Privacy Policy

1. Information We Collect

We collect information that identifies, relates to, describes, is reasonably capable of being associated with, or could reasonably be linked, directly or indirectly, with a particular consumer or household (“personal information”). The types of personal information we may collect about you include:

1.1. Information You Provide Directly

1.2. Information Collected Automatically

1.3. Information from Third Parties

• Third-Party Sign-In: If you choose to register or log in to Zeptum using a third-party service (e.g., Apple, Google, Instagram), we will receive certain information about you from that third party, such as your name, email address, profile picture, and other information as permitted by your privacy settings on that third-party service and authorized by you.
• Other Users: We may receive information about you from other users, such as when they interact with you through the Service (e.g., send you a Rose, mention you in a post, or report content).
• Venues: We may receive information from participating venues related to your check-ins or interactions within those venues, in an aggregated or anonymized form for analytics purposes.
• Third-Party AI and Content Analysis Services: We use third-party artificial intelligence and machine learning services, including Google's Gemini API, to provide the AI Concierge and to automatically analyze User Content for compliance with our community guidelines. The AI Concierge may send Google your temporary conversation, the applicable city or locality and timezone, relevant venue, event, promotion, ticket and reservation information, bounded preference memory, and derived activity signals needed to answer your request. We do not send the AI model your precise coordinates, raw location trail, payment-card details, or private information about other users. We also use Google Vision API to detect potentially harmful, offensive, or inappropriate material and may use AWS Rekognition for face verification processes when you opt to use our face verification feature.

2. How We Use Your Information

We use the information we collect for various purposes, including:

2.1. To Provide and Maintain the Service

• Create and manage your account
• Authenticate your identity and verify your presence at venues
• Enable you to create and share User Content, including Momentum posts
• Facilitate interactions with other users, including through the Rose System and messaging features
• Display your profile information to other users based on your settings and interactions
• Provide location-based services, such as the Heat Map and proximity-based connections
• Provide the AI Concierge, including interpreting your request, finding relevant venues, events, promotions, tickets, and reservation options, and submitting a reservation request after your explicit confirmation
• Calculate and display gamification metrics, including points, status levels, achievement badges, and leaderboard rankings
• Determine promotion eligibility and progress, grant rewards, and validate coupon redemption
• Administer trials, discounts, promotional codes, bonus Roses, and other special offers, including verifying eligibility, duration, and redemption limits
• Determine and schedule randomly selected local Fortune Wheel opportunities, calculate current Rose prices and chances, record spins, allocate venue inventory, and deliver rewards
• Generate and display analytics and engagement metrics for your content, including views and likes data over time
• Process your transactions for Paid Services
• Provide customer support and respond to your inquiries

2.2. To Improve and Personalize the Service

• Understand how users access and use the Service to improve its functionality, usability, and performance
• Personalize your experience, such as by suggesting relevant venues, events, or users
• Personalize AI Concierge recommendations using bounded preferences you establish, deliberate venue or event selections and dismissals, and aggregated signals from your past Zeptum activity
• If we present a personalized offer, use relevant account, subscription, purchase, and prior offer-redemption information to determine eligibility and display the offer. We may vary prices and offer availability by country or region based on your Apple App Store or Google Play Store storefront, local currency, applicable taxes, or regional market conditions. Regional pricing is not a price calculated uniquely for an individual user. If we personalize a price or offer through automated processing using personal information, we will clearly disclose that fact before purchase and provide any explanation or choice required by applicable law
• Develop new features and services
• Analyze gamification engagement patterns to improve our point system, badges, and leaderboard features
• Analyze content engagement patterns to improve our analytics features and content recommendation systems
• Conduct research and analysis to better understand our user base and market trends

2.3. For Safety, Security, and Compliance

• Monitor and enforce compliance with our Terms of Service, Community Guidelines, and other policies
• Detect, prevent, and address fraud, unauthorized access, security issues, and other harmful activity
• Protect the rights, property, or safety of Zeptum, our users, or others
• Comply with legal obligations, respond to legal requests (e.g., subpoenas, court orders), and protect our legal rights
• Process and investigate user reports of policy violations, inappropriate content, or harmful behavior
• Maintain records of reports and enforcement actions for safety and compliance purposes
• Prevent duplicate, automated, manipulated, or otherwise fraudulent promotion and Fortune Wheel participation

2.4. To Communicate with You

• Send you service-related announcements, updates, security alerts, and administrative messages
• Send you promotional communications about new features, products, offers, promotions, rewards, and events offered by Zeptum and our partners (you can opt-out of these communications as described below)

2.5. For Analytics and Aggregated Data

We may de-identify or aggregate your information and use it for any purpose, including for research, analytics, and to improve the Service. Aggregated or de-identified data is not considered personal information.

