Privacy Policy

Ziphy is operated by Cassius-Lee Smith, a sole trader trading as Ziphy, from 84 Gibson Drive, CV21 4LL, United Kingdom. For privacy questions or requests, email support@ziphy.io.

Ziphy is a controller for personal data used to create and administer merchant accounts, provide support, bill for Ziphy, protect the service and meet our own legal obligations. This includes deciding why and how that data is processed.

A merchant normally decides why and how its end-customer data is used. When Ziphy handles that data to provide cancellation prevention, payment recovery and reporting on the merchant's instructions, the merchant is the controller and Ziphy is its processor. The Data Processing Addendum covers that processing.

A provider such as Stripe may separately act as a controller for fraud prevention, regulatory compliance or its own service administration. Its privacy terms apply to those purposes.

Merchant account and administration data

• Account email, authentication records, user identifier and security events.
• Business name, configuration, retention rules and authorised offers.
• Ziphy plan, trial and subscription status, and Stripe billing references. Stripe handles payment-card details; Ziphy does not store full card numbers.
• Connected Stripe account identifier, connection status and whether the connection is in test or live mode.
• Support messages and technical information such as request, security and operational logs.

Merchant end-customer data

• Privacy-safe customer references and Stripe customer, subscription and invoice identifiers.
• Subscription state, price, currency, billing interval, renewal timing, country where available and payment-failure information.
• Cancellation reasons, session events, offers shown and accepted or rejected, execution results, recovery state and subsequent retention or cancellation outcomes.
• Customer email when needed to show it to the authorised merchant or send a recovery message. Customer-list email is fetched from Stripe for visible customers, cached briefly in the application process, and is not written to the Ziphy database.

Ziphy does not currently collect merchant product-usage or engagement tracking through the product and does not present customer health, churn probability or Revenue at Risk scores to merchants.

• To create, authenticate and secure accounts and provide the service requested under our contract.
• To administer trials, subscriptions, billing and support.
• To connect authorised Stripe accounts and carry out merchant-approved cancellation and recovery workflows.
• To maintain factual operational and revenue reporting.
• To diagnose faults, prevent abuse, enforce access controls and protect Ziphy and its users.
• To comply with tax, accounting, data-protection and other legal obligations.

Where Ziphy is controller, we rely on performing our contract, our legitimate interests in operating and securing a business service, compliance with law, and consent only where a specific activity legally requires it. Where Ziphy is processor, the merchant determines the lawful basis.

Ziphy uses Supabase for authentication and database services, Vercel for application hosting and runtime, Resend for transactional and recovery email, and Stripe for Ziphy billing, Stripe Connect and merchant subscription/payment operations. Their exact roles and broad processing locations are set out on our Subprocessors page.

We may also disclose data where required by law, to protect legal rights or service security, or as part of a business transfer subject to appropriate confidentiality and data-protection measures. We do not sell personal data or use merchant end-customer data for advertising.

The primary Supabase database and authentication region used for Ziphy is West EU (Ireland). Some providers and their support or infrastructure partners may process data in the United States, Singapore or other countries. Where UK personal data is transferred to a country without UK adequacy regulations, we rely on an applicable safeguard such as the UK International Data Transfer Agreement, the UK Addendum to approved standard contractual clauses, or another lawful transfer mechanism, together with appropriate technical and organisational measures.

Ziphy currently uses only storage needed to provide and secure the service: Supabase authentication/session cookies, short-lived signup cookies, a trial-intent cookie, and a short-lived Stripe Connect state cookie. They support login, secure signup, checkout intent and protection of the Stripe connection flow.

Ziphy does not currently use advertising cookies, behavioural advertising pixels or product-analytics trackers, and does not store application data in localStorage or sessionStorage. We therefore do not show a consent banner for Ziphy's own strictly necessary storage. Stripe may use necessary payment and fraud- prevention storage on Stripe-hosted checkout or payment pages under Stripe's own notice.

Ziphy uses HTTPS/TLS, Supabase authentication, server-side secrets, row-level security and restricted database privileges, merchant/account/mode binding, signed-webhook verification, durable execution claims, idempotency controls and a server-side Stripe mutation switch. Access and operational logs are designed to avoid customer email, secrets and raw capability tokens. Provider backups support recovery from faults.

No online service can guarantee absolute security. These are current safeguards, not a claim that Ziphy holds a particular security certification.

We keep account and merchant end-customer data while the account is active and as needed to provide the service. We may keep restricted billing, tax, fraud, security and dispute records for the period required by law or reasonably needed for those purposes. As a sole trader, the operator must generally keep relevant business records for at least five years after the applicable Self Assessment filing deadline.

Email support@ziphy.io from the account email to request account closure, correction, deletion or a portable export. We verify identity and authority before acting. After a verified deletion request, we aim to remove active operational data within 30 calendar days and will explain any data that must be retained. Deleted data may remain beyond use in encrypted provider backups until the provider's normal backup cycle removes it.

Ziphy cannot delete records that belong to a merchant's separate Stripe account. The merchant must manage those in Stripe, subject to Stripe's rules. End customers should normally ask the relevant merchant, who can instruct Ziphy to search, export, correct or delete the data Ziphy processes for that merchant.

Depending on the circumstances, UK data-protection law may give you rights to access, correct or erase personal data, restrict or object to processing, receive portable data, and complain about its use. Some rights have legal exceptions. We normally respond to a valid request within one month after verification.

You can complain to the Information Commissioner's Office. We would appreciate the chance to address your concern first.

Ziphy is a business service and is not offered to children.

We may update this policy as the service or law changes. We will update the date above and give reasonable notice of a material change where appropriate.

Contact Cassius-Lee Smith trading as Ziphy at support@ziphy.io, or by post at 84 Gibson Drive, CV21 4LL, United Kingdom.