Privacy Policy

Ziptaa ("Ziptaa," "we," "us," or "our") provides an AI receptionist service that helps small businesses answer calls, book appointments, and manage customer communications. This Privacy Policy explains what information we collect, how we use it, and the choices you have — including specific information about text message (SMS) communications.

1. Information We Collect

When you interact with a business that uses Ziptaa — for example, by calling to book, reschedule, or cancel an appointment — we may collect:

• Your name and phone number
• Appointment details (date, time, service requested)
• Call recordings and transcripts, used to provide the service to the business you contacted
• Information you provide directly during the call, such as the reason for your visit

Calls may be recorded and transcribed to provide the service. The business you contact is responsible for giving any notice and getting any consent about call recording and AI that the law requires where it operates.

If you are a business owner using the Ziptaa dashboard, we also collect your account information, business details, and calendar data you connect to the service (such as Google Calendar).

2. SMS / Text Messaging

Text messages are sent by the AI receptionist on behalf of the business you contacted, using the phone number you provided during your call, after you verbally agree to receive a text confirmation.

3. How We Use Information

• To book, confirm, reschedule, or cancel appointments on behalf of the business you contacted
• To send appointment-related text message confirmations and updates
• To operate, maintain, and improve the Ziptaa platform
• To provide customer support to businesses using Ziptaa
• To process business subscriptions and payments
• To prevent fraud, abuse and unauthorized access, and to comply with applicable legal obligations

4. How We Share Information

We share information with the specific small business you contacted, so they can manage your appointment. We use third-party service providers to operate our platform, including:

• Twilio, for placing and receiving phone calls and text messages
• Vapi, for AI voice call handling. To run calls, Vapi uses OpenAI and Azure OpenAI (language models), Vapi's own voices and xAI (speech), and Deepgram and Soniox (transcription).
• Google Calendar, for appointment scheduling, when connected by the business
• Supabase, for secure data storage
• Resend, for email notifications
• Vercel, for hosting the Ziptaa app
• Stripe, for billing (business account holders only)

We do not sell your personal information. We do not share mobile phone numbers or SMS opt-in data with third parties for their own marketing purposes.

The business you contact may have its own privacy policy and practices. Questions about how a particular business uses your information should also be directed to that business.

5. Google User Data

If a business owner connects Google Calendar to Ziptaa, we ask for access through Google sign-in. On Google's permission screen this appears as three items: view and edit events on your calendars, see your calendars, and see your primary Google Account email address.

What we access and why: We read your list of calendars so you can choose which one Ziptaa uses. We read the busy and free times on that calendar so the AI receptionist can offer open appointment slots when a caller asks to book. We create, change and delete the calendar events for appointments that Ziptaa books, reschedules or cancels. We use your Google Account email only to show you which account is connected. We also store the ID of that calendar and the ID of each event we create, so we can update or remove it later.

How we use it: We use Google data only to provide these features to the business that connected it. We do not use it for advertising, we do not sell it, and we do not use it to develop, improve or train generalized artificial intelligence or machine learning models.

Who sees it: While a call is in progress, the open time slots, without event titles or attendee details, are passed to our voice AI provider, Vapi, and the AI models it uses to run the call (listed in section 4). Vapi may process call data, which can include the open times spoken during the call, in a de-identified form to improve its own speech services. We are enabling Vapi's Zero Data Retention to stop this. Vapi does not share our data with other companies for their own model training, and the AI model providers it uses state that they do not train on API data. Our database provider stores the connection details. Our team does not read your calendar data except with your permission to give support, to investigate abuse or security issues, or when the law requires it. We do not share Google data with anyone other than the providers listed in section 4.

Limited Use: Ziptaa's use and transfer to any other app of information received from Google APIs will adhere to the Google API Services User Data Policy, including the Limited Use requirements.

Disconnecting and deleting: You can disconnect Google Calendar at any time from Settings in the Ziptaa dashboard. When you do, we ask Google to revoke our access and we remove the access keys we store, so we can no longer read or change your calendar. Deleting your Ziptaa account does the same. You can also remove Ziptaa's access at any time at https://myaccount.google.com/permissions. Appointments that Ziptaa already added stay in your own Google Calendar after you disconnect, and Ziptaa will not change them.

6. Data Retention

Call recordings are kept by our voice provider for about 14 days and then deleted. Call details, such as the caller's name and number, the transcript and the summary, are kept in our database while the business account is active, and are deleted when the business deletes its account. Google access keys are deleted when the business disconnects Google Calendar or deletes its account, and the stored calendar and event IDs are deleted when the account is deleted.

7. Security

We use reasonable technical and organizational measures to protect your information. Connections to Ziptaa are encrypted, the access keys we keep for connected services are stored in encrypted form, and each business can see only its own information. No system is completely secure, so we cannot guarantee absolute security.

8. Your Choices

• Reply STOP to any text message from Ziptaa to opt out of future messages
• Reply HELP to any text message for assistance
• Contact the business you booked with directly to request your information be updated or removed
• Contact us at support@ziptaa.com with any privacy questions or requests

9. Changes to This Policy

We may update this Privacy Policy from time to time. When we do, we will change the date at the top of this page. If we make a material change, we will tell business account holders in the dashboard or by email. We will not use Google user data for a new purpose without asking you first.

10. Children's Privacy

The Ziptaa Service is not intended for children to use independently. We do not knowingly collect personal information from children in violation of applicable law.

11. Contact Us

Ziptaa
10000 West Ridgewood Drive 211, Parma Heights, Ohio 44130, US
support@ziptaa.com