PRIVACY

Privacy Policy

Effective 5 September 2026

What Zippy is

Zippy is an AI accounts-receivable and collections product for B2B companies. It is operated by Localservv (also referred to as Zippy AI), based in Dubai, United Arab Emirates. Zippy helps a business follow up on unpaid invoices — drafting and sending reminders, reading and classifying replies, scheduling calls, applying payments, and reporting on collections status.

This policy explains what data we process to provide Zippy, why we process it, and the rights you have over it. It applies to the businesses that use Zippy ("customers"), the people who work for them, and the customers' own debtors whose contact details pass through the product in the course of collections.

Data we process

To run Zippy for a customer, we process:

• Customer names and contact details, and the contact details of the debtors a customer is collecting from
• Invoices, balances and payment records connected from accounting systems
• Email content and call transcripts that relate to collections conversations
• Data from systems the customer connects, such as accounting tools and mailboxes, needed to send reminders and read replies
• Account and workspace information, such as team member logins and configuration

Why we process it

We use this data to draft and send collections reminders, classify and route replies, schedule and support collections calls, apply and reconcile payments, and show the customer reports on their receivables and collections performance. We do not use this data for any purpose unrelated to providing the service.

Google user data

Zippy's use and transfer of information received from Google APIs adheres to the Google API Services User Data Policy, including the Limited Use requirements.

When a customer connects a Gmail mailbox, Zippy requests only the gmail.send and gmail.readonly scopes. We use gmail.send solely to send collections emails from the customer's own mailbox, and gmail.readonly solely to read replies to those collections threads so we can classify them and decide the next step. We do not use Gmail data to serve advertisements, we do not sell Gmail data, and we do not transfer Gmail data to any third party except as needed to provide the service, through the sub-processors listed below.

Human access to Gmail data is limited to what is necessary for support or security purposes, and only with the customer's consent.

Sub-processors

We share data with a small number of providers who help us run Zippy, each bound by a data processing agreement:

• Vercel — application hosting
• Supabase — database
• Nango — OAuth token storage for connected accounts
• OpenRouter and its underlying model providers — classification and drafting of collections messages
• Retell and Twilio — voice calling
• Resend — hosted email delivery
• PostHog — product analytics

Retention

We retain data for as long as a customer's workspace exists. If a workspace is deleted, its data is deleted within 30 days. Customers can export their data at any time before deletion.

Security

Data is encrypted in transit and at rest. Access is controlled and limited to what each team member and sub-processor needs to do their job, and access to customer data is logged in an audit trail.

Your rights

You can ask us to access, correct, or delete the data we hold about you. If you connected a Google account, you can withdraw Zippy's access at any time at myaccount.google.com/permissions.

Children

Zippy is a business product and is not directed at, or intended for use by, anyone under 18.

Changes to this policy

We may update this policy as the product changes. We will update the effective date above when we do.

Contact

Questions about this policy or your data can be sent to info@zippy-help.com.