Privacy Policy
Effective Date: September 3, 2026
ZipLingo, LLC (“ZipLingo,” “we,” “us,” or “our”) is committed to protecting the privacy and security of personal information. This Privacy Policy describes how we collect, use, disclose, retain, and protect information in connection with our website at ziplingo.com (the “Website”), our multi-channel messaging platform (including SMS, MMS, RCS, email, push notification, and third-party messaging channels such as WhatsApp, WeChat, Line, Telegram, Facebook Messenger and Instagram), our Back-Office Chat / Message Link mobile and web applications (the “Apps”), and related services (collectively, the “Services”).
By using our Website or Services, you consent to the practices described in this Privacy Policy. If you do not agree, please discontinue use.
1. Information We Collect
1.1 Information You Provide Directly
When you register, request a demo, or use our Services, we may collect:
- Account Information: Business name, contact name, email address, phone number, mailing address, and billing information.
- Payment Information: Credit card numbers, billing addresses, and payment details. Payment information is processed through PCI-compliant third-party processors and is not stored on our servers.
- Communications: Information you provide when contacting support, submitting feedback, or responding to surveys.
1.2 Information Collected Through the Services (Message Data)
When Customers use the Services to communicate with their distributors, customers and other contacts (“Message Recipients”), we process the following on behalf of our Customers:
- Contact Identifiers: Mobile phone numbers, email addresses, messaging-platform identifiers (such as WhatsApp, WeChat, Line or Telegram IDs), device tokens for push notifications, and names, as provided by Customers or collected through Customer-authorized opt-in forms and keywords.
- Message Content: Text, images, links and multimedia content of messages transmitted through the Services, including content drafted with AI-assisted tools.
- Consent Records: Records of opt-in consent and opt-out requests, including date, time, channel, and method.
- Opt-Out Data: Records of opted-out recipients, including the keyword used, date, time, and channel.
- Delivery and Engagement Data: Delivery status, timestamps, carrier or platform information, error codes, opens, clicks, and replies.
- Campaign Data: Campaign identifiers, message frequency, and carrier or platform registration information.
Important: With respect to Message Data, ZipLingo acts as a service provider and data processor on behalf of Customers. Customers are the data controllers responsible for obtaining proper consent.
1.3 Back-Office and Integration Data
Customers may connect the Services to their back-office, commerce or CRM systems (for example, ByDesign, Exigo or InfoTrax). When they do, we receive and process data from those systems on the Customer’s behalf, which may include distributor and customer names and contact details, distributor rank and status, enrollment and sponsor information, autoship and subscription status, order and purchase history, and commission or milestone information (“Integration Data”). We use Integration Data solely to provide the Services the Customer has configured — for example, to segment audiences, trigger messages based on back-office events, and attribute orders and revenue to campaigns for the Customer’s reporting. We do not sell Integration Data and do not use it to market to a Customer’s distributors or customers on our own behalf. Customers are the data controllers of Integration Data and are responsible for the notices and consents that apply to it.
1.4 Information Collected Automatically
When you visit our Website, we automatically collect device and browser information (IP address, browser type, OS), usage information (pages visited, time on site, referring URLs), and cookies (see Section 7).
1.5 Information from Third Parties
We may receive information from telecommunications carriers and messaging platform providers (delivery receipts), campaign registries, and business partners.
1.6 Information Collected Through the Apps
If a Customer’s distributors or staff use our Apps, we collect account and profile information provided by the Customer or the user, device identifiers and push-notification tokens, chat messages and shared media, and usage and diagnostic information needed to operate the Apps. This information is processed on behalf of the Customer that deployed the App.
2. How We Use Information
2.1 Website Visitor Information
We use visitor information to operate and improve the Website, process transactions, provide support, send marketing communications (with consent), analyze usage, detect fraud, and comply with legal obligations.
2.2 Message Data and Integration Data
We use Message Data and Integration Data solely to: transmit messages on behalf of Customers; segment audiences and trigger messages as configured by Customers; process opt-out requests; maintain suppression lists; generate delivery, engagement and attribution reports for Customers; monitor compliance with our Terms of Use; comply with applicable laws; and maintain records as required by the TCPA, CTIA guidelines, and other regulations.
We do not use Message Data or Integration Data to market our own products to Message Recipients. We do not sell Message Data or Integration Data.
Where a Customer uses AI-assisted features to draft, translate or improve content, the text the Customer submits and the generated output may be processed by our third-party AI providers solely to deliver the feature. Under our agreement with our AI provider, that content is not used to train the provider’s models. We do not submit Message Recipient contact identifiers or Integration Data to AI providers except as required to provide a feature the Customer has enabled.
3. How We Share Information
3.1 General Sharing Practices
ZipLingo does not sell, rent, or lease personal information. We may share information with:
- Service Providers: Third-party vendors (carriers, payment processors, hosting, analytics) contractually bound to maintain confidentiality.
