This Privacy Policy explains how [Legal company name] (“Zaps”, “we”, “us” or “our”) handles personal data when you visit our website, sign up for Zaps, use the web and mobile apps, or contact us. It also explains your rights and how to exercise them.
1. Who we are
Zaps is provided by:
- Legal name
- [Legal company name]
- Commercial Registration
- [CR number]
- VAT number
- [VAT number]
- Registered address
- [Registered address, Riyadh, Saudi Arabia]
- privacy@heyzaps.com
You can contact us about privacy at any time at privacy@heyzaps.com.
2. Our role: controller and processor
We act in two different roles, depending on the data:
- As a controller, we decide how and why we process the personal data of our customers' administrators and users for account management, billing, security, support and communications with them, and the data of visitors to our website.
- As a processor, we process the business data that our customers put into Zaps — for example records about their employees, clients, contacts, deals, attendance, leave, invoices, emails and meeting notes — on the customer's behalf and according to its instructions. The customer (usually your employer) is the controller of that data, and its own privacy notice applies.
If you are an employee of one of our customers, or a client or contact of one, please send requests about your data to that organisation first. If you contact us, we will pass your request to them and help them respond.
3. The laws we follow
We process personal data in accordance with the Personal Data Protection Law of the Kingdom of Saudi Arabia and its Implementing Regulations and its Regulation on Personal Data Transfer outside the Kingdom, as supervised by the Saudi Data and Artificial Intelligence Authority (SDAIA); the UAE Federal Decree-Law No. 45 of 2021 on the Protection of Personal Data; and the other data-protection laws of the Gulf Cooperation Council states that apply to our processing.
4. The personal data we collect
Account and contact data
Name, work email, mobile number, job title, company name, workspace address, language and time zone. Passwords are stored only as secure one-way hashes.
Billing data
Billing contact, the company's tax details (such as VAT and Commercial Registration numbers and address), plan, invoices and payment status. Card details are collected and stored by our payment service provider; we receive only a token, the card brand, the last four digits and the expiry date.
Usage, device and security data
IP address, browser and device type, operating system, app version, crash reports, push-notification tokens, which features are used and when, sign-in and security events, and audit logs of actions taken in a workspace.
Location data
If a customer uses attendance, check-in, visit or route features, the precise location of a user's device — only during working hours or while checked in, and only after the user has consented on the device. Collection pauses on leave and days off.
Content in the Service
The information customers and users put into Zaps, such as companies, contacts, deals, meetings, notes, voice notes, files, quotations and invoices, attendance and leave records and department requests. We process this as a processor.
Connected email and calendar
If a user connects a Google or Microsoft account: email messages and their metadata, and calendar events, for that user only.
Meeting recordings and transcripts
If a user enables the meeting note-taker for a meeting: the recording, transcript and the participants' names as they appear in the meeting.
Communications with us
Messages you send to support or sales, and feedback.
Website
Our website uses no analytics or advertising cookies. Our hosting provider keeps standard server logs (IP address, browser, pages requested and time) for security and operation. On the sign-up page we use a bot-protection check that processes technical signals from your browser.
5. Why we use personal data, and our legal bases
- To create and manage accounts and workspaces and to provide the Service — necessary to perform our contract with the customer.
- To bill, collect payments and issue tax invoices — necessary for the contract and to meet our legal obligations, including tax and ZATCA e-invoicing requirements.
- To keep the Service secure, prevent fraud and abuse (including bot protection at sign-up) and keep audit logs — our legal obligations and our legitimate interest in protecting the Service and our customers.
- To provide support and send service messages such as trial, billing and security notices — necessary for the contract.
- To understand and improve the Service using aggregated or de-identified usage information — our legitimate interest.
- To send product news and offers to business contacts — with consent where the law requires it, and always with an easy way to opt out.
- To collect location for attendance and visits — on the user's consent on the device, and on the basis the customer, as the employer and controller, relies on.
- To comply with the law and respond to lawful requests from competent authorities — legal obligation.
We do not rely on legitimate interest to process sensitive personal data, and we do not use personal data for purposes incompatible with those for which it was collected.
6. Sensitive data
We do not intentionally collect sensitive personal data, such as data about health, religious beliefs or criminal records. Leave requests may include a reason or a supporting document (for example for sick leave); customers should limit this to what is necessary. Such data, and location data, are protected with restricted access within the customer's workspace.
