parties or affiliates for marketing or promotional purposes. Your text-messaging opt-in data and consent will not be shared with any third party, except the service providers that deliver our messages.

4. Analytics

We use Umami, a privacy-focused analytics tool that we host ourselves, to count visits and key steps such as sign-ups and purchases. Umami does not use cookies, does not store identifiers on your device, and does not track you across other websites. It records the page address (without query parameters), referring site, browser, operating system, device type, screen size, language, and approximate country derived from your IP address. Your IP address itself is not stored; visitors are counted using an anonymized value that changes periodically.

When you use the support assistant, Umami also records which entry point you used and whether you rated an answer — never the text of your messages.

5. AI support assistant

The support assistant is optional. It answers questions about the Service and your account using the information described above. It can only read your account: it cannot change your settings, make purchases, or act on your delivery-platform account.

Answers are generated by AI and may be wrong. Do not share passwords, verification codes, or card details in the chat. You can always contact a person through WhatsApp instead.

We store conversations for up to 90 days so we can review the quality of answers and improve the assistant, then delete them automatically. To ask us to delete your conversations sooner, contact us (see “Contact us”).

6. Cookies and similar technologies

• Essential cookies keep you signed in (connect.sid) and remember the account you selected (active_account), your language (NEXT_LOCALE), and layout preferences (sidebar_state).
• Security cookies are set by Cloudflare, Google reCAPTCHA, and Cloudflare Turnstile to tell people apart from bots.
• Advertising cookies are set by the Meta Pixel (for example, _fbp) to measure our ads. They are not set if your browser sends Global Privacy Control.
• Local storage in your browser holds preferences and cached data — for example a promo code you arrived with, notification and bot preferences, and cached schedules — so the dashboard loads quickly.

You can block or delete cookies and local storage in your browser settings. If you block essential cookies, you will not be able to sign in.

7. Do Not Track and Global Privacy Control

If your browser sends a Global Privacy Control (GPC) signal, we treat it as a request to opt out of the sale or sharing of your personal information: the Meta Pixel does not load and Umami records nothing. Umami also honors Do Not Track (DNT). Other parts of the Service do not change their behavior in response to DNT, because there is no common standard for it.

8. How long we keep information

We keep your information while your account is active and as needed to provide the Service. After you ask us to delete your account, we delete or de-identify your personal information, and instruct our service providers to do the same, within 30 days, except where we must keep it longer for legal, tax, accounting, or fraud-prevention reasons. Server logs are kept for a limited time for security and troubleshooting.

• Support assistant conversations: up to 90 days, then deleted automatically.

9. Security

We use encrypted (HTTPS) connections and access controls, and our providers store credentials in protected systems. No method of transmission or storage is completely secure, so we cannot guarantee absolute security. Because the Service stores the password for your delivery-platform account, we recommend using a password you do not use anywhere else.

10. Your choices and rights

• Access, correction, and deletion — email [email protected] to get a copy of your information, correct it, or delete your account. We will verify the request using the phone number on your account and respond within 45 days.
• Opting out of sale or sharing — turn on Global Privacy Control in your browser, or email us. You can also limit ad tracking in your Meta (Facebook) ad settings.
• Text messages — reply STOP to any message to opt out, or HELP for help. If you opt out, you may not be able to receive the verification codes needed to sign up or reset your password.
• State privacy rights — depending on where you live (for example California, Colorado, Connecticut, Texas, or Virginia), you may have the right to know, access, correct, delete, and receive a portable copy of your personal information; to opt out of targeted advertising, sale, or sharing; and to appeal our decision on your request. Email us to exercise them; you may use an authorized agent. We will not discriminate against you for exercising these rights. If we deny your request, you can appeal by replying to our decision, and if your appeal is denied you may contact your state attorney general.

11. Children

The Service is only for adults 18 and older. We do not knowingly collect information from anyone under 18. If you believe a minor has given us information, contact us and we will delete it.

12. Where we process information

We operate in the United States and process information there. If you use the Service from outside the United States, your information will be transferred to and processed in the United States.

13. Changes to this policy

We may update this policy. We will post the new version on this page with a new effective date and, for material changes, notify you in the Service before they take effect.

14. Contact us

Questions or requests about privacy: [email protected]. You can also reach us through the WhatsApp support link in the dashboard. The Service is operated by Zipatch.