- Telecommunications Carriers: Carriers and aggregators necessary for message delivery, who may retain metadata per their own policies.
- Messaging Platform Providers: Third-party platforms through which Customers choose to send messages (including Meta for WhatsApp, Facebook Messenger and Instagram; Google and carriers for RCS; and WeChat, Line and Telegram), which receive message content and recipient identifiers necessary for delivery and process them under their own policies.
- AI Service Providers: Providers of the AI-assisted content features described in Section 2.2, who receive only the content submitted to those features.
- Campaign Registries: The Campaign Registry (TCR) and similar registries as required for carrier compliance.
- Legal Compliance: When required by law, regulation, or legal process, or to protect rights and safety.
- Business Transfers: In connection with a merger, acquisition, or sale of assets.
No mobile information will be shared with third parties or affiliates for marketing or promotional purposes. Text messaging originator opt-in data and consent will not be shared with any third parties, except for vendors and service providers acting on our behalf to deliver the Services (such as carriers, aggregators and hosting providers). Our current sub-processors are listed in Section 3.2.
3.2 Sub-Processors
The following third parties process personal information on our behalf to deliver the Services. We will update this list when a sub-processor is added or replaced.
- Amazon Web Services (AWS) — cloud hosting and data storage (United States)
- Bandwidth — SMS and MMS delivery
- Infobip — RCS delivery
- Twilio — WhatsApp delivery
- Meta Platforms — WhatsApp, Facebook Messenger and Instagram messaging platform
- Beefree (BEE) — email and landing-page design editor
- Anthropic — AI-assisted content features
- Intuit (QuickBooks Payments) — invoicing and payment processing
3.3 Customer Responsibility for Message Data and Integration Data
ZipLingo processes Message Data and Integration Data as a service provider on behalf of Customers. Customers are solely responsible for obtaining consent, providing privacy disclosures, responding to data subject requests, and complying with applicable privacy laws.
If you are a Message Recipient with questions, please contact the business that sent you the message. If you cannot identify the sender, contact privacy@ziplingo.com.
4. Opt-Out and Unsubscribe
4.1 Messages Sent by Our Customers
If you receive messages from a business using ZipLingo, that business controls its messaging program. You may opt out at any time:
- SMS/MMS/RCS: Reply STOP, UNSUBSCRIBE, CANCEL, END, or QUIT. Upon receiving an opt-out, our platform sends a confirmation, adds the number to the suppression list, and stops further messaging from the applicable campaign. Our platform also recognizes non-standard opt-out language that clearly expresses intent to stop receiving messages (for example, “please stop,” “don’t text me,” “remove me”).
- Email: Use the unsubscribe link in any email. Requests are honored within ten (10) business days.
- WhatsApp and other messaging platforms: Reply STOP, use the platform’s block or unsubscribe feature, or contact the sending business.
- Push notifications: Adjust your device or App notification settings.
Opt-outs are processed promptly and typically take effect within minutes. Opt-outs apply to the channel through which they were received. To opt out of all channels, contact the business that sent the message. If you cannot identify the sender or continue to receive messages after opting out, contact privacy@ziplingo.com and we will assist.
4.2 Communications from ZipLingo
To stop receiving marketing communications from ZipLingo itself, click “unsubscribe” in any email, reply STOP to any text from us, or contact info@ziplingo.com. We may continue to send transactional and account-related communications.
5. Data Retention
5.1 Account Information
Retained for the business relationship duration plus three (3) years after termination, unless longer retention is required by law.
5.2 Message Data and Integration Data
- Message content and delivery records: Five (5) years from transmission, to support compliance with the Telephone Consumer Protection Act and defense of related claims, unless the Customer has configured a shorter retention period or a longer period is required by law.
- Consent records: Duration of the consent relationship plus six (6) years following the last message sent under that consent, unless the Customer has configured a shorter retention period or a longer period is required by law.
- Opt-out records: Retained indefinitely to ensure ongoing suppression.
- Campaign registration data: Campaign duration plus three (3) years after termination.
- Integration Data: Retained for the duration of the Customer relationship and deleted or returned upon termination, subject to legal hold or regulatory retention obligations.
5.3 Website Usage Data
Retained for up to twenty-four (24) months unless aggregated or anonymized for longer-term analytics.
5.4 Deletion Requests
To request deletion, see Section 6. We may retain certain information for legal, regulatory, or legitimate business purposes after receiving a deletion request.
6. Your Privacy Rights
6.1 California Residents (CCPA/CPRA)
California residents have the following rights under the CCPA/CPRA:
- Right to Know: Request disclosure of categories and specific personal information collected, sources, purposes, and third parties.
