Privacy Policy

ZigFlow ("we", "us", or "our"), operated by RA Studio, provides the ZigFlow application (the "Service") — an AI-powered marketing automation platform available as a Shopify app and at zigflow.io. This Privacy Policy explains how we collect, use, disclose, and safeguard your information when you install our Shopify app or use our Service.

By installing ZigFlow from the Shopify App Store or using our Service, you consent to the data practices described in this policy. Terms not defined here have the same meanings as in our Terms of Service.

This policy applies to all users of ZigFlow, including Shopify merchants, their team members, and end-users who interact with content created through our platform.

• Service: The ZigFlow application (Shopify app and web platform at zigflow.io), including all related APIs, tools, and features.

• Personal Data: Any information relating to an identified or identifiable natural person, such as name, email address, or store URL.

• Usage Data: Data collected automatically from your use of the Service (e.g., pages visited, features used, timestamps).

• Merchant Data: Data from your Shopify store accessed via Shopify APIs, including products, orders, and store configuration.

• Cookies: Small data files stored on your device to maintain session state and preferences.

• Data Controller: RA Studio, which determines the purposes and means of processing your personal data.

• Data Processor: Any third-party service that processes data on our behalf (e.g., cloud hosting, AI providers).

We collect information through several channels to provide and improve our Service:

We use the collected information for the following purposes:

• Provide and maintain the Service: Process your requests, manage your account, and deliver features you use.

• AI-powered campaign generation: Your product data and brand settings are sent to AI services to generate personalized marketing content.

• Social media publishing: Schedule and publish content to your connected social media accounts via our publishing partners.

• Video generation: Create promotional videos using your product images and brand assets.

• Analytics and insights: Track campaign performance and provide actionable marketing recommendations.

• Service improvement: Analyze usage patterns to improve features and user experience.

• Communication: Send transactional emails (account verification, billing notifications) and, with your consent, marketing updates.

• Security and fraud prevention: Detect, investigate, and prevent unauthorized access or abuse of our Service.

We share data with the following third-party services, strictly for operating our Service. Each provider processes data under their own privacy policy and contractual obligations:

We use cookies and similar technologies to maintain your session, remember your preferences, and analyze Service usage.

• Essential Cookies: Required for authentication, session management, and core Service functionality. Cannot be disabled.

• Preference Cookies: Store your language, theme, and display settings across sessions.

• Analytics Cookies: Help us understand how you use the Service to improve features and performance (Google Analytics).

You can control cookies through your browser settings. Disabling essential cookies may prevent the Service from functioning properly.

If you are in the European Economic Area (EEA), we process your personal data based on the following legal grounds:

• Contractual necessity: Processing required to provide the Service you subscribed to (account management, campaign generation, publishing).

• Consent: Where you have explicitly agreed, such as for marketing emails or optional analytics.

• Legitimate interest: Service improvement, security monitoring, and fraud prevention, where these interests are not overridden by your rights.

• Legal obligation: Compliance with applicable laws, tax requirements, and regulatory requests.

We do not sell, trade, or rent your personal data. We may share information in the following limited circumstances:

• Service Providers: With third-party vendors listed above, solely for operating the Service under contractual safeguards.

• Legal Requirements: When required by law, court order, or governmental authority.

• Rights Protection: To protect the rights, property, or safety of ZigFlow, our users, or the public.

• Business Transfer: In connection with a merger, acquisition, or sale of assets, with prior notice to affected users.

We implement industry-standard security measures to protect your data, including: encryption in transit (TLS 1.2+) and at rest, secure authentication with JWT tokens and OAuth 2.0, access controls and principle of least privilege, regular security monitoring and logging, HMAC signature verification for all webhooks.

While we employ commercially reasonable measures, no method of electronic transmission or storage is completely secure. We cannot guarantee absolute security but are committed to promptly addressing any security incidents.

We retain your data according to the following schedule:

• Account data: Retained while your account is active. Deleted within 30 days of account deletion request.

• Shopify store data: Product catalog and store information are synced periodically. All store data is deleted within 48 hours of app uninstallation (per Shopify requirements via shop/redact webhook).

• Campaign content and media: Retained while your account is active. Deleted with your account or upon request.

• Usage logs and analytics: Retained for up to 12 months for service improvement, then anonymized or deleted.

• Billing records: Retained as required by applicable tax and accounting laws (typically 7 years).

Your data is processed and stored on servers located in the United States (AWS us-east-1 region, MongoDB Atlas us-east-1). If you are located outside the United States, your data will be transferred to and processed in the US. We ensure appropriate safeguards are in place for international transfers, including Standard Contractual Clauses (SCCs) where required by GDPR.

Depending on your location, you may have the following rights regarding your personal data:

To exercise any of these rights, contact us at info@zigflow.io. We will respond within 30 days (GDPR) or 45 days (CCPA).

As a Shopify app, we comply with Shopify's mandatory privacy requirements:

• Data Access Requests: When a merchant's customer requests their personal data, we respond through Shopify's customers/data_request webhook within 30 days.

• Data Erasure: When a merchant requests customer data deletion, we erase the relevant data through Shopify's customers/redact webhook within 30 days.

• App Uninstallation: When a merchant uninstalls ZigFlow, we receive Shopify's shop/redact webhook and delete all store-specific data within 48 hours.

• HMAC Verification: All Shopify webhook communications are verified using HMAC-SHA256 signatures to ensure authenticity.

• Minimal Scopes: We only request read-only API scopes necessary for our functionality. We never request write access to your store.

ZigFlow is a B2B service designed for business use. We do not knowingly collect information from anyone under the age of 16. If you believe a minor has provided us with personal data, please contact us at info@zigflow.io and we will promptly delete it.

We may update this Privacy Policy to reflect changes in our practices or legal requirements. We will notify you of material changes by posting the updated policy on this page with a new effective date, and by sending a notification through the Service or via email. We encourage you to review this policy periodically.

If you have questions about this Privacy Policy, wish to exercise your privacy rights, or need to report a data concern, please contact us:

RA Studio
Montréal, QC, Canada

We will acknowledge your request within 5 business days and respond substantively within 30 days.