7. AI features
AI features use third-party AI providers, including Anthropic (Claude). When you use them, only the content needed for your request is sent to the provider. We do not use your data to train AI models, and our providers are contractually prohibited from training their models on it and may keep it only briefly to provide the service and prevent abuse. Voice notes are transcribed on your phone where the device supports it.
8. Email and calendar connections
Mailbox and calendar content from a connected Google or Microsoft account is private to the user who connected it. We process it only to provide features to that user — such as showing the inbox, linking emails to contacts and deals, and drafting replies. It is not visible to administrators or colleagues unless the user chooses to share a specific item, it is never used for advertising, never sold, and never read by our staff except with the user's permission, for security purposes, or where the law requires.
Zaps's use and transfer to any other app of information received from Google APIs will adhere to the Google API Services User Data Policy, including the Limited Use requirements. Data received from Microsoft APIs is used in accordance with the Microsoft APIs Terms of Use.
A user can disconnect at any time. We then stop syncing and delete the synced mailbox and calendar content within 30 days, except items the user has chosen to log to a record in the workspace.
10. International transfers
Some of our sub-processors process personal data outside the Kingdom of Saudi Arabia and the United Arab Emirates, for example in the European Union or the United States. We transfer personal data only where the conditions of the applicable law are met — for example to a country with an adequate level of protection, or with appropriate safeguards such as standard contractual clauses or binding contractual commitments, together with a transfer risk assessment where the law requires one — and we transfer only the minimum data needed for the purpose.
Customers with specific data-residency requirements can contact us at privacy@heyzaps.com to discuss the options available.
11. How long we keep personal data
- Account data: for as long as the account exists, and then as described below for the workspace.
- Customer content: for the duration of the subscription. After it ends, administrators can export it for 30 days; it is then deleted from our live systems and removed from backups within a further 90 days.
- Billing records and tax invoices: for as long as tax and commercial record-keeping laws require.
- Security and audit logs: up to 12 months, unless needed longer to investigate an incident.
- Website server logs: up to 90 days.
- Location records: according to the retention period the customer sets, and no longer than the subscription.
When personal data is no longer needed, we delete or anonymise it securely.
12. Your rights
Subject to the conditions of the applicable law, you have the right to:
- be informed about how your personal data is processed;
- access your personal data and obtain a copy of it in a readable, commonly used format (portability);
- have inaccurate or incomplete data corrected;
- have your data deleted when it is no longer needed or was processed unlawfully;
- withdraw your consent at any time, without affecting processing carried out before withdrawal;
- object to processing, including for direct marketing, and ask us to restrict processing in the cases the law provides;
- not be subject to decisions based solely on automated processing that significantly affect you.
You can exercise these rights by emailing privacy@heyzaps.com or, if you use Zaps, from the Privacy Centre in the app, where you can download your data, review and withdraw consents (including location consent), and request deletion. We will verify your identity and reply within 30 days; where the law allows, we may extend this period and will tell you why.
If your request concerns data that a customer controls (see section 2), we will refer it to that customer. If you are not satisfied with our response, you may complain to the Saudi Data and Artificial Intelligence Authority (SDAIA) in the Kingdom of Saudi Arabia or the UAE Data Office in the United Arab Emirates.
13. How we protect personal data
- Encryption in transit (TLS) and at rest.
- Row-level isolation in the database, so each customer's data is separated from every other customer's.
- Multi-factor authentication for administrators, and secure one-way hashing of passwords.
- Role-based access within each workspace, and least-privilege access for our own staff, who are bound by confidentiality.
- Audit logs of significant actions, monitoring, regular backups and vulnerability management.
14. Personal data breaches
If a personal data breach occurs, we act promptly to contain it and reduce its effects. Where required by law, we notify the Saudi Data and Artificial Intelligence Authority within 72 hours of becoming aware of the breach, and the UAE Data Office as UAE law requires. We notify affected customers without undue delay, and affected individuals where the law requires.
16. Children
Zaps is a business service and is not directed at anyone under 18. We do not knowingly collect personal data from children; if we learn that we have, we will delete it.
17. Changes to this Policy
We may update this Policy from time to time. The version and date at the top of this page show when it last changed. We will notify customers' administrators of material changes by email or in the Service before they take effect.
18. Contact us
For any question or request about privacy, contact us at privacy@heyzaps.com. Our company details are listed in section 1 and on our contact page.