Privacy Policy

• Account information: email, password hash, and — if you choose to give them — full name and phone number.
• Signup context: how you heard about us (the dropdown, plus your text if you pick “Other”), whether you opted in to product emails, and the consent timestamp + IP required to evidence GDPR consent.
• API keys: stored only as SHA-256 hashes.
• Usage metadata: endpoint, status code, credits, response time, IP, user-agent.
• Authentication events: for each signup, login or password-reset attempt — including failed ones — we log the action, email used, IP, user-agent and outcome. This is what stops brute-force and bulk-signup abuse.
• Advertising attribution: if you arrive from an ad or an affiliate link, we store the click identifier, the advertising cookie value, and the IP and user-agent of that visit on your profile, so a later signup or purchase can be matched to the campaign. Kept only for that purpose.
• Payment metadata via Fungies, our merchant of record (we never see full card details — only the last four digits and a vault token Fungies holds).
• If you join the affiliate program: the details you enter in the application — name, business name, postal address, phone, email — and the payout details you provide (bank name, branch and account number, or IBAN). We need these to identify you and to pay you.

Essential — always set. Your authentication session, a one-time cookie that shows your fresh API key right after signup, your cookie choice itself (zooq_consent, kept 1 year), and zooq_ref — which affiliate referred you, kept 60 days. The affiliate cookie is first-party and set whatever you choose in the banner: it is how we pay the right person, and it is never shared with an advertising network.

Analytics and advertising. Google Tag Manager, Microsoft Clarity, the Meta Pixel and the TikTok Pixel, plus zooq_ttclid (the ad click that brought you here). These load unless you click Decline in the banner; Decline stops all of them and the ad-click cookie with them. We use an opt-out model: if you have not answered the banner yet, they are loaded.

Server-side ad measurement. When you sign up or buy, we may send that event to Meta or TikTok from our own servers so the campaign can be credited: your email address and user id in hashed (SHA-256) form, the ad click id, and the IP address and user-agent recorded at signup. Never if you declined cookies, and never your name, phone number or API usage.

Service delivery:

• Supabase Inc. — authentication and database (EU/US).
• Vercel Inc. — hosting (global edge network).
• Fungies (fungies.io) — merchant of record: payments, invoicing, and global tax compliance.
• Resend — transactional email.
• Data partners — third-party infrastructure for sourcing publicly available professional data.

Analytics and advertising — active only while you have not declined cookies:

• Google LLC — Google Tag Manager and the analytics tags it loads.
• Microsoft Corporation — Clarity (session analytics).
• Meta Platforms, Inc. — Meta Pixel and its conversions API.
• TikTok Technology Limited — TikTok Pixel and its Events API.
• Affiracle — affiliate network: credits the publisher who referred you, and records the order value of a purchase so their commission can be calculated.