This Privacy Policy explains how Joppa Technologies LLC ("Joppa," "we," "us") collects, uses, and shares information when you use Zora (the "Service"). By using Zora you agree to this Policy.
Zora is a tool for event-service professionals ("you"). Much of the information Zora handles is about your clients: you are the controller of that data and are responsible for having the right to use it with Zora.
1. Information we collect
- Account & business information. Your name, email, and the business-profile details you provide during onboarding.
- Google account data (via your authorization). When you connect Google you grant Zora: Gmail (gmail.modify), to read your messages and threads, create and update drafts, and manage labels and read state, so Zora can classify client mail and prepare draft replies; and Google Calendar (calendar.events), to view and manage events, so Zora can sync event entries and create or update bookings you initiate. Your Google OAuth tokens are encrypted at rest.
- Your clients' information. Names, email addresses, message content, event dates, and related details in the email and calendar data you connect or that clients submit through intake forms and the client portal.
- Payment information. Payments are processed by Stripe. We receive subscription status and limited billing metadata; we do not store your full card number.
- Usage & device data. Log data, app interactions, and error reports used to operate, secure, and improve the Service.
- Cookies & tracking. Zora does not use advertising or analytics cookies or third-party trackers. We use only essential browser storage (local and session storage) to keep you signed in and remember in-app preferences. Because we don't track users across sites, we don't respond to Do Not Track signals.
2. How we use information
- Provide the Service: classify mail, generate drafts, sync calendar events, and manage invoices, intake forms, and the client portal.
- Process your subscription and prevent fraud.
- Maintain security, debug, and improve features.
- Communicate with you about your account, trial, and changes to the Service.
We do not sell your or your clients' personal information. We do not use your Gmail or Calendar content to train generalized AI/ML models, and we do not allow our AI providers to do so.
3. Your role
You direct Zora to process your and your clients' data to deliver the Service. Where required, you are responsible for the lawful basis for processing your clients' data through Zora and for any notices you owe them.
4. Service providers (subprocessors)
We share data only with providers that help us run Zora, under contracts limiting their use to providing services to us:
- Google LLC: source of the Gmail and Calendar data you connect (email, calendar).
- Anthropic, PBC (Claude): the AI that classifies mail and generates drafts; relevant email and business content is sent for processing.
- Stripe, Inc.: payment processing (billing details).
- Supabase: database, authentication, and file storage.
- Render: application hosting.
- Langfuse: logging and observability; diagnostic traces may include content. These traces are access-controlled and retained only as long as needed to operate, secure, and debug the Service.
- Resend: transactional email delivery (account, trial, and billing notifications); receives your name and email address.
We keep this list current. If we add or change a subprocessor in a way that materially affects how your data is handled, we'll update this Policy and notify you (see Section 11) before the change takes effect.
We may also disclose information to comply with law, enforce our Terms of Service, or protect rights and safety. If Joppa is involved in a merger or acquisition, data may transfer as part of that transaction (you'll be notified).
5. Google API Limited Use disclosure
Zora's use and transfer of information received from Google APIs adheres to the Google API Services User Data Policy, including the Limited Use requirements. Specifically:
- We use Google user data only to provide and improve the user-facing features prominent in Zora.
- We do not transfer or sell this data for advertising or other unrelated purposes.
- We do not use it to train generalized AI/ML models.
- Humans don't read your Google data except with your consent, for security or to comply with law, or for support you request.
6. Data retention
We keep your data while your account is active and as needed to provide the Service. After cancellation or account termination we retain your data for a limited period (generally up to 90 days) so you can reactivate your account. You can request deletion of your account and data at any time by emailing support@joppatech.com; we will delete or anonymize it within 30 days of your request, except where we must keep records (for example, tax or legal).
7. Security
We protect data with encryption in transit and at rest, encrypted storage of Google OAuth tokens, tenant isolation (row-level security so one account cannot access another's data), and access controls. No system is perfectly secure, but we work to protect your information. If we become aware of a security breach affecting your personal information, we will notify you and any authorities as required by applicable law, without undue delay.
8. Your rights & choices
- Disconnect Google any time in settings, or revoke access at myaccount.google.com/permissions. This stops all further access to your Gmail and Calendar. Copies already synced into Zora remain in your account so your history is preserved, and are handled per section 6; you can request their deletion at any time by emailing support@joppatech.com.
- Access, correct, or delete your data by emailing support@joppatech.com.
- Your privacy rights. Depending on where you live (for example, California under the CCPA/CPRA, or other U.S. state laws), you may have the right to know what personal information we hold about you, to access it, to correct or delete it, to opt out of the sale or sharing of personal information (we do neither), and to limit the use of sensitive personal information, and not to be discriminated against for exercising any of these rights. Email support@joppatech.com to exercise them; we honor these rights as required by law.
- Our role for your clients' data. For the client information you bring into Zora, Joppa acts as a service provider or processor: we process it only to provide Zora to you and under our agreement with you, and we do not sell it, share it, or use it for our own purposes.
9. Children's privacy
Zora is for businesses and isn't directed to children under 18. We don't knowingly collect their data.
10. International users
We operate in the United States; if you use Zora from elsewhere, you consent to processing your information in the U.S.
11. Changes to this Policy
We may update this Policy and will post the new effective date here; material changes will be notified to you.
12. Contact
Joppa Technologies LLC, 30 N Gould St, Ste N, Sheridan, WY 82801. Questions about this Policy? Email support@joppatech.com.