Privacy Policy

ZapInto (zapinto.com) is operated by Agentia de Zece SRL, Ineu 11, Ploiesti, Prahova, Romania, 100269, registered under no. J29/25/2020, VAT RO42081752 ("ZapInto", "we"). We are the data controller for the personal data described here. Contact: contact@zapinto.com.

Account data — email address, display name, optional avatar, and authentication data handled by our provider Clerk (including OAuth profile basics if you sign in with Google, Apple, or Facebook). Lawful basis: performing our contract with you.

Gameplay data — your games, answers, scores, Volts, hexes, badges, streaks, notifications, and leaderboard standings. Lawful basis: contract performance. Display name and public stats are visible to other players by design.

Payment data — handled by Stripe. We never see or store card numbers; we keep your subscription status, purchase history (PowerZaps), and a Stripe customer reference. Lawful basis: contract performance and legal (accounting) obligations.

Security/session data — IP address, device and browser information processed by Clerk for sign-in security. Lawful basis: legitimate interest (account security).

Support & contact data — when you contact us (including a cancellation via the cancel page) we process your name, email address, the reason you selected, the content of your message, and the page you wrote from (plus, for abuse prevention, a one-way hash of your IP address and your browser type — never the raw IP). If you are signed in, the message is linked to your account. We use it to respond and to keep a record of the correspondence. Lawful basis: legitimate interest (handling inquiries) or contract performance (billing and account matters). Retained for 24 months after the matter is closed, then deleted automatically — longer only where a legal obligation requires it.

Affiliate program data— if you arrive through an affiliate link we record the click with the country and a one-way salted hash of the IP address (we never store the raw IP), and if you then create an account it is permanently associated with that affiliate so they can be paid. The same happens when you create your account directly from an influencer's page (an address beginning with /r/): we record that influencer as your referrer from the address of the page you signed up on — no cookie is involved. Affiliates additionally provide contact details, social links, payout details, country of tax residence (and, on request, tax-residence documentation), and their agreement acceptance (version, timestamp, IP). Lawful bases: consent (the tracking cookie), legitimate interest (fraud prevention on clicks, and referral attribution when you sign up from an influencer's page), contract (the affiliate relationship), legal obligation (commission accounting). Affiliates never see who you are: their dashboard shows only anonymous counts and commission amounts — never the identity of referred players.

Affiliate applications — when you apply to the affiliate program we process your legal name, email address, country of tax residence, channel links, optional phone number, anything you add to the application, and a one-way hash of your IP address. Lawful basis: taking steps at your request prior to entering a contract (art. 6(1)(b) GDPR). Applications that do not result in an affiliate account are deleted automatically 6 months after the decision.

Essential: Clerk authentication cookies (keeping you signed in) — no consent required. Your theme preference is kept in localStorage on your device.

Marketing: one first-party cookie, zap_ref (60 days), which remembers the affiliate link that brought you here so the affiliate can be credited. In the EEA, UK, and Switzerland it is set only after you consent via our CookieYes banner; you can withdraw at any time through "Cookie Settings" in the footer. Declining never limits the service.

We use no analytics cookies today. If advertising (Google AdSense) is added later, this policy and the consent banner will be updated first. The full cookie-by-cookie table (name, provider, duration, purpose) lives in the Cookie Policy.

We share data only with the processors that run the service: Clerk (authentication, USA), Supabase (database, storage & serverless functions, USA), Stripe (payments, USA), CookieYes (consent management), Vercel (hosting, USA), ClausWeb (e-mail hosting for support and transactional mail, Romania, EU), and their sub-processors (e.g. e-mail delivery for verification codes). For transfers outside the EEA: Clerk, Stripe, and Vercel are certified under the EU-U.S. Data Privacy Framework; Supabase relies on the EU Standard Contractual Clauses. We never sell your personal data.

Payout recipients: when we pay an affiliate, the payout provider they chose — PayPal, Wise, or their bank — receives their name and payout details. These providers handle that data as independent controllers under their own privacy terms, not as our processors.

Account and gameplay data: for the life of the account. Support correspondence: 24 months after the matter is closed, then deleted automatically. Declined affiliate applications: 6 months after the decision, then deleted automatically. Affiliate click records: 12 months, then deleted automatically. Commission and payout ledgers: retained as required by accounting law even after account deletion, with the account reference removed. Deleted accounts: our data is removed immediately by automated cascade; Clerk completes its deletion within 90 days per its DPA.

You can delete your account from your Dashboard settings (full deletion — we do not offer partial deletion), or by writing to contact@zapinto.com. Deletion removes your profile, transfers your map territories to the neutral system player, immediately ends any active Zap+ subscription (access does not continue to the end of the paid period), and forfeits any unspent PowerZaps — the deletion screen warns you first, and the Terms (Section 7) describe the refund picture.

Under the GDPR you may request access, rectification, erasure, restriction, portability, and object to processing, and withdraw consent at any time (footer → Cookie Settings for the marketing cookie). Write to contact@zapinto.com or use the contact page (reason: Privacy & data requests) — we answer within one month, extendable by up to two further months for complex or numerous requests as the GDPR permits (we tell you within the first month if so). You may also complain to a supervisory authority; in Romania that is ANSPDCP, B-dul G-ral Gheorghe Magheru 28-30, Sector 1, Bucharest (dataprotection.ro).

No solely automated decisions: anti-cheat systems may flag accounts, but a human reviews every account sanction, and you can contest any decision through the contact page.

ZapInto is for users aged 16 and over — younger users may not use the service. We do not knowingly collect data from children below that age; if you believe we have, contact us and we will delete it.

Encryption in transit and at rest, row-level security on every database table, server-side-only processing of payments and balances, and no raw IP storage in our own database. No system is perfectly secure; in case of a breach affecting you we will notify the supervisory authority where the law requires it (within 72 hours) and affected users without undue delay.

We collect the categories described in Section 2 (identifiers like email and display name, gameplay activity, and payment status handled by Stripe), share them only with the service providers in Section 4, and never sell or share personal data for advertising. Because we don't track users across third-party sites, we do not respond to browser "Do Not Track" signals — there is nothing to opt out of. California residents may exercise the access and deletion rights in Section 7 the same way as everyone else.

Material changes will be announced on this page (and by email where legally required) before they take effect. The effective date above always reflects the current version.