Privacy Policy

1. Data Controller

The controller responsible for personal information processed directly by the Service is:

• Operator: ZipFlow
• Website: https://zipflow.site/
• Privacy contact: support@zipflow.site
• Data Protection Officer: not formally appointed; privacy requests are handled by the service operator.

2. Personal Information We Collect

2.1 Information you provide

• Account information: display name, email address, and an irreversible password hash. We never store your plain-text password.
• Google sign-in information: verified email address, display name, and Google account identifier when you choose Google sign-in. The identity token is used to verify the sign-in request, not stored as your password.
• Content and files: media, documents, subtitles, public-file URLs, processing options, and generated results submitted for the operation you request.
• Billing information: selected plan, billing interval, transaction or order identifier, payment status, subscription status, credit balance, and renewal period. Full payment-card details are handled by Waffo Pancake and never reach ZipFlow servers.
• Communications: support, billing, refund, privacy, or security correspondence you send to us.

2.2 Information collected automatically

• Device and network information: IP address, browser type, operating system, language, time zone, and basic device characteristics.
• Service activity: pages and tools used, timestamps, job status, selected formats, credit activity, and authentication or subscription events.
• Technical logs: request metadata, errors, rate-limit events, performance information, and security signals.
• Preference data: language and light/dark theme choices stored in your browser.
• Optional analytics, only with your consent: Google Analytics receives a pseudonymous browser identifier, page views, basic device/language and approximate region information, approved campaign labels, and events for sign-in, registration, tool processing, and starting checkout. We do not send email addresses, names, account IDs, file names, uploaded content, source-file URLs, raw error text, payment tokens, or card details to Analytics. Opening checkout is not recorded as a completed payment.

We do not request precise location, government identifiers, biometric data, or special-category personal data. Do not upload such data unless it is necessary, lawful, and you have authority to process it.

3. How We Use Information and Our Legal Bases

Where practical, we aggregate or de-identify information for statistics and service planning. We do not attempt to re-identify such information.

4. Cookies and Similar Technologies

The Google Analytics tag is not loaded until you opt in. Rejecting analytics leaves all tools available. You can withdraw at any time using “Privacy settings”; we stop future Analytics collection and remove its accessible first-party cookies. Withdrawal does not retroactively erase data already collected. Global Privacy Control or Do Not Track signals disable Analytics. Advertising storage, ad personalization, and Google signals are disabled. We do not send events that occurred before consent.

5. Sharing and Disclosure

We do not sell personal information, including a "sale" or "sharing" for cross-context behavioral advertising under applicable US state privacy laws. We disclose only what is necessary to:

• Waffo Pancake: hosted checkout, payment processing, taxes, subscription lifecycle, transaction notices, and eligible refunds. ZipFlow provides the account identifier and email required for checkout. Waffo Pancake processes card details under its own privacy and security terms.
• Google: identity verification when you choose Google sign-in; separately, optional website measurement through Google Analytics only if you opt in. Google sign-in does not require Analytics consent. See Google's Privacy Policy and how Google uses information from partner sites.
• MyMemory / Translated: extracted text may be submitted for translation when that provider is configured and you request translation. Do not submit confidential text to translation features unless you accept that transfer. See Translated's Privacy Policy.
• Infrastructure providers: hosting, network, security, and storage vendors process limited data under contractual confidentiality and security obligations.
• Authorities and professional advisers: where required by law, court order, valid government request, or to establish, exercise, or defend legal claims.
• Business transaction: in a merger, financing, restructuring, or sale, subject to continued protection and appropriate notice.
• With your consent: for another clearly disclosed purpose after receiving your permission.

Uploaded media is not sent to Waffo Pancake or Google sign-in. Text is sent to an external translation provider only when you request a feature that requires it.

6. Security Measures

• TLS/HTTPS encryption for supported production traffic.
• One-way password hashing and HTTP-only authentication cookies.
• Random job identifiers, upload limits, rate limits, and controlled processing queues.
• Restricted server-side data files and separation of payment-card processing from ZipFlow systems.
• Automatic source-file removal after processing and output-file removal within 24 hours.

No system is completely secure. If a breach is likely to risk your rights, we will notify affected users and the competent authority without undue delay and, where legally required, within 72 hours after becoming aware of it. You are responsible for protecting your password and devices.

Optional Google Analytics user-level and event-level data are configured for a two-month retention period, without resetting it on new activity. This setting does not limit Google's aggregated standard reports. Browser consent preferences and Analytics cookies have the separate lifetimes described above.

7. Retention Periods

Backups may retain deleted records for up to 90 additional days before rotation, with access restricted to recovery and security purposes.

8. Your Privacy Rights

Depending on where you live, you may have rights to know, access, correct, delete, restrict, or object to processing; receive portable data; withdraw consent; opt out of sale or targeted advertising; and appeal a decision. We do not discriminate against users for exercising a privacy right.

Email support@zipflow.site from your registered address and identify the request. We may ask for proportionate verification. We aim to respond within 30 calendar days, or sooner where local law requires. Authorized agents may submit requests where permitted. You may complain to your local data-protection or consumer-protection authority if you believe a request was mishandled.

9. Marketing Communications

ZipFlow does not currently send third-party advertising or non-consensual marketing messages. If optional product marketing is introduced, it will require any consent mandated by law and will include a working unsubscribe link or account control. Opting out of marketing will not stop essential security, account, transaction, or policy notices.

10. International Data Transfers

ZipFlow's current primary processing infrastructure is located in Hong Kong. Waffo Pancake, Google, translation providers, and infrastructure partners may process information in the United States and other jurisdictions. Those locations may have different data-protection laws.

Where required, international transfers rely on an adequacy decision, Standard Contractual Clauses, another approved transfer mechanism, and contractual security and confidentiality protections. We limit transferred data to what the relevant service needs.

11. Children's Privacy

The Service is intended only for people aged 18 or older. We do not knowingly collect personal information from children. If you believe a child has supplied information, contact support@zipflow.site; after appropriate verification, we will remove it promptly.

12. Third-Party Links and Services

The Service may link to or integrate third-party services. This Policy covers information controlled directly by ZipFlow. A third party's own privacy policy governs its independent processing, so review that policy before using the integration.

13. Changes to This Policy

We may update this Policy to reflect product, vendor, legal, or security changes. For a material change, we will provide at least 15 days' advance notice through a prominent Service notice or the registered email address, unless urgent legal or security circumstances require a shorter period. The version and dates at the top will be updated, and previous versions will be retained where reasonably practicable.

14. Contact Us

Data controller: ZipFlow
Privacy, rights, and security requests: support@zipflow.site
Website: https://zipflow.site/
Support hours: Monday–Friday, 09:00–18:00 UTC+8