Privacy Policy

1. Data we collect, only with your consent

We only collect data from social accounts that you connect to Zaaz, and only after you authorize access through each platform’s official consent screen. You choose what to share and can decline any optional permission.

Every connection is made through the platform’s own official API and its own authorization screen. Access is read-only, and we never receive or store your passwords.

Instagram

When you connect your Instagram professional account to Zaaz, you authorize us, through Meta’s official API and an explicit consent screen, to read:

• Profile basics: username, name, account type, profile picture, and follower / following / media counts.
• Content metadata: your posts’ captions, media type, timestamps, permalinks, and public engagement counts.
• Performance insights: views, reach, likes, comments, saves, shares, watch time, and similar metrics for your account and posts.
• Audience demographics: aggregated distributions only (age ranges, gender, top cities and countries). We never receive lists of your followers, only aggregates.
• Comments on your media (optional permission): comment content is processed solely to help you understand your own content, performance, and audience sentiment. Commenters’ public usernames are displayed exactly as the API provides them. We do not build commenter profiles. Purchase-intent signals are aggregate measurements only, the percentage of comments that express purchase intent or product questions, and are never profiles of individual buyers or commenters.

Personal (non-professional) Instagram accounts are not supported and are never accessed.

Meta’s own handling of data is described in the Meta Privacy Policy.

TikTok

When you connect your TikTok account, you authorize us, through TikTok’s official developer API and TikTok’s own consent screen, to read:

• Profile basics: your display name, username, avatar, and follower, following, likes and video counts.
• Your videos: the videos on your account and their metadata, meaning title, description, cover image, duration, creation time and permalink.
• Performance statistics: view, like, comment and share counts for each of your videos.

We read only videos that are public on your account. We do not read your private or draft videos, your direct messages, or comments on your videos.

TikTok’s own handling of data is described in the TikTok Privacy Policy.

YouTube

Zaaz accesses your YouTube data through YouTube API Services. By connecting YouTube, you agree to be bound by the YouTube Terms of Service. Google’s handling of data it receives is described in the Google Privacy Policy.

When you connect your YouTube channel, you authorize us to read:

• Channel basics: channel name, description, thumbnail, and subscriber, view and video counts.
• Your videos: your videos and their metadata, meaning title, description, thumbnail, duration, publication date and permalink.
• Performance insights: views, watch time, likes, comments, shares and similar metrics for your channel and videos.
• Audience demographics: aggregated distributions only (age ranges, gender, top countries). We never receive lists of your subscribers, only aggregates.

In addition to disconnecting inside Zaaz, you can revoke Zaaz’s access to your YouTube data at any time through the Google security settings page.

Our data partner

Some connections are made through Phyllo, an approved data partner that connects to the same official platform APIs on our behalf and passes the data to us. Where that is the case, Phyllo acts as our processor: it handles your data only on our instructions and under the limits described in this policy, and the rules here apply identically to data received through it.

Phyllo’s own privacy practices are described at getphyllo.com/privacy-policy.

2. What we never do

• We never post, comment, like, message, or change anything on your accounts. Our access is read-only.
• We never sell your personal data.
• We never access non-public data from any account other than the accounts you connect.

3. How we use your data

We use your data to provide the service to you: analytics about your content and audience, growth and engagement indicators, earned-media-value estimates, benchmarking, personalized recommendations, and insights and materials that help you identify, win, and fairly price brand partnerships. Aggregated, de-identified statistics may be used to generate benchmarks across the Zaaz member base and to improve the product. Benchmarks are always anonymized and will never identify you personally.

We do not share your connected-account data with other Zaaz customers, and we do not combine data from different creators to produce rankings or comparisons that are shown to anyone other than you.

4. Sharing with third parties

We never sell your personal data, and other Zaaz customers never get access to your connected-account data.

Service providers. We use cloud providers and processors to run the service, for example Amazon Web Services and ClickHouse Cloud. They act on our instructions only and for no purpose of their own.

Our data partner. Where a connection is made through Phyllo, Phyllo processes your data on our instructions and under the limits in this policy.

Partner organisations. In limited cases we make aggregated or identity-masked information available to partner organisations under contract, for example so that creators can be found for paid opportunities. Partners never receive your platform access tokens, and their contracts prohibit uses that these terms do not allow.

Anything that identifies you personally to a partner requires your express, specific opt-in. We will ask you first, show you exactly what would be shared, and you can withdraw at any time. It is never enabled by default, and declining it does not affect anything else in the service.

5. Storage and security

Data is encrypted in transit, stored with access controls in our analytics infrastructure (cloud providers acting as processors, for example Amazon Web Services and ClickHouse Cloud), and personal identifiers are masked by default for internal analytical access. Access tokens are held as managed secrets and are never shared.

Where a connection is made through our data partner, access tokens are held by that partner under the same protections and are likewise never shared.

6. Retention and deletion

We keep connected-account data only as long as we need it to provide the service, and only while the account stays connected. We do not keep it indefinitely after you disconnect.

• You disconnect a platform inside Zaaz: we stop collecting immediately, and we delete the data we hold for that platform, including our internal analytics copies, within 7 days. If you reconnect the same platform before that window ends, we stop the deletion and keep your history.
• You revoke access on the platform’s own settings page (for example the Google security settings page): we delete that platform’s data within 30 days, because we learn about it on our next scheduled check rather than immediately.
• You ask us to delete your data, or you delete your Zaaz account: we delete all associated personal data, including our internal analytics copies, within 7 days.

Aggregated, de-identified statistics that cannot be linked back to you may be retained.

Where our data partner holds copies of your data, we instruct them to delete those copies within the same limits.

7. Disconnecting and deleting your data

• Instagram: Instagram → Settings → Apps and Websites → remove “Zaaz.” Our access ends immediately.
• TikTok: TikTok → Settings and privacy → Security and permissions → Manage app permissions → remove “Zaaz.”
• YouTube: the Google security settings page.
• Any platform: your Zaaz account settings, under Connections.
• Request deletion: email privacy@zaaz.co from the email associated with your account, or include your platform @username. You may also delete your account directly in account settings, which triggers the same deletion.

Full deletion instructions are maintained at zaaz.co/data-deletion.

8. Your rights

Depending on where you live, applicable data protection laws (including the GDPR and U.S. state privacy laws) may give you rights to access, correct, export, or delete your personal data, and to withdraw consent at any time. Use the contact below to exercise them. We honor these rights for all users regardless of location.

9. Changes

We will post any material changes to this page and update the effective date.

10. Contact

Super Zaaz Collective LLC · privacy@zaaz.co
1424 11th Ave, Seattle, WA 98122-4269, United States

If you have questions or complaints about how we handle your data, including data obtained through YouTube API Services, contact us at the address above.