ZipWP, a product of Brainstorm Force
This policy explains what personal data ZipWP collects when you build a website with us, why we collect it, who we share it with, and the choices you have. It is written from a codebase-level audit of what our systems actually do, not a template.
Section 1. Introduction and Scope
This policy applies to the ZipWP platform (app.zipwp.com, zipwp.com). It covers the personal data of people who create a ZipWP account, the teammates they invite, and visitors to zipwp.com itself.
Websites built with ZipWP run a small ZipWP-maintained plugin. That plugin does not collect personal data from visitors to those websites. The one exception: unclaimed free-tier sites show a visitor-facing access page that sets a single, non-identifying cookie so a returning visitor is not shown it twice (see Section 5).
Section 2. Information We Collect
Account information: name, email address, password (stored as a one-way hash), company name, avatar, timezone, and language preference.
Google sign-in: if you create your account with Google, we receive your name, email address, and profile photo from Google.
Team information: your team’s name and the email address of anyone you invite, stored from the moment the invitation is sent.
Site and business content: the business name, description, category, contact details (email, phone, address), and social profile links you provide while building a site, plus any images you upload.
AI conversation history: the messages you send to our AI site-building tools and the responses they generate, stored so you can pick up a session later.
Payment information: our payment processor, SureCart, collects your billing name and email directly. ZipWP does not receive or store your card number.
Support requests: if you contact support, we store your message, your email address, and an automated classification of the request so it reaches the right person quickly.
Device and usage data: IP address, browser, device type, and session activity, collected for security and to keep the product working reliably.
Section 3. AI-Powered Site Building
Our AI site-building tools send what you type, along with relevant business details you have entered, to a third-party AI provider, which generates content, layouts, and design suggestions on your behalf.
We primarily use OpenAI to process these requests. If OpenAI is unavailable, we automatically fall back to an alternate provider, currently Groq or Google Gemini, so the feature keeps working. The same data is sent to whichever provider handles the request.
These providers process your input only to return a response to that request. Because AI generation is core to how these tools work, there is currently no way to use them without this processing taking place. Your conversation history is stored in your ZipWP account so you can return to a session later.
Section 4. How We Share Information
We share the minimum information each provider needs to do its job. We do not sell your personal information.
| Provider | Purpose | Data Shared |
| SureCart | Payment processing | Billing name, email, subscription details |
| Openprovider, ResellerClub | Domain registration and business email | Name and email address. A ZipWP-managed address and phone number are used for registration instead of yours. |
| Cloudflare, Bunny, Vultr, Hetzner, UpCloud | Hosting and DNS infrastructure | Domain name, site files |
| OttoKit | Marketing preference sync | Name, email, subscription status |
| Meta | Advertising and ad measurement | Page visits and actions (views, add-to-cart, checkout started, purchase), plus your IP address and browser/device identifiers, shared unhashed. See below. |
| Google Ads | Advertising measurement | Page visits and conversion actions (signups, purchases) |
| Microsoft Advertising (Bing) | Advertising measurement | Page visits and conversion actions (signups, purchases) |
| Twitter/X | Advertising measurement | Page visits and conversion actions (add-to-cart, checkout, purchase) |
| Quora | Advertising measurement | Page visits and purchase events |
| Advertising measurement | Page visits and conversion events | |
| PostHog, Sentry, Microsoft Clarity | Product analytics and reliability monitoring | Usage events, error reports, session interactions |
| Sigmize | A/B testing, used occasionally on our pricing page | Usage and interaction data |
| ConvertBox | Exit-intent messages and info bars | Usage data, and any information you submit through a ConvertBox message |
| PowerfulDocs | AI chat assistant trained on our help documentation | The messages you send to the chat assistant |
| Pexels, Unsplash, Pixabay | Stock imagery search | Search terms only. No personal data is shared. |
| FreeScout | Customer support | Your support messages and email address |
Meta: in addition to a standard tracking pixel that runs on all pages to measure ad performance, we send your IP address and browser or device identifiers directly to Meta through its Conversions API on pricing-related pages. Meta’s own systems require these identifiers in their original, unhashed form to match them against its records, so they are not hashed before being sent. You can opt out of this and the other advertising trackers listed above at any time through your cookie preferences.
