Privacy Policy

Zaptrom is operated by Heřman Tajovský, Hornomlýnska 1136/8, Czech Republic ("Zaptrom", "we", "us"). You can reach us at support@zaptrom.com for any question about this policy or about your personal data.

This policy applies to the Zaptrom web application, its associated backend services, and any support communication connected with your use of Zaptrom. It does not apply to third party websites or services that you may reach through links inside Zaptrom.

• Zaptrom lets you connect your own Gmail, Microsoft/Outlook or SMTP mailbox and send outreach from it. We do not send your outreach for you through a separate mail system.
• We use a third party provider, Resend, only for Zaptrom's own transactional email to you, such as sign-up confirmation, password reset and billing notices. Resend never sends your outreach.
• We store the lead and company data you import or generate, so you can manage your outreach and pick up where you left off.
• AI Lead Finder uses third party AI and web data services to help you discover and research leads. You always review AI output before you act on it.
• Card payments are handled entirely by Stripe; we never receive or store your card number.
• You can disconnect a connected mailbox, delete companies or projects, and request deletion of your account at any time.

This summary is for convenience only. The full sections below are what actually governs how we handle your data.

Data protection law distinguishes between a controller, who decides why and how personal data is processed, and a processor, who processes personal data on the controller's instructions.

For account data, authentication data, billing data and usage data, Zaptrom is the controller: we decide why this data is processed, because it is needed to operate the service and your account.

For the lead and company data that you import, add manually or generate through AI Lead Finder, you are the controller and Zaptrom acts as a processor on your behalf. You decide which contacts to collect, what to store about them, and what outreach to send them. You are responsible for having a lawful basis to process that data and for complying with applicable law, including data protection and anti-spam rules, in respect of your recipients.

Depending on how you use Zaptrom, we process the following categories of personal data.

We use personal data for the following purposes, and rely on the legal bases indicated.

• To create and operate your account, authenticate you, and provide the core functionality of Zaptrom: performance of the contract with you.
• To let you import, organise and act on lead and company data, and to send outreach through your connected mailbox: performance of the contract with you, with you acting as controller of that data.
• To run AI Lead Finder searches and generate AI drafts, scores and research: performance of the contract, at your request.
• To send transactional email such as sign-up confirmation, password reset, invitations and billing notices: performance of the contract and, where applicable, our legitimate interest in keeping you informed about your account.
• To process payments and manage your subscription: performance of the contract and compliance with accounting obligations.
• To keep Zaptrom secure, prevent abuse and enforce our terms: our legitimate interest in protecting the service, our users and third parties.
• To run optional analytics: your consent, which you can withdraw at any time.
• To respond to support requests: performance of the contract and our legitimate interest in resolving issues you raise.
• To comply with legal obligations, such as accounting or responding to lawful requests from authorities.

It matters to us that this is clear, because Zaptrom uses two separate email paths that should never be confused.

When you connect a mailbox, we store what is needed to send on your behalf, and we describe below exactly what that is and how it is protected.

• OAuth access tokens and refresh tokens for Gmail and Microsoft connections, and passwords for SMTP connections, are stored in our database encrypted at rest using AES-256-GCM. The encryption key exists only as a server-side secret and is never sent to your browser.
• Where you connect by SMTP, Zaptrom does store an encrypted copy of the SMTP password you provide, so that it can authenticate to your mail server on your behalf when sending.
• Gmail connections use a send-only permission scope, meaning Zaptrom cannot read the contents of your Gmail mailbox.
• Microsoft connections require permission to create and send mail (Mail.Send and Mail.ReadWrite), because outreach is created as a draft message and then sent. Zaptrom uses this permission only to create, send and verify the messages it sends on your instruction, and does not browse or index your Microsoft mailbox.
• For both providers we also read basic mailbox metadata: the connected email address and its display name.
• You can disconnect a connected account at any time from Settings, and you may connect more than one account.

AI Lead Finder (currently in beta) helps you discover and research public business information using a combination of third party services: Perplexity for discovery, Firecrawl for website verification, and Google Gemini models, accessed through an AI gateway, for enrichment, scoring and drafting outreach messages.

To provide these features, the search queries you submit, the candidates discovered, confidence data, sources, AI-generated drafts, research summaries and scores are sent to and processed by these providers, and are stored in Zaptrom so that a run can be resumed and reviewed later.

AI Lead Finder is a beta feature. AI-generated content, scores and research summaries are suggestions that you should review before you rely on or send them.

Where you enable it, outreach can include an open-tracking pixel served from zaptrom.com. This records that a message has been opened, together with a coarse timestamp; readable IP addresses are not retained for this purpose.

Every outreach message sent through Microsoft carries List-Unsubscribe headers, and outreach generally includes a working unsubscribe link. When a recipient unsubscribes, we store that request so the address can be suppressed from future outreach sent through Zaptrom.

Work in Zaptrom is organised into projects. Each project has an owner and may have invited members with a role, such as editor or viewer. Row Level Security enforced in our database restricts access to a project's data to its owner or an accepted member; this is enforced on the server, not only in the app interface.

If you use our in-app AI assistant or contact us by email, the content of that conversation is stored so we can assist you and reference it in future correspondence.

We distinguish between cookies and local storage that are necessary for Zaptrom to function, and optional analytics that only run with your consent.

Zaptrom offers a Free plan (0 USD), a Pro plan (12 USD per month) and a Team plan (39 USD per month), billed monthly or annually. All payment processing and card data handling is carried out entirely by Stripe; Zaptrom never receives or stores your card number.

