Privacy Policy

Zaprep ("we", "our", "us") operates zaprep.com, a social media automation platform. This policy explains what data we collect, why, and how we protect it. Zaprep currently integrates with Instagram and Facebook Messenger (via Meta). We are adding an integration with TikTok, and the TikTok terms in this policy apply once that feature is available to you.

• Account data: email address and hashed password when you sign up.
• Social account data: your Instagram Business account ID, username, and an encrypted access token obtained via Meta OAuth. We never store your Instagram password.
• TikTok account data: only if you connect TikTok: your TikTok open ID, display name and profile avatar; profile details (bio, profile link and verification status); account statistics (follower count, following count, total likes and video count); and metadata for your public videos (such as title, thumbnail, creation date and public view, like, comment and share counts). We also store an encrypted access token and refresh token issued by TikTok. We never receive or store your TikTok password.
• Automation data: rules you configure, comment/DM trigger events received via Meta Webhooks, and message delivery logs.
• Contact data: email addresses voluntarily provided by your followers through DM flows you create.
• Billing data: subscription status from our billing provider. We do not store full payment card details — those stay with the payment processor.
• Usage data: page views and feature usage for product analytics (no third-party tracking scripts).

• Authenticate you and protect your account.
• Send automated replies on your behalf via the Meta Graph API.
• Show your connected TikTok account's profile information, statistics and public videos in your Zaprep dashboard, so you can analyze performance and manage your automation workflows.
• Deliver collected contact emails to you through the Contacts dashboard.
• Process billing and manage your subscription.
• Improve the platform based on aggregate, anonymised usage patterns.

We do not use TikTok data for advertising, we do not sell it, and we do not use it to train machine-learning or AI models.

We do not sell your data. We share data only with:

• Meta Platforms: to send messages and read webhooks on your behalf.
• TikTok: to authenticate you through TikTok Login Kit and retrieve the data you authorize via TikTok's APIs.
• Payment processors: to process payments.
• AWS: cloud infrastructure (database, compute).

We do not share your TikTok data with any other third party, except AWS, which hosts our infrastructure, and where required by law.

We request the following Meta permissions: instagram_basic, instagram_manage_messages, instagram_manage_comments, pages_show_list, pages_read_engagement, pages_manage_metadata, pages_messaging. These are used solely to operate your automation rules. You can revoke access at any time from your Instagram account settings or from the Zaprep Settings page.

When the TikTok integration becomes available and you choose to connect your TikTok account, Zaprep will use TikTok Login Kit and the TikTok Display API. TikTok shows you a consent screen listing the permissions we request, and you can approve all of them or only some. We will request these read-only scopes:

• user.info.basic: your open ID, avatar and display name, used to show which TikTok account is connected.
• user.info.profile: your bio, profile link and verification status, used to display your profile details and link to your TikTok profile in Zaprep.
• user.info.stats: your follower, following, likes and video counts, used to show account statistics in your dashboard.
• video.list: your public videos, used to list your videos and their public metrics for analysis and automation.

These permissions are read-only. Zaprep does not use them to post, edit or delete content on your TikTok account. TikTok access and refresh tokens are encrypted at rest. You can disconnect TikTok at any time from Zaprep Settings → Integrations → Disconnect TikTok, or by removing Zaprep from your TikTok account's connected apps settings. Your use of TikTok is also governed by TikTok's own Terms of Service and Privacy Policy. Zaprep is not affiliated with or endorsed by TikTok.

We retain your data for as long as your account is active. If you disconnect TikTok, we delete your TikTok tokens and stored TikTok data within 30 days. On account deletion, your personal data, access tokens, automation rules, stored TikTok data, and collected contacts are permanently deleted within 30 days.

Access tokens are encrypted at rest using AES-256-GCM. Passwords are hashed with bcrypt (cost 12). All data in transit is protected by TLS.

Depending on your jurisdiction you may have rights to access, correct, or delete your data. Email us at support@zaprep.com to exercise these rights. You can also revoke Zaprep's access to your TikTok data at any time from your TikTok app settings or from Zaprep Settings.

Zaprep is not directed at children under 13. We do not knowingly collect their data.

Material changes will be announced by email or in-app notice at least 7 days before they take effect.