Section 5. Cookies and Tracking Technologies
We use a small number of first-party cookies to run the product, plus a few third-party cookies for analytics and measurement.
First-party cookies:
| Cookie | Purpose |
| Session and XSRF token | Keeps you signed in |
| UTM attribution | Remembers how you first found ZipWP |
| Signup source | Records which channel you signed up through |
| Currency and language preference | Remembers your pricing currency and site language |
| Exit-feedback shown | Avoids asking for feedback twice |
| Authentication and onboarding redirects | Carries you through sign-up and plugin-connect steps |
Websites built with ZipWP that are still on the free, unclaimed tier show visitors a temporary-access page. Clicking through sets a single cookie (a random, non-identifying token) on the visitor’s browser so they are not shown the page again. This cookie stays on the built site only and is never sent to ZipWP.
Third-party cookies
| Provider | Purpose |
| Microsoft Clarity | Session-replay analytics, to see how the product is used |
| Sigmize | A/B testing of pages and features |
| SureCart Affiliates | Attributes signups to affiliate partners |
| Meta, Google Ads, Microsoft Advertising, Twitter/X, Quora, Reddit | Advertising measurement. See Section 4 for details. |
| SureCookie | Remembers your cookie preferences |
| Google Tag Manager | The tool we use to manage the trackers listed above |
Find details of cookies, we use, here.
Section 6. Data Retention
Site lifecycle. Free sandbox sites follow a predictable schedule: a site goes inactive one day after creation if not reserved, its files and DNS record are removed about a week later, and its remaining record is permanently purged from our database 30 days after that. It is roughly 34 days from creation to complete removal, with no manual step required on your part.
Operational logs. Email delivery logs are kept 60 days; site activity logs, 120 days, long enough to diagnose a problem, short enough that we’re not holding operational data indefinitely. Accounts that never verify their email are removed after one year.
When you delete your account, it’s deactivated immediately and inaccessible to you or anyone else. Your account record and related data are soft deleted immediately. To prevent someone from deleting an account solely to bypass free-plan limits and re-signing up, we intend to retain the deleted email, not linked to your name or site content. We keep this data for abuse detection only.
Section 7. Your Rights and Choices
Access and correction: update your account details at any time from your profile settings.
Deletion: delete your account directly from Account Settings.
Portability: request a copy of your data at any time by writing to us at [email protected]. Your request is sent to us automatically, and we provide your data in response.
Marketing preferences: unsubscribe from marketing email at any time. Your preference is synced across our systems.
Opt-out of ad measurement: you can stop data sharing with Meta, Google Ads, Microsoft Advertising, Twitter/X, Quora, and Reddit at any time through your cookie preferences. See Section 4 for details on what each of these receives.
No sale of data: aside from the advertising transfers described in Section 4, we do not sell your personal information to third parties.
Erasure exception: aside from a hashed, non-reversible copy of your email address retained to prevent free-tier abuse (see Section 6), all other account data is permanently deleted or anonymized 30 days after account deletion.
Section 8. International Data Transfers
Our infrastructure and service providers operate in multiple countries, including the United States. Where we transfer personal data from the UK or EU to a country without an equivalent adequacy decision, we rely on Standard Contractual Clauses or an equivalent safeguard with that provider.
Section 9. Data Security
We encrypt data in transit using HTTPS, store passwords as salted one-way hashes, and rely on our payment processor’s tokenized card handling so that card numbers never reach our servers. Access to production data is limited to personnel who need it to operate the service.
Section 10. Children’s Privacy
ZipWP is not directed at children, and we do not knowingly collect personal information from anyone under the age of 16. If you believe a child has provided us with personal information, please contact us and we will remove it.
Section 11. Changes to This Policy
We will update the date at the top of this page whenever this policy changes, and we will notify you by email or an in-app notice if a change is material, for example, if we add a new AI provider or begin sharing data with a new category of third party.
Section 12. Contact Us
Questions about this policy or your data can be sent to [email protected]. This service is operated by Brainstorm Force US LLC, 2093 Philadelphia Pike #3090, Claymont, Delaware 19703.