2.6. Legal Basis for Processing

For users in the EEA, UK, or Switzerland, our legal basis for processing your personal information includes:

• Contract performance: To provide the Service and fulfill our Terms of Service
• Legitimate interests: For analytics, security, fraud prevention, and Service improvement
• Consent: For optional features like face verification, marketing communications, and location services
• Legal compliance: To comply with applicable laws and regulations

2.7. AI Transparency and Automated Processing

The AI Concierge clearly identifies itself as an AI feature. It generates recommendations and conversational responses but does not make decisions that produce legal or similarly significant effects about you. Any reservation action requires your explicit confirmation and is then checked by Zeptum's server against current plan eligibility, event status, venue settings, operator availability, category, capacity, and duplicate-reservation rules. You may clear a conversation or reset the persistent preference memory through the controls provided in the Service.

3. How We Share Your Information

We may share your personal information in the following circumstances:

3.1. With Other Users

• Your profile information (e.g., full name or initial, age, gender, photos, bio, level, badges, Rose statistics) will be visible to other users following the functionalities of the Service. The extent of information visible may change based on interaction status (e.g., pre-Rose, post-Rose acceptance, post-3 messages)
• Your User Content, such as Momentum posts, will be shared according to the visibility settings you choose (e.g., public, venue-only)
• When you like Momentum posts, this may be visible to other users based on the post's visibility settings
• Information about your interactions (e.g., sending/receiving Roses, matching) may be visible to the relevant users and displayed in aggregate statistics
• Your presence at a venue (if checked-in) may be indicated to other users at the same venue, or your profile picture thumbnail may be displayed to other users viewing the venue details screen as part of the "recently checked-in users" list
• Your name initial, age, profile picture preview, and activity metrics will be displayed on city/region-wide leaderboards to all users in your area. Leaderboard participation is mandatory for all users.

3.2. With Venues

We may share limited verification data with participating venues, including:

• Confirmation that you successfully checked in at their location
• Aggregate anonymized data about check-in patterns and user demographics
• Limited coupon and redemption information needed to validate a venue reward you present, including the coupon identifier, reward terms, and redemption status
• We do NOT share your full name, contact information, or precise location data with venues without your explicit consent

We will not share your specific personal information with venues without your consent unless required for the provision of a service you requested (e.g., if we implement a drink ordering system as envisioned).

3.3. With Service Providers

We share personal information with third-party vendors, consultants, and other service providers who perform services on our behalf, including Twilio (phone verification), Google (Gemini API for the AI Concierge and content moderation, Vision API for content analysis, and authentication), AWS (Rekognition for face verification, cloud infrastructure), Apple, Facebook/Meta, and Instagram (authentication services when you use social login), and other providers for hosting, data storage, analytics, payment processing, customer support, marketing, and technical infrastructure. These service providers are authorized to use your personal information only as necessary to provide these services to us and are obligated to protect your information.

3.4. For Legal Reasons and Protection

We may disclose your information if we believe it's necessary to:

• Comply with applicable laws, regulations, legal processes, or governmental requests
• Enforce our Terms of Service and other agreements, including investigation of potential violations
• Detect, prevent, or otherwise address fraud, security, or technical issues
• Protect the rights, property, or safety of Zeptum, our users, a third party, or the public as required or permitted by law

3.5. Business Transfers

In the event of a merger, acquisition, financing, reorganization, bankruptcy, receivership, sale of company assets, or transition of service to another provider, your personal information may be sold or transferred as part of such a transaction as permitted by law and/or contract. We will notify you via email and/or a prominent notice on our Service of any change in ownership or uses of your personal information, as well as any choices you may have regarding your personal information.

3.6. With Your Consent

We may share your personal information for other purposes with your explicit consent.

3.7. Public Leaderboards

Your leaderboard information (including name initial, age, profile picture preview, and activity metrics) may be displayed publicly to other users within your city/region through our leaderboard features. This information is displayed to encourage healthy competition and community engagement.

4. Data Retention

We retain your personal information for as long as necessary to provide the Service to you, to fulfill the purposes described in this Privacy Policy, to comply with our legal obligations (e.g., to resolve disputes, enforce our agreements), or as otherwise permitted or required by applicable law.