Zaptrom does store your subscription status, plan, current billing period end date, and the Stripe customer and subscription identifiers needed to manage your account.

Discovery Credits are used to run AI Lead Finder searches: one credit equals one complete search. The Free plan includes 1 credit, Pro includes 30 per month, and Team is unlimited. Monthly allowances reset each calendar month and unused monthly credits do not roll over. Separately purchased credit packs (25, 50 or 100 credits) do not expire and are only used after the monthly allowance is exhausted. Failed searches are refunded automatically.

If you cancel a paid plan, it remains active until the end of the paid period and then falls back to Free. Exceeding a plan limit never deletes or locks your existing data; it only prevents creating new projects until you upgrade or free up capacity.

We rely on the following categories of third party providers to operate Zaptrom. Each processes personal data only to the extent necessary to perform its function for us.

Supabase

our backend platform, used for authentication, database storage and enforcement of access rules (Row Level Security).

Resend

used to send Zaptrom's own transactional email to you, such as confirmations, password resets and billing notices. Never used for your outreach.

Google (Gmail OAuth, Google sign-in)

used for Google sign-in and for send-only Gmail connections used in your outreach.

Microsoft (Microsoft Graph API)

used for Microsoft/Outlook mailbox connections used to create and send your outreach.

Perplexity

used by AI Lead Finder for discovery of public business information.

Firecrawl

used by AI Lead Finder to verify information found on company websites.

Google Gemini (via an AI gateway)

used for AI enrichment, lead scoring and drafting of outreach messages.

Stripe

used to process payments and manage subscriptions; handles all card data.

Google Analytics

used for optional analytics, only after you consent through the cookie banner.

Plausible

used for privacy-friendly, aggregate analytics without cross-site tracking.

Some of the providers listed above may process personal data outside the European Economic Area. Where that happens, we rely on the transfer mechanisms those providers make available, such as the European Commission's standard contractual clauses, to ensure an appropriate level of protection for the data transferred.

We keep personal data for as long as your account is active and the purpose for which it was collected still applies. You can delete companies, projects and connected accounts yourself, at any time, from within Zaptrom.

Where we need to keep certain records for longer, for example for accounting purposes, to maintain security, or to establish or defend a legal claim, we may retain that limited data even after you delete other information or your account.

You can delete individual companies, projects and connected mailbox accounts yourself at any time from within the app.

To delete your entire account, contact support@zaptrom.com. We will remove your account and its project data from our live systems without undue delay, subject to the limited retention described in the section above.

Zaptrom is built with privacy and data protection in mind, and we take the measures described below to protect the personal data we process.

• Encryption in transit using TLS.
• Encryption at rest of connected mailbox credentials (OAuth tokens and SMTP passwords) using AES-256-GCM, with the encryption key held only as a server-side secret.
• Row Level Security applied on every application database table, so access is restricted at the database level, not only in the app interface.
• Server-side authorisation checks on every API route.
• Rate limiting on sensitive endpoints to reduce the risk of abuse.
• Logging of repeated denied requests using hashed IP addresses, for abuse detection.
• Validation of imported files by file extension, file size (5 MB maximum) and content sniffing, to reduce the risk from malformed or malicious uploads.

No system can be made completely risk free. We continue to review and improve these measures over time.

If you are located in the European Economic Area or the United Kingdom, data protection law gives you the following rights in relation to personal data for which Zaptrom is the controller.

• Access: to obtain confirmation of, and a copy of, the personal data we hold about you.
• Rectification: to have inaccurate or incomplete personal data corrected.
• Erasure: to have your personal data deleted in certain circumstances.
• Restriction: to have processing of your personal data limited in certain circumstances.
• Objection: to object to processing carried out on the basis of legitimate interest.
• Portability: to receive certain personal data in a structured, commonly used format.
• Withdrawal of consent: to withdraw consent at any time, for processing based on consent, such as optional analytics.

To exercise any of these rights, contact us at support@zaptrom.com. Where you act as the controller of lead or company data you have imported into Zaptrom, requests concerning that data from a third party should generally be directed to you as the controller, and we will assist you as our processor where required.

We would appreciate the chance to address any concern directly, at support@zaptrom.com. You also have the right to lodge a complaint with a supervisory authority, in particular in the European Union or European Economic Area member state of your habitual residence, place of work or place of the alleged infringement.

In the Czech Republic, the competent supervisory authority is the Office for Personal Data Protection (Úřad pro ochranu osobních údajů), www.uoou.cz.

Zaptrom is a business tool and is not directed at children. It is not intended for use by anyone under the age of 16, and we do not knowingly collect personal data from children.

AI Lead Finder produces AI generated scores, confidence indicators and draft messages to help you prioritise and prepare outreach. These outputs are suggestions only; they do not have any legal effect on you or on the companies and contacts they describe, and Zaptrom does not use them to make any decision about you.

A human, namely you, always reviews AI output and decides whether and how to act on it, including whether to send any message. Zaptrom does not carry out solely automated decision-making that produces legal or similarly significant effects.

We may update this Privacy Policy from time to time, for example to reflect changes to Zaptrom or to the providers we use. We will update the date at the top of this page when we do. If a change is significant, we will make reasonable efforts to bring it to your attention, such as by email or an in-app notice.

If you have any question about this Privacy Policy or about how Zaptrom handles your personal data, please get in touch.