Privacy & Data Security

Privacy Policy

Last updated: 11 October 2026

This Privacy Policy describes how Zippl Labs LLP ("Zippl", "we", "us", or "our") collects, uses, and safeguards your business and personal information when you use the Zippl app on Android and Windows, the Zippl web app at app.zipplapp.com, and this website.

1. Information We Collect

  • Account Information: Name, mobile number, email address, and authentication credentials.
  • Shop Profile: Shop name, GSTIN, business address, logo, and UPI ID (for QR payment generation).
  • Store Data: Stock items, unit rates, HSN codes, customer and supplier ledgers, invoices, payments, and expense entries.
  • Payment Details: Subscription and billing upgrades are handled via Razorpay. Zippl does not store full credit or debit card numbers on our servers.

2. Local On-Device Security & App Lock

If you enable local App Lock via biometric fingerprint or PIN, all authentication is handled 100% locally on your device hardware. Zippl never accesses or transmits biometric data.

3. How We Use & Sync Data

Your records are stored primarily on your local device storage for ultra-fast offline access and replicated securely to cloud servers for multi-device sync and automated backup. Zippl also lets you send payment reminders, invoice receipts, and ledger statements to your customers over WhatsApp. These open directly in your own WhatsApp app and are sent from your device, not through Zippl's servers. When you sign in using a WhatsApp one-time code, that code is delivered via Meta's WhatsApp Business Platform. We also compile GSTR-1/2/3B tax reports and profit & loss summaries inside the app.

4. Data Ownership

You own 100% of your business data. We never sell, monetize, or share your financial records, customer phone numbers, or inventory prices with third-party advertisers.

5. When and With Whom We Share Information

We do not sell your personal or business data. We share information only with trusted infrastructure providers required to operate the Service:

  • Supabase Inc.: database hosting, authentication, edge functions, and file storage.
  • PowerSync (JourneyApps Inc.): offline-first, real-time SQLite sync engine.
  • Razorpay Software Pvt. Ltd.: subscription and plan billing.
  • Meta Platforms, Inc. (WhatsApp Business Platform): delivering one-time passcodes (OTP) for WhatsApp sign-in and verification.

6. Mobile & System Permissions

To enable core app capabilities, Zippl may request access to certain device features:

  • Camera: scanning barcodes/QR codes and capturing shop logo photos.
  • Contacts: optional, to import customer/supplier phone numbers into your party directory.
  • Bluetooth & Nearby Devices: discovering and printing bills on ESC/POS thermal receipt printers.
  • Microphone: optional, for voice-to-text search and hands-free item lookup.
  • Files & Storage: uploading shop logos and saving/exporting PDF invoices, spreadsheets, and GST reports.

7. How Long We Keep Your Information

We retain business data while your account remains active or as required by law (such as Indian GST record-keeping mandates). When you delete your account, your personal data (login credentials, profile, session data) and any shop data you solely own are removed from our production systems immediately; any residual copies held in backups or logs are purged within 30 days. If you are a member of a shared shop, the shop and its business records (invoices, payments, purchases) stay intact for your teammates. Only your personal link to that data is removed. See Account & Data Deletion for the full breakdown.

8. Your Data Protection Rights (DPDP Act, 2023)

Under India's Digital Personal Data Protection Act, 2023 and other applicable law, you have the right to access your personal data, request correction of inaccuracies, request erasure, and withdraw consent for non-essential communications at any time by contacting us below.

9. Account & Data Deletion

You can delete your account and data any time from inside the app (Settings → Danger Zone → Delete Account), or by emailing us. See Account & Data Deletion for exactly what gets deleted, how long it takes, and how shared shops are handled.

10. Cookies, Local Storage and Third-Party Requests

This website sets no cookies and runs no advertising or cross-site trackers. It stores a single value in your browser's local storage, zippl_theme, to remember whether you chose the light or dark theme. Clearing your browser data removes it.

We do measure traffic, using Cloudflare Web Analytics. It records page views, the page you arrived from, your country, and basic device, browser and page-speed information, so we can see which pages are useful and which are slow. It sets no cookie, does not fingerprint your device, and cannot follow you to other websites. We cannot identify you from it.

Three third parties serve files to your browser when you load a page here, and so receive your IP address and browser user-agent as part of that request: Google Fonts (fonts.googleapis.com, fonts.gstatic.com) for typefaces, Cloudflare cdnjs (cdnjs.cloudflare.com) for icons, and Cloudflare Web Analytics (static.cloudflareinsights.com, cloudflareinsights.com) for the measurement described above. Google and cdnjs are given no information about you by us. The site itself is hosted on Cloudflare Pages.

On the contact page only, two more are involved when you send an enquiry: Cloudflare Turnstile (challenges.cloudflare.com), which runs the "confirm you are human" check, and Resend (resend.com), which delivers the resulting email to us. Turnstile is a bot check, not a tracker: it sets no advertising cookie and does not profile you across sites.

The enquiry form on our contact page. When you submit it, what you typed (your name, business, email, phone if given, and your project description) is sent to an endpoint we run at enquiry.zipplapp.com, which checks the Turnstile result and then emails the enquiry to us. Nothing is stored in a database on this website; the enquiry lives in our mailbox, where we keep it for as long as we need it to answer you and for our own business records. We use it only to reply to you, and we do not add you to any mailing list or pass it to anyone else. If you would rather not use the form, the "Send on WhatsApp" button opens your own WhatsApp with the message prefilled instead, and you choose whether to send it.

11. Grievance Officer and Contact

For any privacy question, data-deletion request, or complaint about how we handle your information, contact our Grievance Officer:

  • Name: Piyush Sharma, Grievance Officer
  • Email: support@zipplapp.com
  • Post: Grievance Officer, Zippl Labs LLP, Plot No. S-1, Kacholiya Road, Chomu, Jaipur, Rajasthan 303702, India

We acknowledge every grievance within 72 hours and resolve it within 30 days of receipt, as required by the Digital Personal Data Protection Act, 2023 and the Information Technology (Intermediary Guidelines) Rules.

12. Governing Law

This Privacy Policy is governed by the laws of India. Any dispute arising from it is subject to the exclusive jurisdiction of the courts at Jaipur, Rajasthan.

13. Changes to This Policy

If we change how we handle your data in a way that materially affects you, we will update the date at the top of this page and notify you by email or inside the app before the change takes effect.

Back to Homepage