Last updated: July 19, 2026.
Privacy Policy
This Privacy Policy explains how Zaphia AI ("Zaphia AI", "we", "us", or "our") collects, uses, and protects your personal information when you visit zaphia.ai (the "Site") or buy our digital products. It is written to a global standard, covering the EU General Data Protection Regulation (GDPR), the UK GDPR, and the California Consumer Privacy Act as amended by the California Privacy Rights Act (CCPA/CPRA).
Who we are (data controller):
- Trading name: Zaphia AI
- Legal entity: Zaphia LLC
- Business address: 14540 Victory Blvd Suite 214, Van Nuys, CA 91411
- Contact: hello@zaphia.ai
1. What personal data we collect
We collect only what we need to run the Site, deliver our products, and communicate with you.
- Email address and marketing data. When you sign up for our free sampler or newsletter, we collect your email address and your consent status. This is handled through our email provider, MailerLite.
- Order and purchase information. When you buy a product, checkout and payment are handled by Lemon Squeezy, which acts as the Merchant of Record (see Section 4). We receive limited order details such as your name, email, the product purchased, order number, and country, so we can provide support and keep records. We do not collect or store your full card or payment details. Those are handled directly by Lemon Squeezy and its payment partners.
- Support communications. If you email us, we keep your message and contact details so we can respond and maintain a record.
- Analytics and device data. We collect basic usage data such as pages visited, referring site, approximate location, browser type, and device information. Privacy-friendly analytics (Vercel Analytics) do not use cookies. Other tools (Google Analytics 4, Meta Pixel, Google Ads) may set cookies or similar identifiers and load only after you give consent (see Section 6).
2. Where the data comes from
We collect data directly from you (for example, when you sign up or contact us) and automatically through your device when you use the Site (for example, analytics and, with consent, advertising tools). We also receive limited order data from Lemon Squeezy when you complete a purchase.
3. Why we use your data and our legal bases (GDPR / UK GDPR)
Under the GDPR and UK GDPR, we must have a lawful basis for each use of your personal data.
| What we do | Why | Legal basis (GDPR Art. 6) |
|---|---|---|
| Deliver the product you bought and provide support | To perform our agreement with you | Contract (Art. 6(1)(b)) |
| Send you the free sampler and newsletter | You asked to receive them | Consent (Art. 6(1)(a)) |
| Keep order and tax records | To meet legal and accounting obligations | Legal obligation (Art. 6(1)(c)) |
| Run privacy-friendly analytics and keep the Site secure | To operate and improve the Site | Legitimate interests (Art. 6(1)(f)) |
| Load advertising and retargeting tools (Meta Pixel, Google Ads, GA4) | To measure and promote our products | Consent (Art. 6(1)(a)) |
You can withdraw consent at any time (see Section 9). Withdrawing consent does not affect processing that already happened.
4. Payments and Merchant of Record
Purchases are processed by Lemon Squeezy, which acts as the Merchant of Record. This means Lemon Squeezy is the seller of record for your transaction: it processes your payment, handles sales tax and VAT, and applies its own buyer terms and refund handling. Your payment is subject to Lemon Squeezy's privacy policy and terms in addition to ours. We receive only limited order information from them, as described in Section 1. Please review Lemon Squeezy's own privacy policy for how it handles your payment data.
5. Service providers and sub-processors
We use trusted third parties ("processors") to run our business. Each processes personal data on our behalf or as an independent controller for their own defined purposes.
| Provider | Purpose | Notes |
|---|---|---|
| Lemon Squeezy | Checkout, payments, Merchant of Record, tax handling | Seller of record; see Section 4 |
| MailerLite | Email sign-up, newsletter, sampler delivery | Double opt-in used |
| Vercel (including Vercel Analytics) | Website hosting and privacy-friendly analytics | Cookieless analytics |
| Google Tag Manager | Loads and governs our other tags, subject to your consent choices | Loads on all pages; sets no advertising or analytics cookies itself |
| CookieScript | Consent management platform: shows the consent banner, records your choices, and blocks non-essential cookies until you consent | Essential to operating the consent banner |
| Meta (Facebook/Instagram) Pixel | Advertising and retargeting | Loads only after consent |
| Google (Google Ads, Google Analytics 4) | Advertising, retargeting, and analytics | Loads only after consent |
This list may change as our business evolves. We will keep it current here.
