Privacy Policy

1. About this policy

This policy explains how the operator of ZaPrompt collects and uses information in the ZaPrompt OnAir app, on zaprompt.com, and in its account, administration and support services. The service is identified as zaprompt.com. Its mailing address and verified privacy contact will be added before public launch. This is a pre-launch draft dated October 17, 2026, not an effective published policy.

2. Your scripts and local app data

The desktop app stores scripts, projects, formatting, private notes and playback settings in a local database on your device. Ordinary editing and local prompting do not require uploading your script library to our website. When you choose a talent display, the app sends the selected prompting output to that display, including over your local network. Only connect devices and networks you trust. Exported ZaPrompt documents can include private notes; plain-text exports omit notes and rich formatting. Your operating-system backups or cloud-synced folders may separately copy files under your own settings.

3. Account, trial and support information

When account services are enabled, we collect the name and email address you provide, an optional company name, email-verification records and account sessions. Trial signup records the follow-up consent text/version and time you agreed. Subscription licensing may also process installation identifiers, platform, app version and device authorizations. We use these details to verify accounts, provide requested trials, prevent repeated trial abuse, authorize app access and answer support requests. We do not require a phone number or postal address for a trial unless the checkout or applicable tax rules separately require it.

4. Support forum visibility

Questions, replies, chosen display names, dates and resolution status are visible to people who can access the public forum. Your account email address is not included in the public question listing. Do not post passwords, payment details, confidential scripts or other sensitive information. Posts may be moderated, hidden or removed for abuse or privacy reasons. Contact support to request correction or removal of a post.

5. Payments and subscriptions

When billing is enabled, Stripe processes checkout and payment details. ZaPrompt receives billing references and subscription information needed to provide access, including plan, status and paid-through dates; we do not receive your complete payment-card number through the planned hosted checkout. The checkout explains its own billing and tax requirements. Billing is not currently active in this local preview.

6. Security, service logs and bot checks

Hosting and application infrastructure may process IP addresses, browser and device information, request timestamps and security events to deliver the site, investigate problems and prevent abuse. When configured, Cloudflare Turnstile checks form submissions; the widget and verification service process technical signals under Cloudflare’s own privacy notice. Necessary security checks are not advertising tools. We will document any optional analytics or additional tracking before enabling it and obtain permission where required. The local preview does not contain advertising pixels.

First-party website reports count requests to a fixed list of public pages. These reports retain the page path, time, response status, general browser/device family and a visitor identifier derived from an address with a private key and the current UTC day. The identifier changes daily and is used for approximate visitor counts. Raw IP addresses, complete browser strings, account email addresses and URL queries are not stored in these reports. Report rows expire after 30 days. Hosting and security logs are separate from these reports.

7. Cookies and local preferences

Account sign-in uses a necessary session cookie. The public site saves your chosen interface language in browser local storage. Browser-based talent displays may store a device identifier and connection-related state so the operator can recognize and configure the display. These identifiers do not grant access to the full script library. Browser settings can remove cookies and local storage; doing so may sign you out or reset preferences.

8. Tour narration

When Google Cloud Text-to-Speech is configured, the site sends fixed public tour narration to Google to generate audio. A browser speech fallback uses voices provided by your browser or operating system; some voices may use the provider’s online services. This tour does not send your app scripts or private notes to Google. Administrator-entered voice-preview text is sent to the selected speech provider, so it should not contain confidential information.

9. Emails and your choices

A trial request requires a separate, affirmative agreement to one email following up about that trial. The checkbox is not selected in advance, and this is not permission for an unrelated newsletter. You can withdraw that permission through the follow-up email’s unsubscribe option or the verified privacy/support contact. Withdrawing does not cancel an already activated trial or paid subscription. Necessary account-verification, security and billing emails are separate service communications. No marketing or trial follow-up email has been enabled in this preview.

10. Service providers and disclosures

The intended services include Hostinger for hosting, Stripe for payments, Cloudflare for bot protection, Google Cloud for optional narration, OpenAI for the optional website assistant, and a configured transactional-email provider for account-verification and trial-delivery messages. We share only information needed for the enabled service. These providers may process information outside your country. Before launch, the operator must confirm providers, processing regions and any legally required transfer safeguards. We may disclose information when legally required, to investigate abuse or protect rights, or during a business transfer subject to applicable protections. We do not sell personal information or use it for targeted advertising in the current implementation.

11. Retention and deletion

We keep information for the purpose for which it was collected, then delete or de-identify it unless law, fraud prevention or an unresolved dispute requires retention. Local script retention is controlled by you. Sign-in links expire after a short period and are single-use; session credentials expire according to the configured account policy. Billing records may need longer retention for tax and accounting obligations. Support posts remain until removed or the forum closes. Verification links expire after 15 minutes and account sessions after seven days. Trial download-page links expire after the period configured when issued. Transactional email bodies are cleared after sending or final failure, and completed delivery metadata is retained for 30 days. Website activity rows and assistant summaries have separate 30-day retention periods. The operator must approve and implement the production retention schedule, backup-deletion cycle and deletion process before launch; this draft does not claim that an unimplemented automatic-deletion schedule exists.

12. Your rights and contact

Depending on your location and applicable law, you may request access, correction, deletion, a copy of your information, restriction of processing or withdrawal of consent, and may complain to a relevant regulator. We may need to verify your identity before responding. Some records must be retained for legal reasons. The operator’s verified contact and postal details are required before this policy becomes effective. This service is intended for adults and authorized business users, not for children. Contact the operator if you believe a child provided personal information.

13. Changes

The published policy will identify its effective date and version. Material changes will be communicated through the site or account where appropriate. We will not silently reinterpret a trial follow-up consent as permission for general advertising.

14. Optional website assistant

If you choose to use the website assistant, the site sends the message you enter and a limited amount of conversation history held in the current page to OpenAI to generate a response. Do not enter payment information, passwords, private scripts or other sensitive information. The assistant cannot access your account, local app scripts, billing controls or device. It answers product and support questions using the information made available to it.

Assistant requests use the OpenAI API with response storage disabled (store: false). This setting does not replace OpenAI’s own data-handling and retention policies. The operator stores a brief summary of the question and response for service reporting for up to 30 days, with potentially identifying details minimized or redacted. The local service does not store the full conversation transcript. Limited in-page conversation history is held only for the current page session. These reports help the operator understand common questions and improve documentation and support; they are not used to access customer accounts.