Privacy Policy — ZapMailer Pro

1 Data We Collect

We collect the following categories of personal data when you use ZapMailer Pro:

Account data: your name, email address, and company name
Payment data: billing information processed via Stripe (we do not store card numbers — see Section 5)
Resend API key: your Resend API key, stored AES-256 encrypted (see Section 4)
Usage data: pages visited, features used, actions taken within the platform, browser type, IP address, and approximate location
Subscriber data: the email addresses and profile data of your subscribers that you upload or collect via ZapMailer Pro forms
Support interactions: messages you send to ZapBot or our support team

2 How We Use Your Data

We use the data we collect to:

Deliver the Service: operate your account, send transactional emails about your account, and execute email sequences via Resend delivery infrastructure
Billing: process subscription payments and manage your plan via Stripe
Support: respond to support requests and operate the ZapBot assistant
Product improvements: analyse aggregated usage patterns to improve features and performance (never individual profiling for advertising)
Legal compliance: comply with applicable laws, regulations, and lawful requests from authorities

We do not use your data or your subscribers' data for advertising or sell it to third parties.

3 Data Storage

All ZapMailer Pro application data — including your account details and subscriber records — is stored on Hetzner Cloud servers located in Helsinki, Finland (EU).

Data is encrypted at rest. Connections to our servers are encrypted in transit using TLS. Hetzner is ISO 27001 certified and compliant with GDPR data processing requirements.

As a UK-based business, we comply with both UK GDPR (as retained by the UK Data Protection Act 2018) and EU GDPR for our EU-based customers. Storing data in Finland (EU) ensures compliant data transfer for EU customers.

4 Resend API Key

ZapMailer Pro uses Resend (resend.com) as its email delivery infrastructure. Your Resend API key is stored encrypted using AES-256 encryption at rest in our database.

Your API key is used solely and exclusively to send emails on your instruction via Resend's delivery infrastructure. It is never shared with any third party or used without your explicit instruction to send emails.

You may revoke or rotate your Resend API key at any time via the Settings page. We recommend using a domain-scoped API key with the minimum required sending permissions.

5 Third-Party Services

ZapMailer Pro uses the following third-party services as part of its operation:

Stripe Payment processing and subscription billing. Stripe stores your card details securely. ZapMailer Pro never stores card numbers. See Stripe's Privacy Policy.
Firebase Authentication services (Google Firebase Auth). Used to manage secure sign-in. See Google Firebase Privacy.
Anthropic The AI Builder and ZapBot features are powered by the Anthropic Claude API. Prompts you send may be processed by Anthropic. Do not submit PII of third parties. See Anthropic's Privacy Policy.
Resend Email delivery infrastructure (resend.com). Resend processes email sending data on our behalf under a GDPR-compliant data processing agreement. See Resend's Privacy Policy.
Hetzner Cloud hosting and infrastructure in Helsinki, Finland (EU). Acts as a data processor under a GDPR-compliant data processing agreement.

We only share data with these parties to the extent necessary for them to provide their services to us.

6 Your Rights Under GDPR

Under the UK GDPR and EU GDPR, you have the following rights regarding your personal data. To exercise any right, contact us at privacy@zapmailerpro.com.

Right of Access Request a copy of all personal data we hold about you.

Right to Rectification Ask us to correct inaccurate or incomplete data.

Right to Erasure Request deletion of your personal data ("right to be forgotten").

Right to Portability Receive your data in a structured, machine-readable format.

Right to Object Object to processing based on legitimate interests.

Right to Restrict Request restriction of processing in certain circumstances.

You also have the right to lodge a complaint with the Information Commissioner's Office (ICO) at ico.org.uk if you believe your data has been processed unlawfully.

7 Cookies

ZapMailer Pro uses session cookies only — small files placed on your device solely to maintain your authenticated session and remember your preferences within the app.

We do not use tracking cookies, advertising cookies, or any third-party analytics cookies that profile your behaviour across other websites. No cookie consent banner is displayed because we only use strictly necessary session cookies.

8 Data Retention

We retain your account data for as long as your account is active, and for a period of up to 90 days after account closure for backup and legal compliance purposes.

Upon written request to privacy@zapmailerpro.com, your account data will be permanently deleted within 30 days of your account closure.

Subscriber data you have imported or collected belongs to you. Upon account deletion it will be removed from our systems within the same 30-day window unless a legal hold applies.

9 Contact Us

For any privacy-related questions, requests to exercise your data rights, or concerns about this policy, please contact:

Data Controller: Bhupinder Sahota, ZapMailer Pro
Email: privacy@zapmailerpro.com
Jurisdiction: England and Wales, United Kingdom

We aim to respond to all privacy requests within 30 days.