International transfers
Some of these providers are located in, or transfer data to, the United States and other countries outside the EEA and the UK. Where we or our providers transfer personal data internationally, we rely on appropriate safeguards such as the European Commission's Standard Contractual Clauses, the UK International Data Transfer Addendum, and, where applicable, the EU-U.S. Data Privacy Framework. You can contact us at hello@zaphia.ai for more information about these safeguards.
6. Cookies and tracking
Cookies and similar technologies fall into three groups:
- Essential. Needed for the Site to work (for example, security and remembering your cookie choices). These do not require consent.
- Analytics. Help us understand how the Site is used. Vercel Analytics is privacy-friendly and cookieless. Google Analytics 4, if enabled, sets cookies and loads only after you consent.
- Advertising. Meta Pixel and Google Ads support retargeting and measurement. These load only after you give consent.
When you first visit, our consent banner lets you accept or reject non-essential cookies, and choose categories where offered. Non-essential (analytics and advertising) tools are blocked until you consent. We use a consent management platform, CookieScript, together with Google Tag Manager and Google Consent Mode, so that advertising and analytics tags cannot store cookies or identifiers on your device until you have given permission. You can change or withdraw your choice at any time using the Cookie preferences link in the Site footer.
7. How long we keep your data (retention)
We keep personal data only as long as needed:
- Newsletter/sampler data: until you unsubscribe or withdraw consent, after which we remove or suppress it.
- Order records: for as long as required for tax, accounting, and legal purposes (typically up to 7 years, per California, USA requirements). Lemon Squeezy retains transaction data under its own policy.
- Support emails: typically up to 24 months after the matter is resolved.
- Analytics data: retained per each provider's default settings, then deleted or anonymized.
8. How we protect your data
We use reasonable technical and organizational measures to protect your data, and we work with reputable providers that maintain their own security practices. No method of transmission or storage is completely secure, so we cannot guarantee absolute security.
9. Your privacy rights (GDPR / UK GDPR)
If you are in the EEA or the UK, you have the right to:
- Access the personal data we hold about you.
- Rectify inaccurate or incomplete data.
- Erase your data ("right to be forgotten").
- Restrict or object to certain processing, including direct marketing.
- Data portability (receive your data in a portable format).
- Withdraw consent at any time, without affecting prior processing.
- Complain to a supervisory authority. In the UK this is the Information Commissioner's Office (ICO, ico.org.uk). In the EU it is your local data protection authority.
To exercise any right, email hello@zaphia.ai. We will respond within the timeframes required by law (generally one month under GDPR/UK GDPR).
10. Your privacy rights (California, CCPA/CPRA)
If you are a California resident, you have the right to:
- Know what personal information we collect, use, and disclose.
- Delete the personal information we hold about you, subject to legal exceptions.
- Correct inaccurate personal information.
- Opt out of the sale or sharing of your personal information (see Section 11).
- Limit the use of sensitive personal information (we do not use sensitive personal information for purposes requiring a limit right).
- Non-discrimination for exercising your rights. We will not deny service, charge different prices, or provide a different quality of service because you exercised your rights.
To exercise these rights, email hello@zaphia.ai. You may use an authorized agent, and we may need to verify your identity before acting.
11. Do Not Sell or Share My Personal Information
Zaphia AI does not sell your personal information for money. However, when advertising cookies (such as Meta Pixel or Google Ads) are active, this activity may be considered "sharing" or a "sale" of personal information for cross-context behavioral advertising under the CCPA/CPRA.
You can opt out in two ways:
- Reject non-essential cookies on our consent banner, or open Cookie preferences from the Site footer and turn off advertising cookies.
- Use the "Do Not Sell or Share My Personal Information" link in our Site footer.
We also honor recognized opt-out preference signals, such as Global Privacy Control (GPC), where technically feasible. Opting out does not require an account.
12. Children's privacy
The Site and our products are not directed to children under 16, and we do not knowingly collect personal data from children under 16. If you believe a child has provided us personal data, contact hello@zaphia.ai and we will delete it.
13. Changes to this policy
We may update this Privacy Policy from time to time. We will post the new version here and update the "Last updated" date at the top. Material changes may be communicated by email or a Site notice.
14. Contact us
Questions or requests? Email us at hello@zaphia.ai, or write to Zaphia LLC, 14540 Victory Blvd Suite 214, Van Nuys, CA 91411.