Privacy Policy

Effective Date: September 3, 2026

ZipLingo, LLC (“ZipLingo,” “we,” “us,” or “our”) is committed to protecting the privacy and security of personal information. This Privacy Policy describes how we collect, use, disclose, retain, and protect information in connection with our website at ziplingo.com (the “Website”), our multi-channel messaging platform (including SMS, MMS, RCS, email, push notification, and third-party messaging channels such as WhatsApp, WeChat, Line, Telegram, Facebook Messenger and Instagram), our Back-Office Chat / Message Link mobile and web applications (the “Apps”), and related services (collectively, the “Services”).

By using our Website or Services, you consent to the practices described in this Privacy Policy. If you do not agree, please discontinue use.

1. Information We Collect

1.1 Information You Provide Directly

When you register, request a demo, or use our Services, we may collect:

• Account Information: Business name, contact name, email address, phone number, mailing address, and billing information.
• Payment Information: Credit card numbers, billing addresses, and payment details. Payment information is processed through PCI-compliant third-party processors and is not stored on our servers.
• Communications: Information you provide when contacting support, submitting feedback, or responding to surveys.

1.2 Information Collected Through the Services (Message Data)

When Customers use the Services to communicate with their distributors, customers and other contacts (“Message Recipients”), we process the following on behalf of our Customers:

• Contact Identifiers: Mobile phone numbers, email addresses, messaging-platform identifiers (such as WhatsApp, WeChat, Line or Telegram IDs), device tokens for push notifications, and names, as provided by Customers or collected through Customer-authorized opt-in forms and keywords.
• Message Content: Text, images, links and multimedia content of messages transmitted through the Services, including content drafted with AI-assisted tools.
• Consent Records: Records of opt-in consent and opt-out requests, including date, time, channel, and method.
• Opt-Out Data: Records of opted-out recipients, including the keyword used, date, time, and channel.
• Delivery and Engagement Data: Delivery status, timestamps, carrier or platform information, error codes, opens, clicks, and replies.
• Campaign Data: Campaign identifiers, message frequency, and carrier or platform registration information.

Important: With respect to Message Data, ZipLingo acts as a service provider and data processor on behalf of Customers. Customers are the data controllers responsible for obtaining proper consent.

1.3 Back-Office and Integration Data

Customers may connect the Services to their back-office, commerce or CRM systems (for example, ByDesign, Exigo or InfoTrax). When they do, we receive and process data from those systems on the Customer’s behalf, which may include distributor and customer names and contact details, distributor rank and status, enrollment and sponsor information, autoship and subscription status, order and purchase history, and commission or milestone information (“Integration Data”). We use Integration Data solely to provide the Services the Customer has configured — for example, to segment audiences, trigger messages based on back-office events, and attribute orders and revenue to campaigns for the Customer’s reporting. We do not sell Integration Data and do not use it to market to a Customer’s distributors or customers on our own behalf. Customers are the data controllers of Integration Data and are responsible for the notices and consents that apply to it.

1.4 Information Collected Automatically

When you visit our Website, we automatically collect device and browser information (IP address, browser type, OS), usage information (pages visited, time on site, referring URLs), and cookies (see Section 7).

1.5 Information from Third Parties

We may receive information from telecommunications carriers and messaging platform providers (delivery receipts), campaign registries, and business partners.

1.6 Information Collected Through the Apps

If a Customer’s distributors or staff use our Apps, we collect account and profile information provided by the Customer or the user, device identifiers and push-notification tokens, chat messages and shared media, and usage and diagnostic information needed to operate the Apps. This information is processed on behalf of the Customer that deployed the App.

2. How We Use Information

2.1 Website Visitor Information

We use visitor information to operate and improve the Website, process transactions, provide support, send marketing communications (with consent), analyze usage, detect fraud, and comply with legal obligations.

2.2 Message Data and Integration Data

We use Message Data and Integration Data solely to: transmit messages on behalf of Customers; segment audiences and trigger messages as configured by Customers; process opt-out requests; maintain suppression lists; generate delivery, engagement and attribution reports for Customers; monitor compliance with our Terms of Use; comply with applicable laws; and maintain records as required by the TCPA, CTIA guidelines, and other regulations.

We do not use Message Data or Integration Data to market our own products to Message Recipients. We do not sell Message Data or Integration Data.

