Privacy Policy

This policy separates two different situations:

• A. Information ZAPMICRO collects directly from MYZAP account holders — the shop owners, administrators and staff who sign in to MYZAP. Here ZAPMICRO decides why and how the data is used.
• B. Information merchants enter into MYZAP about their own customers, suppliers and staff. Here the merchant decides why and how the data is used; ZAPMICRO stores and processes it on the merchant's behalf to run the service.

If you are a shopper whose details appear in a MYZAP bill, the shop that billed you is your first point of contact. We will assist that shop in responding to your request.

Account information: name, email address, mobile number, password (stored only in hashed form), profile photo where provided, role and permissions.

Business information: shop name, address, GSTIN and tax settings, logo, branches, plan and subscription details, invoices issued to you and payment status.

Device and browser information: device type, operating system, browser version, screen size, app installation status and language.

Logs and security information: IP address, timestamps, sign-in and sign-out events, actions performed in the app, error and crash diagnostics.

Support communications: messages, attachments and call notes when you contact us.

Merchant-entered records (category B): customer names, phone numbers and addresses, order and invoice history, credit balances, delivery details, supplier details and staff records that merchants add to their MYZAP workspace.

• To create and operate your MYZAP account and workspace
• To provide billing, inventory, reporting and other product features
• To process subscriptions, payments, renewals and invoices
• To provide customer support and respond to your requests
• To keep the platform secure, detect abuse and prevent fraud
• To diagnose faults, improve reliability and develop the product
• To send service, billing and security notifications
• To meet legal, tax and record-keeping obligations

We do not sell personal data. We do not use merchant-entered customer records for our own marketing.

Where Indian data-protection law applies, we process personal data on the basis of consent given at the time of collection, or for legitimate uses permitted by law — for example performing our contract with you, complying with legal obligations, and protecting the security of the service.

Where processing is based on consent, you may withdraw that consent at any time using the grievance contact below. Withdrawal applies going forward and may mean we can no longer provide part or all of the service. Merchants are responsible for obtaining any consent or giving any notice required for the personal data they enter into MYZAP.

For data in category B, ZAPMICRO acts on the merchant's documented instructions: we store it, make it available in the merchant's workspace, back it up, and delete or export it when the merchant asks or when the account ends, subject to legal retention requirements.

Merchants must ensure they have lawful authority to collect and use this data and must not upload sensitive personal data that they are not entitled to process.

We share data only as needed, with categories of providers such as:

• Cloud hosting, database and storage providers
• Payment gateways and billing partners
• Email, SMS and WhatsApp message delivery providers
• Analytics and error-monitoring services
• AI services used for optional insight features

These providers are engaged under contractual obligations to protect data and use it only to provide their service to us. We may also disclose data where required by law, court order or a lawful request from a competent authority, or to establish or defend legal claims.

MYZAP data is stored on managed cloud infrastructure. Some providers may process or back up data outside India; where that happens, we take reasonable steps consistent with applicable law and any restrictions notified by the Government of India regarding cross-border transfers.

We apply reasonable technical and organisational measures, including encryption of data in transit, hashed passwords, row-level access controls in the database, role-based permissions, audit logging and restricted administrative access. No internet-connected system can be described as absolutely secure, and we do not claim to be 100% secure. Your own account practices — described in Security & Account Responsibility — are an essential part of keeping your data safe.

If a personal data breach occurs, we will investigate, take steps to contain and remediate it, and notify the affected users and the Data Protection Board of India where and as required by applicable law, within the timelines prescribed. Merchants will be informed of breaches affecting data they hold in MYZAP so that they can meet their own obligations.

We keep personal data for as long as your account is active and for as long as necessary for the purposes described above.

• Account and workspace data: for the life of the account
• Invoices, tax and accounting records: for the period required under applicable tax and company law
• Security and access logs: for a limited period appropriate to security needs
• Data after account closure: deleted or anonymised within a reasonable period, except where retention is legally required

MYZAP uses cookies and browser storage that are necessary to operate the service — for example to keep you signed in, remember your active shop, store your theme preference and protect against abuse. Where optional analytics storage is used, it is limited to understanding product usage and reliability.

You can clear or block browser storage at any time, but doing so may sign you out and can remove unsynchronised offline data.

When you install MYZAP as an app or use offline mode, some business data — products, customers, pending bills and settings — is cached on your device (for example in IndexedDB and local storage) so that billing can continue without a connection. This data stays on your device until it is synchronised or cleared. Allow synchronization to complete before clearing app data, uninstalling the app or resetting the device, otherwise unsynchronised records may be lost.

Subject to applicable law, including the Digital Personal Data Protection Act, 2023 and the applicable Digital Personal Data Protection Rules, 2025 (as and when the relevant provisions commence), you may:

• Ask what personal data we hold about you and how it is processed
• Ask us to correct or update inaccurate or incomplete data
• Ask us to erase data that is no longer needed for a lawful purpose
• Withdraw consent where processing is based on consent
• Nominate another person to exercise your rights in case of death or incapacity
• Raise a grievance with us and, if unresolved, with the Data Protection Board of India

You can update most account details directly in Settings. For other requests, use the grievance contact below. We may need to verify your identity before acting, and some data may be retained where the law requires it. If your request concerns records held by a shop that uses MYZAP, we will forward it to that shop.

MYZAP is a business tool and is not directed at children. Accounts must be created by individuals who can enter into a binding contract. We do not knowingly collect personal data of children for our own purposes; where processing of a child's data would be required by applicable law to be based on verifiable parental consent, merchants must ensure that consent exists before entering such data. If we become aware that a child's data has been collected by us without a lawful basis, we will delete it.

This policy is versioned. When it changes, we update the version number and date at the top of this page, and we notify account holders of material changes where required by applicable law. Publishing this page does not by itself constitute a claim of full legal compliance; compliance is an ongoing programme.

To exercise your rights or raise a privacy concern, contact our grievance contact below. We will acknowledge your request and respond within the timelines required by applicable law. If you are not satisfied with our response, you may escalate to the Data Protection Board of India.