ZipZy® Cookie Policy

This Policy covers:

• zipzy.in, zpzy.in, and their subdomains, including marketing pages, documentation, the application dashboard, and the payments portal.
• ZipZy® mobile and desktop applications, where equivalent storage and identifier technologies are used.
• Redirect infrastructure that resolves shortened links and QR codes.

It does not cover third-party websites you reach through a ZipZy® link, which have their own policies.

2.1 Cookies are small text files stored on your device by a website. First-party cookies are set by the domain you are visiting; third-party cookies are set by another domain.

2.2 Similar technologies include:

Throughout this Policy, “cookies” refers to all of the above.

3.1 Strictly Necessary Cookies

Required for the Services to function. These cannot be disabled through our consent banner because the Services cannot operate without them.

Purposes: authentication and session management; maintaining login state across pages; CSRF protection; load balancing and request routing; storing your cookie consent choices; enforcing rate limits; fraud and bot detection; secure checkout flow with our payment provider.

Legal basis: necessary for the performance of the contract and for security; consent is not required under the DPDP Act or the GDPR/ePrivacy framework for strictly necessary cookies.

3.2 Functional Cookies

Remember your choices and improve usability.

Purposes: language and locale; timezone; theme and display density; last-used workspace; dismissal of banners, tours, and announcements; support chat widget continuity; saved table filters and column layouts.

Effect if disabled: the Services remain usable but preferences reset on each visit.

3.3 Analytics and Performance Cookies

Help us understand how the Services are used so we can improve them.

Purposes: page and feature usage counts; navigation paths; time on page; funnel completion; error and crash reporting; performance and latency measurement; A/B test assignment.

We configure analytics with IP truncation or hashing and do not use analytics data to build advertising profiles.

3.4 Security Cookies

Protect Accounts and infrastructure.

Purposes: detecting credential-stuffing and brute-force attempts; bot and automation detection; challenge and CAPTCHA state; anomaly detection on session reuse; Cloudflare edge security cookies used to distinguish legitimate traffic from attack traffic.

Security cookies are treated as strictly necessary.

3.5 Advertising and Marketing Cookies

Used only on our public marketing pages, and only where you consent.

Purposes: measuring the effectiveness of marketing campaigns; attributing sign-ups to a campaign source; suppressing ads shown to existing customers; audience building for business-to-business advertising on third-party platforms.

We do not place advertising cookies inside the authenticated application, on the payments portal, or on link redirect infrastructure.

4.1 Banner. On your first visit we present a consent banner offering, with equal prominence, the options to accept all, reject all non-essential, or manage preferences by category.

4.2 Standard. Non-essential cookies are set only after you take an affirmative action. We do not use pre-ticked boxes, and we do not treat scrolling, continued browsing, or closing the banner as consent.

4.3 Withdrawal. You may change or withdraw consent at any time from the Cookie Preferences link in the site footer and in your account settings. Withdrawal takes effect immediately for future processing; cookies already set in the withdrawn categories are cleared where technically possible, and you may also clear them through your browser.

4.4 Records. We record the timestamp, consent string, banner version, and choices made for each consent event, and retain those records for the processing period plus seven years, consistent with the Privacy Policy.

4.5 Re-prompting. We will ask again when the set of categories or vendors changes materially, and in any event no more than once every 12 months.

Actual lifetimes for each individual cookie, including its name, provider, and purpose, are listed in the Cookie Preferences centre, which reflects the live inventory.

6.1 Our preference centre is the most precise way to control non-essential cookies on ZipZy® properties.

6.2 Browser controls. All major browsers allow you to view, block, and delete cookies through their settings. Blocking strictly necessary cookies will prevent you from logging in.

6.3 Mobile devices. Operating system settings allow you to reset or limit advertising identifiers.

6.4 Third-party opt-outs. Analytics and advertising providers generally offer their own opt-out mechanisms, linked from the preference centre.

When an End User opens a shortened link, scans a QR code, or visits a landing page or link-in-bio page created by a ZipZy® Customer:

• We set only strictly necessary and security cookies required to resolve the request, prevent abuse, and count the interaction.
• Analytics for these resources are recorded server-side on behalf of the Customer, who is the Data Fiduciary/Controller for that data.
• If a Customer adds its own tracking scripts or pixels to a hosted page, that Customer is solely responsible for obtaining consent and providing notice to its visitors. We require this under the Terms of Service and the Data Processing Addendum.

There is no uniform industry standard for Do Not Track browser signals, and we do not currently respond to them. Where we detect a Global Privacy Control (GPC) signal, we treat it as a valid request to reject non-essential cookies for that browser.

We update this Policy when our cookie inventory or legal obligations change. The live per-cookie inventory in the preference centre is authoritative for names and lifetimes. Material changes will be notified and, where required, fresh consent obtained.

Questions about this Policy: privacy@zipzy.in

Privacy Team: privacy@zipzy.in

Grievance Officer: grievance@zipzy.in