Where a Customer uses AI-assisted features to draft, translate or improve content, the text the Customer submits and the generated output may be processed by our third-party AI providers solely to deliver the feature. Under our agreement with our AI provider, that content is not used to train the provider’s models. We do not submit Message Recipient contact identifiers or Integration Data to AI providers except as required to provide a feature the Customer has enabled.

3. How We Share Information

3.1 General Sharing Practices

ZipLingo does not sell, rent, or lease personal information. We may share information with:

• Service Providers: Third-party vendors (carriers, payment processors, hosting, analytics) contractually bound to maintain confidentiality.
• Telecommunications Carriers: Carriers and aggregators necessary for message delivery, who may retain metadata per their own policies.
• Messaging Platform Providers: Third-party platforms through which Customers choose to send messages (including Meta for WhatsApp, Facebook Messenger and Instagram; Google and carriers for RCS; and WeChat, Line and Telegram), which receive message content and recipient identifiers necessary for delivery and process them under their own policies.
• AI Service Providers: Providers of the AI-assisted content features described in Section 2.2, who receive only the content submitted to those features.
• Campaign Registries: The Campaign Registry (TCR) and similar registries as required for carrier compliance.
• Legal Compliance: When required by law, regulation, or legal process, or to protect rights and safety.
• Business Transfers: In connection with a merger, acquisition, or sale of assets.

No mobile information will be shared with third parties or affiliates for marketing or promotional purposes. Text messaging originator opt-in data and consent will not be shared with any third parties, except for vendors and service providers acting on our behalf to deliver the Services (such as carriers, aggregators and hosting providers). Our current sub-processors are listed in Section 3.2.

3.2 Sub-Processors

The following third parties process personal information on our behalf to deliver the Services. We will update this list when a sub-processor is added or replaced.

• Amazon Web Services (AWS) — cloud hosting and data storage (United States)
• Bandwidth — SMS and MMS delivery
• Infobip — RCS delivery
• Twilio — WhatsApp delivery
• Meta Platforms — WhatsApp, Facebook Messenger and Instagram messaging platform
• Beefree (BEE) — email and landing-page design editor
• Anthropic — AI-assisted content features
• Intuit (QuickBooks Payments) — invoicing and payment processing

3.3 Customer Responsibility for Message Data and Integration Data

ZipLingo processes Message Data and Integration Data as a service provider on behalf of Customers. Customers are solely responsible for obtaining consent, providing privacy disclosures, responding to data subject requests, and complying with applicable privacy laws.

If you are a Message Recipient with questions, please contact the business that sent you the message. If you cannot identify the sender, contact privacy@ziplingo.com.

4. Opt-Out and Unsubscribe

4.1 Messages Sent by Our Customers

If you receive messages from a business using ZipLingo, that business controls its messaging program. You may opt out at any time:

• SMS/MMS/RCS: Reply STOP, UNSUBSCRIBE, CANCEL, END, or QUIT. Upon receiving an opt-out, our platform sends a confirmation, adds the number to the suppression list, and stops further messaging from the applicable campaign. Our platform also recognizes non-standard opt-out language that clearly expresses intent to stop receiving messages (for example, “please stop,” “don’t text me,” “remove me”).
• Email: Use the unsubscribe link in any email. Requests are honored within ten (10) business days.
• WhatsApp and other messaging platforms: Reply STOP, use the platform’s block or unsubscribe feature, or contact the sending business.
• Push notifications: Adjust your device or App notification settings.

Opt-outs are processed promptly and typically take effect within minutes. Opt-outs apply to the channel through which they were received. To opt out of all channels, contact the business that sent the message. If you cannot identify the sender or continue to receive messages after opting out, contact privacy@ziplingo.com and we will assist.

4.2 Communications from ZipLingo

To stop receiving marketing communications from ZipLingo itself, click “unsubscribe” in any email, reply STOP to any text from us, or contact info@ziplingo.com. We may continue to send transactional and account-related communications.

5. Data Retention

5.1 Account Information

Retained for the business relationship duration plus three (3) years after termination, unless longer retention is required by law.

5.2 Message Data and Integration Data

• Message content and delivery records: Five (5) years from transmission, to support compliance with the Telephone Consumer Protection Act and defense of related claims, unless the Customer has configured a shorter retention period or a longer period is required by law.
• Consent records: Duration of the consent relationship plus six (6) years following the last message sent under that consent, unless the Customer has configured a shorter retention period or a longer period is required by law.
• Opt-out records: Retained indefinitely to ensure ongoing suppression.
• Campaign registration data: Campaign duration plus three (3) years after termination.
• Integration Data: Retained for the duration of the Customer relationship and deleted or returned upon termination, subject to legal hold or regulatory retention obligations.

