Privacy Notice
Version 1.0 · effective 11 November 2026
This notice explains which personal data is processed when you use ZERPY, why and for how long, and what rights you have.
Who we are
Giffi OÜ (registry code 12483222, Erna põik 12, 76907 Suurupi, Estonia) provides the ZERPY service. For privacy questions, write to hi@giffi.ee.
We have two roles:
- Controller — for user account, sign-in, security and communication data. This notice describes that data.
- Processor — for the data that companies (our customers) enter into ZERPY: their customers, suppliers, contact persons, orders, invoices, claims, website chat conversations etc. The controller of that data is the company, and the processing is governed by the Data Processing Agreement. For questions about that data, contact the company you do business with.
What data we process
| Data | Purpose | Legal basis |
|---|---|---|
| Name, e-mail, password (as a hash), optionally phone and address | Creating and using the account, signing in | Contract (providing the service) |
| The company or companies you belong to and your role(s) | Checking permissions and showing the right company's data | Contract |
| Sign-ins: time, device type (e.g. "Chrome · macOS"), IP address | Protecting the account: new-device alerts, sign-in history for the company's owners | Legitimate interest (security) |
| Activity log: who changed what and when in the company account | Transparency and tracing errors for the company, reverting AI changes | Contract and legitimate interest |
| Log of e-mails sent to you (recipient, subject, status) | Notifications, invitations, security alerts and checking their delivery | Contract and legitimate interest |
| AI assistant connections (which app, when connected and last used) | Managing and ending connections | Contract |
| Communication with us (e-mails, feedback) | Answering questions, improving the service | Legitimate interest |
We do not use analytics, advertising or tracking cookies, and we do not sell personal data.
Cookies and browser storage
ZERPY uses only strictly necessary cookies and browser storage, without which the service does not work:
| Name | Purpose |
|---|---|
sb-…-auth-token | Sign-in session |
zerpy_org | Which company's data you are viewing |
zerpy_locale | Interface language |
nuxt-color-mode (browser storage) | Light or dark theme |
zerpy_chat_v (browser storage, in the website chat window) | Random identifier so that the same visitor sees their conversation |
Strictly necessary cookies do not require consent. The help centre help.zerpy.app does not use cookies.
Who receives the data
We use reliable service providers that process data on our behalf and on our instructions:
| Provider | Purpose | Location |
|---|---|---|
| DigitalOcean | Application servers | Frankfurt, Germany (EU) |
| Supabase | Database, sign-in, file storage | Frankfurt, Germany (EU) |
| Brevo | Sending e-mails | EU |
| Netlify | Hosting the help centre (help.zerpy.app) | Global CDN |
In addition, data goes to services that the company or the user switches on (e.g. Merit Aktiva, Montonio, a webshop via the API, an AI chat provider with the company's own key, Claude or ChatGPT as an AI assistant connection). Their providers' terms apply to them.
To check VAT numbers we send the number to the European Commission's VIES service, and to look up company details we send the registry code to the Estonian e-Business Register.
We disclose data to authorities only when required by law.
Transfers outside the EU
The application data is located in the EU. Some service providers are US companies. Where data may be processed outside the European Economic Area (e.g. for technical support), we use safeguards required by the GDPR, such as the European Commission's Standard Contractual Clauses or the EU–US Data Privacy Framework.
How long we keep data
| Data | Retention |
|---|---|
| User account | While the account exists. After a deletion request, deleted within 30 days. |
| Sign-in history (device, IP address) | 12 months. Company owners see the sign-ins of the last 90 days. |
| Activity log | While the company account exists (the company's audit trail). |
| E-mail log | 90 days |
| Ended AI connections | 90 days after ending |
| Website chat conversations | 12 months after the last message |
| Backups | Deleted as the backups are rotated |
Data that the law requires to be kept longer (e.g. accounting documents) is kept by the company it belongs to.
Your rights
You have the right to:
- know which data we process about you and get a copy of it;
- have incorrect data corrected (you can change most of it yourself on My profile);
- have data deleted when it is no longer needed or there is no basis for processing;
- restrict processing or object to processing based on legitimate interest;
- receive your data in a machine-readable format (data portability).
Write to hi@giffi.ee. We reply within one month. If you believe we are violating your rights, you may contact the Estonian Data Protection Inspectorate (www.aki.ee) or the supervisory authority of your country.
How we protect data
- All connections are encrypted (HTTPS).
- Passwords are stored only as hashes. Integration keys and secrets are encrypted in the database.
- Each company's data is separated from others. Access depends on the role and is checked on the server.
- Private files (e.g. attachments of claims and tasks) are kept in closed storage and are only served after a permission check.
- We send security alerts about sign-ins from a new device and about important changes.
Changes
If we change this notice materially, we will let you know by e-mail or in the app. The current version is always on this page.
See also: Terms of Service · Data Processing Agreement