Privacy policy

The controller for the product is SIMPS LTD (trading as Zap Trades), company number 17432160, registered office The Lake Lodge, Foggathorpe, Selby, YO8 6PZ. ICO registration is pending. Contact hello@zaptrades.co.uk.

A firm that signs up is a controller for its own customers, callers and staff. SIMPS LTD (trading as Zap Trades) processes that data on the firm’s instructions. The data processing addendum sets that out.

What is stored

Account details, business name and address, staff names and pay rates, customers, jobs, receipts and photos, clock-in locations, call summaries, and the questions sent to Ask Zap. Passwords are stored as a hash. Card numbers are handled by Stripe and are not stored here. Bring-your-own API keys and telephony tokens are encrypted before they are written down.

Why

To provide the account, answer the phone, keep job records, and take payment. The lawful bases are contract, and legitimate interests in keeping the service secure. Call recording and the AI receptionist are disclosed at the start of the call. Marketing email is not sent.

Processors

• Hetzner — the server that hosts the application and the database, in the European Union.
• Google Gemini — Ask Zap and reading receipt photos, when a key is configured. Questions and images are sent to Google for that reply.
• OpenAI or Anthropic — only when the firm saves its own key in Settings. The question, and any photo, is sent to that provider. The key is stored encrypted.
• xAI — the AI receptionist. The caller’s audio and the business greeting are sent so the call can be answered.
• Twilio — UK phone numbers, call routing and the regulatory bundle.
• Stripe — subscriptions, invoices and card payments.
• Resend — email for welcome messages, address checks, password resets, staff invites, trial reminders and payroll exports. If email is not configured, those messages stay on the account.
• Cloudflare — DNS and email routing for the domain.
• OpenStreetMap Nominatim — address search. The place name or postcode is sent so a pin can be dropped. No account key is used.

International transfers

The application and the database are hosted by Hetzner in the European Union. xAI, Twilio, Stripe, Google and Resend process data in the United States. Those transfers use the UK International Data Transfer Agreement, or the UK Addendum to the EU standard clauses, and the UK-US data bridge where it applies to that provider. A firm that saves an OpenAI or Anthropic key sends the assistant question to that provider, which may also be in the United States, on the same basis. Cloudflare handles DNS and email routing. Nominatim may be contacted from outside the UK.

Cookies

The only cookie is app_session. It keeps you signed in. It is essential, HttpOnly, and SameSite Lax. There are no analytics or advertising cookies, so there is no consent banner.

How long, and your rights

Account data stays until the firm owner deletes the account, or asks for it to be deleted. A copy can be downloaded from Settings. You can ask for access, correction, erasure, restriction, and a copy to take elsewhere. Complaints can go to the ICO at ico.org.uk. Call audio is summarised into the enquiry. The summary is part of the firm’s records.