Overview
ZapReading ("we," "our," or "us") operates the website zapreading.com and the ZapReading web application (together, the "Service"). This Privacy Policy explains what personal information we collect, how we use it, who we share it with, and the rights you have over it.
We are committed to complying with the EU General Data Protection Regulation (GDPR), California Consumer Privacy Act (CCPA/CPRA), and other applicable privacy laws. If you have questions, email us at support@zapreading.com.
Data We Collect
Account & Authentication Data
- Email address — required to create an account, log in, and receive transactional emails.
- Password (hashed) — stored securely by Supabase Auth; we never see your plaintext password.
- Google OAuth tokens — if you choose to sign in with Google, we receive your name, email, and profile picture from Google. We do not receive your Google password.
Usage & Performance Data
- Reading speed (WPM) baseline and subsequent session measurements.
- Quiz scoresfrom SAT R&W practice sessions, including per-question response data.
- Reading history — passages read, date/time, session length, completion status.
- Daily checkup results — self-reported reading focus and comprehension ratings.
Billing Data
- Payment method details (card number, expiry, CVC) are collected and stored exclusively by Stripe. We store only your Stripe Customer ID and subscription status.
- Billing history — plan type, payment dates, and invoice references.
Technical Data
- IP address, browser type, operating system, and device type (collected by our hosting infrastructure for security and abuse prevention).
- Cookies and session tokens required for authentication (see Cookies & Tracking).
How We Use Your Data
| Purpose | Legal Basis (GDPR) |
|---|---|
| Create and manage your account | Performance of a contract (Art. 6(1)(b)) |
| Authenticate your identity and maintain sessions | Performance of a contract (Art. 6(1)(b)) |
| Process subscription payments and manage billing | Performance of a contract (Art. 6(1)(b)) |
| Deliver core features: RSVP reader, SAT practice, reading history | Performance of a contract (Art. 6(1)(b)) |
| Send transactional emails (receipts, password resets, account notices) | Performance of a contract (Art. 6(1)(b)) |
| Personalise your dashboard with WPM progress and score trends | Legitimate interests (Art. 6(1)(f)) — improving service value |
| Detect fraud, abuse, and security threats | Legitimate interests (Art. 6(1)(f)) — keeping the service secure |
| Comply with legal obligations (tax records, law-enforcement requests) | Legal obligation (Art. 6(1)(c)) |
We do not sell your personal information. We do not use your data to train AI or machine-learning models. We do not send marketing emails without your explicit opt-in consent.
Third-Party Services
We share your data with the following sub-processors only to the extent necessary to operate the Service:
Supabase
Database, authentication, and file storage
Data shared: Email, hashed password, reading data, quiz scores
Location: US East (AWS us-east-1)
Stripe
Payment processing and subscription management
Data shared: Email, billing address, payment method (stored by Stripe)
Location: United States
Google (OAuth)
Optional social login
Data shared: Name, email, profile picture (only if you use Google sign-in)
Location: United States
Resend
Transactional email delivery
Data shared: Email address, email content
Location: United States
Vercel
Web hosting and CDN
Data shared: IP address, request logs (standard server logs)
Location: United States / Global CDN
All sub-processors are bound by data processing agreements that require them to handle your data in accordance with applicable privacy laws. For transfers from the EEA to the US, we rely on Standard Contractual Clauses (SCCs) where required.
Data Retention
- Active accounts: We retain your data for as long as your account is active.
- After account deletion: Personal data is deleted or anonymised within 30 days. Aggregated, anonymised usage statistics may be retained indefinitely.
- Financial records: Billing records are retained for 7 years as required by applicable tax and accounting laws.
- Stripe: Stripe retains payment records per their own retention policy for financial regulatory compliance.
To delete your account and all associated data, go to Settings → Account → Delete Account, or email us at support@zapreading.com.
Your Rights
Depending on your location, you have the following rights over your personal data. To exercise any of these, email support@zapreading.com with the subject line "Privacy Rights Request." We will respond within 30 days (GDPR) or 45 days (CCPA).
Access
Request a copy of the personal data we hold about you.
GDPR Art. 15 · CCPA
Rectification
Ask us to correct inaccurate or incomplete data.
GDPR Art. 16
Erasure
Request deletion of your data ("right to be forgotten").
GDPR Art. 17 · CCPA
Portability
Receive your data in a structured, machine-readable format.
GDPR Art. 20
Restriction
Ask us to pause processing of your data in certain circumstances.
GDPR Art. 18
Objection
Object to processing based on legitimate interests.
GDPR Art. 21
Opt-out of sale
We do not sell personal information. Nothing to opt out of.
CCPA §1798.120
Non-discrimination
We will not penalise you for exercising privacy rights.
CCPA §1798.125
If you are located in the EU/EEA and are unsatisfied with our response, you have the right to lodge a complaint with your local data protection authority.
Age Requirement
The Service is intended for users who are at least 13 years of age. By creating an account, you represent that you are 13 or older. If you are under 18, you represent that a parent or legal guardian has reviewed and agreed to these terms on your behalf.
We do not knowingly collect personal information from children under 13. If we discover that a user under 13 has created an account, we will delete the account and all associated data promptly. If you believe a child under 13 has registered, contact us at support@zapreading.com.
Changes to This Policy
We may update this Privacy Policy from time to time. When we do, we will revise the effective date at the top of the page. For material changes, we will notify you by email (to the address on your account) at least 14 days before the change takes effect. Continued use of the Service after the effective date constitutes acceptance of the revised policy.
Contact
Data Controller
ZapReading
support@zapreading.comFor privacy requests, use subject line: "Privacy Rights Request"