- Right to Delete: Request deletion of personal information, subject to exceptions.
- Right to Correct: Request correction of inaccurate personal information.
- Right to Opt Out of Sale/Sharing: ZipLingo does not sell personal information or share it for cross-context behavioral advertising.
- Right to Limit Sensitive Data Use: We limit use of sensitive personal information to CCPA-authorized purposes.
- Right to Non-Discrimination: We will not discriminate for exercising privacy rights.
Categories of PI Collected: Identifiers (name, email, phone, IP); commercial information (transactions, billing); internet activity (browsing, usage); geolocation (from IP); professional information (title, company).
To exercise your rights: Email privacy@ziplingo.com or call 888-245-3090. We respond within forty-five (45) days.
6.2 EEA, UK, and Swiss Residents (GDPR/UK GDPR)
Legal Bases for Processing: Contract performance (Article 6(1)(b)); legitimate interests (Article 6(1)(f)); consent (Article 6(1)(a)); and legal obligation (Article 6(1)(c)).
Your rights under GDPR include:
- Access: Receive a copy of your personal data.
- Rectification: Correct inaccurate or incomplete data.
- Erasure: Request deletion (“right to be forgotten”) under certain circumstances.
- Restriction: Restrict processing under certain circumstances.
- Data Portability: Receive data in a structured, machine-readable format.
- Object: Object to processing based on legitimate interests or for direct marketing.
- Withdraw Consent: Withdraw consent at any time without affecting prior processing.
- Lodge a Complaint: File a complaint with your supervisory authority.
International Transfers: We implement appropriate safeguards for transfers outside the EEA/UK/Switzerland, including EU Standard Contractual Clauses and the EU-U.S. Data Privacy Framework where applicable.
GDPR Inquiries: Email privacy@ziplingo.com with “GDPR Request” in the subject line.
6.3 Other Jurisdictions
We comply with applicable privacy laws where we operate. Contact privacy@ziplingo.com with questions about your jurisdiction.
7. Cookies and Tracking Technologies
- Strictly Necessary: Essential for Website functionality (session management, security). Cannot be disabled.
- Performance/Analytics: Help us understand visitor behavior and improve the Website.
- Functional: Remember preferences and settings.
- Marketing: Used for relevant advertising and campaign tracking.
Manage cookie preferences through your browser settings. Disabling cookies may affect functionality. Because we do not sell or share personal information for cross-context behavioral advertising, the Website does not currently respond to “Do Not Track” or Global Privacy Control signals.
8. Data Security
We implement commercially reasonable safeguards including: encryption of data in transit (TLS/SSL) and at rest; access controls; regular security assessments; employee training; and incident response procedures. No method of transmission or storage is completely secure; we cannot guarantee absolute security.
9. Children’s Privacy
ZipLingo does not knowingly collect personal information from children under 13 (or 16 in the EEA/UK). If we learn of such collection without parental consent, we will delete it promptly. Contact privacy@ziplingo.com if you believe we have collected information from a child. Our Services are directed at businesses, not children.
10. Third-Party Links
Our Website may link to third-party sites. This Privacy Policy applies only to our Website and Services. We encourage you to review third-party privacy policies.
11. Social Media Connections
Last updated: October 14, 2026
If your company uses ZipLingo's Social Media Manager, an administrator of your workspace can connect your company's Facebook Pages, Instagram professional accounts, LinkedIn Company Pages and X accounts. Personal profiles are never connected.
Whose data this is. ZipLingo provides the Social Media Manager to businesses. Your company decides which accounts to connect and what to do with them, and ZipLingo handles the data only to provide the service to your company. For this data ZipLingo is a service provider under U.S. state privacy laws and a processor under the GDPR; your company is the business, or controller. If you commented on or messaged a company's page and want to know what that company holds about you, or want it deleted, contact that company. We help our customers answer those requests, and if you write to us instead we pass your request to the company concerned.
What we receive and keep. When an account is connected, the platform gives us an access token. We store it encrypted (AES-256-GCM) and use it only on our servers, to:
- publish posts that people in your workspace wrote and approved;
- read the performance of those posts and of your connected accounts (reach, views, engagements, clicks, followers);
- read comments, mentions and messages on your own accounts' content, with the name or username of the person who wrote them, so your team can answer from one inbox, and send the replies your team writes.
How long we keep it. We keep this data, scoped to your workspace, for as long as your workspace uses the Social Media Manager, and delete it when you ask (see below). Some of it goes sooner on its own: the detailed engagement timing behind "best time to post" after 180 days, and the raw notifications the platforms send us after 14 days.
Who we share it with. We do not sell this data, share it for advertising, or use it to build profiles of the people who interact with your pages. It is processed for us by the service providers below, under contracts that limit them to providing their service to us:
- Amazon Web Services, which hosts ZipLingo in the United States.
