Data privacy at Zapier

Zapier has ongoing processes to ensure the protection of your data and privacy rights:

Legal Review

Zapier works with legal and other professional counsel to understand its role under both current and proposed data privacy laws and regulations. Zapier regularly reviews and periodically updates its Privacy Policy, Data Processing Addendum, and Terms of Service to ensure ongoing compliance.

Internal Data Audits

Zapier periodically reviews the types of the data that it collects, the reasons for collecting that data, and when Zapier personnel might need to access it.

Vendor Audits

Zapier audits its vendors, both at the time of onboarding and thereafter, to ensure that they adhere to data privacy laws/regulations and sign all relevant Data Processing Addendums.

Communications

Zapier documents pertinent changes in its privacy compliance practices. Customer and partner notification occurs via email, this webpage, and the updates blog. Zapier also maintains a Data Privacy & Security FAQ page that may be useful to review.

Ongoing Process Changes

Zapier continues to refine processes for how it performs customer support, builds products, and handles data, This includes internal documentation, training, and other processes.

For Zap Content (content transferred in and out of Zaps in your Zapier account), you, the customer, are considered the “data controller” of that data from a privacy perspective.

In turn, Zapier is the “data processor” responsible for safeguarding Zap Content as it flows through Zapier’s systems. Zapier’s security measures are described in Zapier’s Security and Compliance page.

As data controller, you are responsible for safeguarding Zap Content as you interact directly with services integrated with Zapier. You should configure your Zaps and integrations to not trigger or work with users' data without proper consent.

Read more about your role and Zapier’s role in privacy compliance.

Because Zapier’s Terms of Service incorporates a Data Processing Addendum (“DPA”), you do not need to sign a separate copy. This DPA (and the accompanying Standard Contractual Clauses) contain legal terms that apply to personal information that may be contained in customer data.

If you need a standalone copy of Zapier’s DPA for your records or other compliance purposes, you can:

• Download a PDF copy of the DPA. Do not sign or return this copy to Zapier.
• Generate an electronically signed copy of the DPA. You will receive two emails, both from HelloSign (noreply@mail.hellosign.com):
  • The first will be a request to sign with the subject: “Signature requested”
  • Once you sign and agree to the DPA terms, you will receive a second email with the subject: “You just signed” that contains a fully signed PDF copy of the DPA.
  • If you have any trouble receiving these messages, check your spam folder, wait at least five minutes for each email to arrive, and ensure you clicked the final “Agree” button after signing in HelloSign.

Below is information on Zapier’s data retention/deletion practices (last updated: September 30, 2021):

Deletion & Export Options

Deletion options
These options describe how to manually delete data from your account. Otherwise, data is deleted from logs and backups based on the standard retention periods described above.

• Delete your account
• Delete data in your account
• Delete a specific Zap
• Delete specific Zap Content and Zap History

Export options
These options describe how to manually export data from your account.

• Export your Zaps
• Export your Zapier Account Data
• Export your Zap History

Zapier engages with subprocesses to provide services to customers. This includes both third-party companies and Zapier affiliates. These subprocessors may receive access to customer data and may assist Zapier with processing it (last updated: January 25, 2022):

Third-Party Subprocessors

Affiliate Subprocessors

Service-Specific Subprocessors

Zapier works with third parties (Service-Specific Subprocessors) to provide customer-requested functionality within its services. When customers request the relevant functionality, these subprocessors access their customer data. Their use is limited to the indicated services:

Updates to Subprocessors

As Zapier’s business continues to grow and evolve, these subprocessors may change. Sign up to receive email notifications about future updates to these lists.