Privacy Policy
Last updated 7 October 2026
The short version
- We collect what we need to run Zeppo: your account, your business profile, and the quotes and follow-ups you add.
- Quotes are analysed by AI. Our AI provider doesn’t use this data to train its models.
- We don’t sell your data, show ads or use tracking cookies.
- Our database is in the EU (Ireland). Some of our providers, including our AI provider, process data in the US under approved safeguards.
- You can see, correct or delete your data at any time. Just email support@zeppo.app.
1. Who we are
This policy explains how Zeppo, based in Norway (“Zeppo”, “we”, “us”), handles personal data when you visit zeppo.app, create an account or use the Zeppo app.
Questions about privacy? Email support@zeppo.app.
2. Your data and your customers’ data
We handle personal data in two different roles:
- About you, our user, such as your account, business profile, billing and how you use Zeppo. Here we are the controller, and this policy explains what we do.
- About your customers, such as the names, email addresses and job details in the quotes and follow-ups you add. Here your business is the controller and decides how the data is used. We are your processor and handle it on your behalf under the data processing agreement in our Terms. This policy also explains how we look after that data.
Got a follow-up from a business that uses Zeppo? See If you received an email sent with Zeppo.
3. What we collect
- Account: your name, email address and password, which is stored only as a secure hash. If you sign in with Google, Google shares your name, email address and profile picture with us; we never see your Google password. We also record when you accepted our Terms.
- Business profile: your business name, type, country, language, tone and style preferences, description, website, sender name, reply-to email address and reminder settings.
- Quotes and follow-ups: the quote files and text you add; your customers’ names and email addresses; each quote’s title, value, currency, date and status; the AI analysis; follow-up drafts, your edits and your feedback on them; and a record of each email sent (recipient, subject, content, time and delivery status).
- Billing: your plan, subscription status and renewal date, and your PayPal subscription and payer IDs. PayPal handles the payment itself; we never see or store your card or bank details.
- Invites: if you sign up through another business’s invite link, we record which business invited you and whether you have started paying, so we can give both of you the free week. The business that invited you sees only how many businesses joined and pay, not who you are; we tell them by email when one of their invited businesses starts paying.
- Usage: events such as signing up, adding a quote, generating or sending a follow-up, or changing a quote’s status, with basic details like the quote’s language but not its content; and when you last used the app.
- Technical data: IP address, browser and device information in the security and server logs kept by our hosting and sign-in providers. To show our website in Norwegian or English, we look at the country your IP address belongs to and your browser’s language setting when you visit. We don’t store this.
- Website statistics: anonymous, aggregated visitor numbers for our website, collected without cookies.
- Messages to us: what you write when you contact us, for example for support.
4. How we use it and why
| Purpose | Legal basis (GDPR) |
|---|---|
| Providing the Service: running your account, storing and analysing quotes, drafting and sending follow-ups, and sending reminders | Our contract with you (art. 6(1)(b)) |
| Billing and managing your subscription | Our contract with you (art. 6(1)(b)), and our legal duty to keep accounting records (art. 6(1)(c)) |
| Running the invite offer: recording who invited whom and giving each side its free week | Our contract with you, which includes the invite offer (art. 6(1)(b)) |
| Essential emails, such as confirming your email address, resetting your password and notices about the Service | Our contract with you (art. 6(1)(b)) |
| Keeping Zeppo secure and preventing abuse, including misuse of email sending | Our legitimate interest in a safe, reliable service (art. 6(1)(f)) |
| Understanding how Zeppo is used, so we can improve it | Our legitimate interest in developing the product (art. 6(1)(f)) |
| Answering your messages and giving support | Our contract with you, or our legitimate interest in helping you |
| Complying with the law and handling legal claims | Legal obligation or legitimate interest (art. 6(1)(c) and (f)) |
Now and then we may also email you about important updates to Zeppo. You can opt out of these at any time by replying to one of them.
We don’t use your data for advertising, we don’t sell it, and we don’t make decisions about you based solely on automated processing.
5. How we use AI
When you add a quote, we send its content (the PDF or text) to our AI provider so it can analyse it. When you ask for a follow-up, we send the analysis, the relevant quote details and your business profile so it can write a draft.
Our AI provider processes this data for us as a sub-processor. Under its commercial terms, it does not use this data to train its models, and neither do we.
The AI doesn’t make decisions about anyone. Every analysis and draft is shown to you, and nothing is sent until you click Send.
7. Transfers outside the EEA
Our database and files are stored in the EU. Some providers, including Vercel, our AI provider and Resend, are based in the US and may process personal data there. Whenever personal data is transferred outside the EEA, we make sure an approved safeguard is in place, such as the EU–US Data Privacy Framework for certified providers or the EU Standard Contractual Clauses. Contact us if you’d like to know more.
8. How long we keep data
- While your account is open, we keep your account, business profile, quotes and follow-ups so the Service works. When you delete a quote, its file, analysis, follow-ups and email records are deleted straight away.
- When you delete your account, we delete your data within 30 days. Copies in backups disappear as the backups are replaced.
- Billing records are kept for as long as accounting law requires, currently up to five years in Norway.
- Logs kept by our hosting and sign-in providers are deleted after a short period.
- Messages to us are kept for as long as we need them to help you.
9. Security
- All connections to Zeppo are encrypted (HTTPS), and our database provider encrypts stored data.
- Each business’s data is kept separate in the database with row-level security, so one business can never see another’s quotes, customers or emails.
- Quote files are stored privately and are only accessible to the business that added them.
- Passwords are stored as secure hashes, and our keys and secrets never reach your browser.
No system is completely secure, but we take protecting your data seriously. If a data breach affects you, we’ll tell you and the authorities as the law requires.
11. Your rights
You have the right to:
- get a copy of the personal data we hold about you;
- have incorrect data corrected;
- have your data deleted;
- restrict how we use your data, or object where we rely on our legitimate interests;
- receive your data in a machine-readable format.
You can do much of this yourself in the app: edit your business profile, edit or delete quotes, and turn off reminders. For anything else, email support@zeppo.app. We’ll reply within one month.
If you’re unhappy with how we handle your data, you can complain to the Norwegian Data Protection Authority (Datatilsynet) or to the data protection authority where you live or work. We’d appreciate the chance to sort it out with you first.
12. If you received an email sent with Zeppo
Businesses use Zeppo to follow up on quotes they’ve sent. If you received a follow-up sent with Zeppo, the business that sent it is responsible for your personal data (it is the controller). The easiest way to reach them is to reply to the email; replies go straight to the business.
If you don’t want to be contacted again, tell the business. You can also contact us at support@zeppo.app, and we’ll pass your request on and help the business respond.
13. Children
Zeppo is a business tool and isn’t meant for anyone under 18. We don’t knowingly collect data from children.
14. Changes to this policy
We’ll update this policy when our practices change, and the date at the top shows when it last changed. If we make a significant change, we’ll email you before it takes effect.