• Momentum Posts: Momentum posts are designed to be ephemeral and typically expire and are removed from primary visibility after their designated time period (e.g., one hour, or longer for premium users). During the active period, posts are visible to other users based on your selected visibility settings. After expiration, posts are removed from public/shared visibility but remain stored and accessible only to you through your personal profile. Analytics data (views, likes, engagement metrics) are collected during the active period and remain available to you indefinitely through graphical analytics interfaces.
• Chat Expiry: Chat sessions initiated through the Rose system may expire after a certain period (e.g., one hour after acceptance), after which further interaction may require a new Rose initiation.
• AI Concierge Conversations and Memory: AI Concierge messages, rolling conversation summaries, candidate results, reservation drafts, and processed-turn responses are held in a temporary server-side conversation store. They expire after inactivity according to the active plan (currently 20 minutes for Plus, 40 minutes for Premium, and 80 minutes for VIP) and are deleted immediately if you clear the conversation. There is no permanent database transcript. A separate, bounded memory of stable preferences and deliberate selections may remain until you reset the AI Concierge memory or delete your account. Reservation records created after explicit confirmation are retained under the ordinary reservation and legal record-retention rules, not as part of the AI conversation.
• Promotions and Fortune Wheel: We retain participation, spin, inventory-allocation, reward, and redemption records for as long as needed to provide unredeemed rewards, prevent duplicate claims, resolve disputes, maintain transaction integrity, and satisfy legal obligations. Redeemed coupons retain their redemption status in our records even after they are removed from the user-facing available-coupon list.
• Paid Offers: We retain trial, discount, promotional-code, bonus-Rose, offer-eligibility, and redemption records for as long as needed to administer the offer, enforce redemption limits, prevent fraud, resolve billing disputes, and meet accounting or legal obligations.
• De-identified Data: We may retain de-identified or aggregated data indefinitely as it is not considered personal information.

5. Your Rights and Choices (Including GDPR)

If you are located in the European Economic Area (EEA), Switzerland, or the United Kingdom (UK), you have certain data protection rights under the General Data Protection Regulation (GDPR) or applicable local laws. Zeptum aims to take reasonable steps to allow you to correct, amend, delete, or limit the use of your Personal Information. Your rights include:

To exercise any of these rights, please contact us using the contact details provided in Section 12. We will respond to your request in accordance with applicable data protection laws. We may need to verify your identity before processing your request. We will respond to your rights requests within one month of receipt. In complex cases, we may extend this period by two additional months, and we will inform you of any extension within the first month along with the reasons for the delay.

6. Your Choices

• Account Information: You can review and update your account information at any time by logging into your account settings within the Service
• Location Information: You can control or disable precise location collection through your device settings. Some features may then be limited, and we may still use the IP address sent with a current request to infer an approximate city and timezone where needed to provide a local Fortune Wheel opportunity
• Notifications: You can manage your push notification preferences within the Service settings or your device settings
• Promotional Communications: You can opt-out of receiving promotional emails from us by following the unsubscribe instructions in those emails or by changing your notification settings in the Service. If you opt-out, we may still send you non-promotional communications, such as those about your account or our ongoing business relations
• Cookies: Most web browsers are set to accept cookies by default. If you prefer, you can usually choose to set your browser to remove or reject browser cookies. Please note that if you choose to remove or reject cookies, this could affect the availability and functionality of our Service

7. Data Security

8. Data Breach Notification

In the event of a data breach that is likely to result in a high risk to your rights and freedoms, we will notify you without undue delay, and in any case within 72 hours of becoming aware of the breach, unless the breach is unlikely to result in a risk to your rights and freedoms.

9. International Data Transfers

Your personal information may be transferred to, stored, and processed in countries other than your own, including the United States, where our servers may be located and our central database is operated. Specifically:

• Google Services: When we use Google's Gemini API for the AI Concierge or content moderation, or Google Vision API for content analysis, the relevant AI Concierge interaction data or User Content may be transmitted to and processed by Google's servers in the United States.
• AWS Services: When you use our face verification feature, your biometric data may be processed by Amazon Web Services (AWS) Rekognition in the United States.
• Twilio Services: When we verify your phone number, your phone number and related verification data are processed by Twilio's servers in the United States.
• Social Login Providers: When you use third-party sign-in (Apple, Google, Facebook/Meta, Instagram), your authentication data is processed by these providers in various jurisdictions according to their privacy policies.
• Other Service Providers: Additional service providers for hosting, analytics, and other services may also process your data in various jurisdictions.

These countries may have data protection laws that are different from the laws of your country. If we transfer your personal information from the EEA, Switzerland, or the UK to other countries not deemed adequate by the European Commission, we will rely on appropriate safeguards, such as Standard Contractual Clauses (SCCs) approved by the European Commission, or other lawful transfer mechanisms, to ensure that your personal information is adequately protected.

10. Children's Privacy

For more information about our standards and procedures regarding child safety and child sexual abuse and exploitation (CSAE), please see our Child Safety Standards page.

11. Third-Party Links and Services

The Service may contain links to third-party websites, services, or applications that are not operated or controlled by Zeptum. This Privacy Policy does not apply to such third-party services. We encourage you to review the privacy policies of any third-party services before providing any information to or through them.

12. Changes to This Privacy Policy

We may update this Privacy Policy from time to time to reflect changes in our practices, technologies, legal requirements, or other factors. If we make material changes, we will notify you by email (sent to the e-mail address specified in your account), by posting a notice on the Service, or as otherwise required by applicable law, prior to the change becoming effective. We encourage you to periodically review this Privacy Policy for the latest information on our privacy practices. Your continued use of the Service after any changes to this Privacy Policy will constitute your acceptance of such changes.

13. Contact Us