- Anthropic and xAI, only if your team uses the AI assist. When someone asks for a draft post, the text they typed is sent to the AI provider's API. When someone asks for a suggested reply, the conversation it answers is sent, including the names and messages of the people in it. Which of the two handles a request depends on the model ZipLingo uses for it. The provider processes this as our processor, to return the draft, and under its terms for business customers does not use it to train its models. xAI deletes what it receives and what it returns within 30 days. Nothing is sent to either unless a member of your team presses the AI assist button.
We also disclose data where the law requires it.
Security. Access tokens are encrypted at rest and are never sent to a browser. The database is encrypted at rest, and connections to ZipLingo, to its database and to the platforms are encrypted in transit. Access inside your workspace follows the roles your administrator assigns. If we learn of a breach affecting your workspace's data, we notify your company without undue delay and, under our Data Processing Addendum, within 72 hours.
Disconnecting an account. An administrator can disconnect any account in Social Media Manager → Accounts. That erases its access tokens immediately and stops all reading and publishing for that account. You can also remove ZipLingo's access at the platform itself (for Facebook and Instagram: Settings → Business integrations).
Deleting your data. An administrator of your workspace can delete all the social media data we hold for it at any time, in Social Media Manager → Settings → Delete social media data. This:
- disconnects every connected account and erases the stored access tokens;
- for Facebook and Instagram, asks Meta to withdraw ZipLingo's authorization, so the tokens stop working at Meta as well. We do this whenever we can confirm it affects only your workspace. Where we cannot (for example, the same Facebook login also connects another workspace, or Meta does not confirm), we erase our copies, leave the authorization in place, and tell you on screen so you can remove ZipLingo under Business integrations. For LinkedIn and X we erase the tokens we hold; remove ZipLingo from the account's connected apps to withdraw access there;
- deletes the inbox (comments, mentions, messages and replies), the analytics, and the platform's identifiers, metrics and error messages on your posts.
Reading and publishing stop at once, and the data is removed from our live systems as part of the same step; anything a platform was still sending us at that moment is discarded or removed within the hour. The result, with a reference number, is shown on screen and sent to your workspace's administrators. Copies in our encrypted backups expire within 30 days. Scheduled posts go back to draft. Posts your team wrote stay in your workspace as your own record unless you choose to delete them in the same step. A record of each deletion is kept (who ran it, when, and how many items were removed), without the deleted data itself.
If you cannot use the tool, or you no longer have access to your workspace, email support@ziplingo.com from an address on the workspace's administrator list with the subject "Delete social media data". We complete the request within 30 days and confirm by email.
Your privacy rights. Depending on where you live you may have the right to know what personal information is held about you, to have it corrected or deleted, and to receive a copy. Because we hold this data on behalf of our customers, the company whose page you interacted with is the one to ask; we assist it. We do not discriminate against anyone for exercising these rights.
If you are in the EEA or the UK.
- Lawful basis. Your company, as controller, determines the lawful basis for handling the comments and messages people send to its pages (typically its legitimate interest in answering its customers and running its business). ZipLingo processes that data on your company's documented instructions under the Data Processing Addendum in your company's ZipLingo Service Agreement. For the account details of the people who sign in to ZipLingo, ZipLingo's basis is the performance of its contract with your company and its legitimate interest in keeping the service secure.
- Your rights. You have the right to access, correct, erase, restrict or object to the processing of your personal data, and to data portability. To exercise them over data on a company's page, contact that company. You also have the right to complain to your data protection authority.
- International transfers. ZipLingo stores this data in the United States, and Amazon Web Services and Anthropic process it there. xAI processes what it receives in the United States and other countries where it operates, under its data processing terms. Transfers from the EEA and the UK are made under the European Commission's Standard Contractual Clauses, with the UK International Data Transfer Addendum for UK data, as set out in our Data Processing Addendum. ZipLingo is not certified under the EU-U.S. Data Privacy Framework.
Changes. If we change this section in a way that matters, we notify workspace administrators before the change takes effect and update the date above.
Contact. ZipLingo LLC, 355 South 520 West Ste. 100, Lindon, UT 84042, United States. support@ziplingo.com.
12. Changes to This Privacy Policy
We may update this Privacy Policy from time to time. Material changes will be communicated to Customers via email at least thirty (30) days prior to taking effect. The revised version will be posted with an updated date. Continued use constitutes acceptance.
13. Contact Us
ZipLingo, LLC
Attn: Privacy
355 South 520 West Ste. 100
Lindon, UT 84042
Email: privacy@ziplingo.com
Phone: 888-245-3090
GDPR requests: privacy@ziplingo.com with “GDPR Request” in the subject line.
CCPA/CPRA requests: privacy@ziplingo.com with “California Privacy Request” in the subject line, or call 888-245-3090.