Privacy Policy

1. Introduction

ZazSync (zazsync.com) is an independent workflow automation software platform owned and operated by Shamsul Hoque as a sole proprietorship (“ZazSync,” “we,” “us,” or “our”). This Privacy Policy explains how we collect, use, store, and protect your information when you visit our website, utilize our workflow automation software, or request integration services.

2. Information We Collect

We collect only the information necessary to provide and operate our services:

A. Information You Provide Directly

• Contact Information: Your name, business email address, company name, and communication preferences when you submit an automation request or register an account.
• Workflow Requirements: Information regarding the third-party apps you wish to connect, trigger parameters, and automation descriptions.
• Billing & Payment Data (Paddle.com): When you purchase a subscription or digital service, payment processing and billing operations are conducted directly by our Merchant of Record and online reseller, Paddle.com Market Limited (and its affiliates). ZazSync never collects, sees, or stores your raw credit card numbers or payment credentials. Paddle processes billing data in accordance with its own privacy policies (Paddle Privacy Policy).

B. Integration & Execution Data

• Connection Credentials: OAuth access tokens, refresh tokens, API keys, and webhook secrets used to authorize connections to services such as Google, Slack, Stripe, HubSpot, or Shopify. All stored secrets are encrypted at rest using AES-256-GCM envelope encryption.
• Workflow Step Payloads: Transient data transferred between your apps during workflow runs (e.g., spreadsheet rows, form submissions, notification text). Payloads are processed solely to complete workflow steps and are subject to automated retention limits.

C. Automatic Technical & Log Information

• Device & Telemetry Data: IP address, browser type, operating system, and request timestamps collected for cybersecurity, rate limiting, and performance monitoring.
• Workflow Execution Logs: Status timestamps, node run durations, and error diagnostics used to help you troubleshoot failed steps.

3. How We Use Your Information

We use the collected information strictly for legitimate business and operational purposes:

• To execute, route, and manage your automated workflows between connected apps.
• To evaluate technical feasibility when you submit an automation inquiry.
• To authenticate user sessions, manage subscriptions, and process billing invoices.
• To protect our infrastructure against DDoS attacks, brute-force intrusions, and platform abuse.
• To provide customer support and troubleshoot workflow run errors.
• To send critical system notifications, account security alerts, and service updates.

4. Data Encryption & Security Architecture

We implement industry-standard technical and organizational safeguards:

• Envelope Encryption at Rest: Connector credentials, tokens, and sensitive integration settings are encrypted at rest using AES-256-GCM keys managed in isolated vaults.
• Encryption in Transit: All HTTP traffic, API endpoints, webhooks, and dashboard communications are strictly encrypted using TLS 1.3 / HTTPS.
• Multi-Tenant Isolation: Workflows, projects, and credentials are partitioned by workspace with row-level security and tenant authentication boundaries.
• Zero Persistent Payload Retention: Transient step payloads are purged on a rolling schedule after execution completion or failure inspection windows.

5. How We Share Your Information

We do not sell, rent, or trade your personal information. We share data only in the following limited situations:

• Merchant of Record & Payment Processing (Paddle): We share order, checkout, and licensing details with Paddle.com Market Limited, which acts as our online reseller and Merchant of Record for customer orders, invoicing, tax collection, and customer returns.
• With Connected Third-Party Services: In accordance with the workflows you configure, we transmit data payloads to the third-party APIs you have explicitly authorized (e.g., sending an invoice notification to your Slack channel).
• Trusted Infrastructure Vendors: With vetted cloud hosting, database, and email infrastructure providers who operate under strict confidentiality and data protection agreements.
• Legal Compliance: If required by valid court orders, subpoenas, or applicable law to protect platform integrity or legal rights.

6. Your Privacy Rights (GDPR & CCPA/CPRA)

Depending on your location, you have rights regarding your personal information, including:

• Right of Access: You can request a copy of the personal information we hold about you.
• Right to Rectification: You can request correction of inaccurate account records.
• Right to Erasure (“Right to Be Forgotten”): You may request complete deletion of your account, connections, and workflow logs.
• Right to Restrict Processing: You can disconnect third-party integrations at any time via your dashboard, revoking all active API tokens.
• No Discrimination: We will never discriminate against you for exercising your legal privacy rights.

To exercise any of these rights, please contact our team at contact@zazsync.com.

7. Cookies and Tracking

ZazSync uses only essential session cookies and CSRF tokens necessary for secure authentication, navigation, and rate-limit tracking. We do not use third-party behavioral advertising cookies or cross-site data brokers.

8. Data Retention Policy

We retain account information for as long as your account remains active. If you close your account or request deletion, your credentials, project settings, and workflow definitions are permanently scrubbed from our active databases within thirty (30) days.

9. Changes to This Privacy Policy

We may update this policy as new connectors, security features, or legal standards evolve. We will notify you of material changes by posting the updated policy on our website with a revised effective date.