5.3 Website Usage Data

Retained for up to twenty-four (24) months unless aggregated or anonymized for longer-term analytics.

5.4 Deletion Requests

To request deletion, see Section 6. We may retain certain information for legal, regulatory, or legitimate business purposes after receiving a deletion request.

6. Your Privacy Rights

6.1 California Residents (CCPA/CPRA)

California residents have the following rights under the CCPA/CPRA:

• Right to Know: Request disclosure of categories and specific personal information collected, sources, purposes, and third parties.
• Right to Delete: Request deletion of personal information, subject to exceptions.
• Right to Correct: Request correction of inaccurate personal information.
• Right to Opt Out of Sale/Sharing: ZipLingo does not sell personal information or share it for cross-context behavioral advertising.
• Right to Limit Sensitive Data Use: We limit use of sensitive personal information to CCPA-authorized purposes.
• Right to Non-Discrimination: We will not discriminate for exercising privacy rights.

Categories of PI Collected: Identifiers (name, email, phone, IP); commercial information (transactions, billing); internet activity (browsing, usage); geolocation (from IP); professional information (title, company).

To exercise your rights: Email privacy@ziplingo.com or call 888-245-3090. We respond within forty-five (45) days.

6.2 EEA, UK, and Swiss Residents (GDPR/UK GDPR)

Legal Bases for Processing: Contract performance (Article 6(1)(b)); legitimate interests (Article 6(1)(f)); consent (Article 6(1)(a)); and legal obligation (Article 6(1)(c)).

Your rights under GDPR include:

• Access: Receive a copy of your personal data.
• Rectification: Correct inaccurate or incomplete data.
• Erasure: Request deletion (“right to be forgotten”) under certain circumstances.
• Restriction: Restrict processing under certain circumstances.
• Data Portability: Receive data in a structured, machine-readable format.
• Object: Object to processing based on legitimate interests or for direct marketing.
• Withdraw Consent: Withdraw consent at any time without affecting prior processing.
• Lodge a Complaint: File a complaint with your supervisory authority.

International Transfers: We implement appropriate safeguards for transfers outside the EEA/UK/Switzerland, including EU Standard Contractual Clauses and the EU-U.S. Data Privacy Framework where applicable.

GDPR Inquiries: Email privacy@ziplingo.com with “GDPR Request” in the subject line.

6.3 Other Jurisdictions

We comply with applicable privacy laws where we operate. Contact privacy@ziplingo.com with questions about your jurisdiction.

7. Cookies and Tracking Technologies

• Strictly Necessary: Essential for Website functionality (session management, security). Cannot be disabled.
• Performance/Analytics: Help us understand visitor behavior and improve the Website.
• Functional: Remember preferences and settings.
• Marketing: Used for relevant advertising and campaign tracking.

Manage cookie preferences through your browser settings. Disabling cookies may affect functionality. Because we do not sell or share personal information for cross-context behavioral advertising, the Website does not currently respond to “Do Not Track” or Global Privacy Control signals.

8. Data Security

We implement commercially reasonable safeguards including: encryption of data in transit (TLS/SSL) and at rest; access controls; regular security assessments; employee training; and incident response procedures. No method of transmission or storage is completely secure; we cannot guarantee absolute security.

9. Children’s Privacy

ZipLingo does not knowingly collect personal information from children under 13 (or 16 in the EEA/UK). If we learn of such collection without parental consent, we will delete it promptly. Contact privacy@ziplingo.com if you believe we have collected information from a child. Our Services are directed at businesses, not children.

10. Third-Party Links

Our Website may link to third-party sites. This Privacy Policy applies only to our Website and Services. We encourage you to review third-party privacy policies.

11. Changes to This Privacy Policy

We may update this Privacy Policy from time to time. Material changes will be communicated to Customers via email at least thirty (30) days prior to taking effect. The revised version will be posted with an updated date. Continued use constitutes acceptance.

12. Contact Us

ZipLingo, LLC

Attn: Privacy

350 South 400 West, Suite 100

Lindon, UT 84042

Email: privacy@ziplingo.com

Phone: 888-245-3090

GDPR requests: privacy@ziplingo.com with “GDPR Request” in the subject line.

CCPA/CPRA requests: privacy@ziplingo.com with “California Privacy Request” in the subject line, or call 888-245-3090.