Privacy Policy
How Zinc handles personal data across zinc.com, the API, the dashboard, and the MCP server.
Zinc Technologies Inc. ("Zinc," "we," "us") provides an API and related tools that let businesses, developers, and AI agents search for products and buy them from online retailers. This Privacy Policy explains how we handle personal data in connection with zinc.com, the Zinc API, the dashboard, the Zinc MCP server, and related services (the "Services"). Capitalized terms not defined here have the meanings in our Terms of Service.
We do not sell personal data, and we do not share it for cross-context behavioral advertising.
1. Our role
When we are the controller. Zinc decides how and why personal data is used, and this policy applies, for: people who create or use a Zinc account, including through an MCP client or approved agent; contacts at our customers and prospects; people who pay per request without an account; and visitors to our websites.
When we are a processor. Most of the personal data we handle belongs to our customers' end users, such as the names, addresses, and phone numbers of people who receive orders. Our customers submit that data through the API, and we process it on their behalf under our agreement with them. In that case, the customer's privacy policy governs, and requests should go to the customer. If you contact us about such data, we will refer you to the customer where we can.
2. Personal data we collect
Data you give us
| Category | Examples |
|---|---|
| Account and contact | Name, email, company, role, phone, billing address, sign-in information |
| Orders | Product URLs, quantities, price limits, recipient names, shipping addresses, phone numbers, emails, gift messages |
| Connected retailer accounts | Sign-in details for retailer accounts you choose to connect, protected with encryption |
| Forwarded messages | Messages you choose to forward to Zinc to help complete orders, such as account notices and order updates |
| Support and communications | Messages, attachments, call notes, and community posts |
Data we collect automatically
| Category | Examples |
|---|---|
| API and usage | API keys and key prefixes, request and response logs, timestamps, error codes, webhook deliveries |
| Agent and connection data | Agent names and runtimes shown on approval screens, OAuth grants and scopes, MCP client identifiers |
| Device and network | IP address, browser and device type, operating system |
| Website activity | Pages viewed, referring pages, and interactions, collected with cookies and similar technologies |
Data from third parties
| Source | Examples |
|---|---|
| Retailers and carriers | Order confirmations, retailer order numbers, prices charged, tracking numbers, delivery status, return outcomes |
| Payment providers (such as Stripe and Tempo) | Payment confirmations, the last four digits and brand of a card, wallet addresses for stablecoin payments, fraud signals. Zinc does not collect full card numbers |
| Our customers | End-user data submitted through the API |
| Business and marketing sources | Business contact details from event lists, partners, and public sources |
We do not ask for, and you should not submit, sensitive data such as government ID numbers, health information, or precise geolocation.
3. How we use personal data
The legal basis column applies where EU or UK data protection law applies.
| Purpose | Examples | Legal basis |
|---|---|---|
| Provide the Services | Place, track, cancel, and return orders; log in to retailer accounts you authorize; process payments, holds, and refunds; send webhooks | Performing our contract |
| Secure the Services and prevent fraud | Verify accounts and agents, detect abuse and payment fraud, enforce our Terms, screen against sanctions lists | Legitimate interests; legal obligation |
| Support you | Answer questions, investigate failed orders, work with retailers and carriers | Performing our contract; legitimate interests |
| Improve the Services | Debug, measure reliability, test automation against past orders using de-identified or masked data where practical | Legitimate interests |
| Communicate with you | Service, billing, security, and policy notices; product updates and marketing, which you can opt out of | Performing our contract; legitimate interests; consent where required |
| Meet legal obligations | Tax and accounting records, responding to lawful requests, protecting our rights | Legal obligation; legitimate interests |
We may create aggregated or de-identified data that does not identify any individual and use it for any lawful purpose. We will not attempt to re-identify it.
We use automated systems and trusted service providers to complete orders, and authorized Zinc staff and contractors may review order details when needed to complete, support, or investigate an order.
4. How we disclose personal data
- Retailers and carriers, to place, fulfill, ship, track, cancel, and return orders. They handle the data under their own privacy policies.
- Payment providers such as Stripe and Tempo, to process payments, holds, refunds, and fraud checks.
- Service providers that host, store, secure, analyze, or support the Services, including cloud hosting, databases, AI model providers, email and messaging, and customer support tools. They may use the data only to provide services to Zinc.
- Our customers, when we process order data on their behalf, including order status and tracking for their end users.
- Apps and agents you connect, such as an MCP client, which receive the results of the tools you use. Their own privacy policies apply.
- Professional advisors, such as lawyers, accountants, and auditors, under confidentiality obligations.
- Legal and safety, when we believe disclosure is required by law or legal process, or needed to protect the rights, property, or safety of Zinc, our customers, or others. Where allowed, we will notify the affected customer first.
- Corporate transactions, as part of a merger, acquisition, financing, or sale of assets, subject to standard confidentiality protections.
- With your direction or consent.
5. Retention and security
We retain personal data for as long as your account is active, and afterward for as long as we have a legitimate business or legal reason to keep it, such as maintaining transaction records, preventing fraud, resolving disputes, enforcing our agreements, and complying with law. You can ask us to delete your personal data as described in Section 6, subject to those needs. We may keep de-identified data indefinitely.
Security. We use administrative, technical, and physical safeguards designed to protect personal data, including encryption in transit, encryption of connected account details at rest, access controls, and logging. No system is completely secure. If we learn of a security incident affecting your personal data, we will notify you and the relevant authorities as required by law. Customers are responsible for securing their own API keys, systems, and agents.
6. Your rights and choices
Account controls. You can update account details, revoke API keys and agent or MCP connections, and delete managed accounts in the dashboard.
Marketing. You can unsubscribe from marketing emails with the link in any message. We will still send service and legal notices.
Privacy rights. Depending on where you live, you may have the right to access, correct, delete, or receive a portable copy of your personal data; to object to or restrict certain processing; to withdraw consent; and to not be discriminated against for using these rights. To make a request, email support@zinc.com. We will verify your identity, which may require you to confirm control of your account email, and respond within the time required by law. You may use an authorized agent with proof of their authority. If we deny your request, you may appeal by replying to our decision, and you may contact your data protection authority or state attorney general.
U.S. state privacy disclosures. Some U.S. state laws ask companies to describe their practices using standard categories. Over the past 12 months, we collected identifiers, customer records, commercial information, internet activity, and sign-in information, from the sources and for the purposes described above. We shared this information only with the recipients described in Section 4, for business purposes. We use sign-in information only to provide the Services you ask for. We do not sell personal information or share it for targeted advertising, and we do not knowingly do so for anyone under 16.
EU and UK. You may lodge a complaint with your local data protection authority.
7. Other information
Cookies. We use cookies and similar technologies on our websites and dashboard to keep you signed in, remember settings, secure the Services, and understand usage. You can control cookies through your browser settings. We honor Global Privacy Control signals as an opt-out of sale and sharing where required.
Children. The Services are for businesses and adults. They are not directed to children under 18, and we do not knowingly collect personal data from them. If you believe a child has provided us data, contact support@zinc.com and we will delete it.
International transfers. Zinc is based in the United States and processes data there and in other countries where our service providers operate. When we transfer personal data from the EU, UK, or Switzerland, we rely on appropriate safeguards such as the European Commission's Standard Contractual Clauses and the UK Addendum.
Changes. We may update this policy. We will post the new version with a new date, and notify you by email or in the dashboard before material changes take effect.
Contact. Zinc Technologies Inc., 440 N Barranca Ave #5620, Covina, CA 91723, United States. Privacy questions and requests: support@zinc.com.