Terms

TERMS OF USE FOR THE ZAPLY.ME APPLICATION

Effective date: 30 September 2026

Service Provider

Entity: jdg. piotrfeder.pl - Piotr Feder
Product brand: Zaply.me
Tax ID (NIP): 8381776640
Contact: piotr.feder@piotrfeder.pl, rodo@zaply.me

§ 1. General provisions

1. These Terms (hereinafter: 'Terms') set out the rules and conditions for using the 'Zaply.me' application (hereinafter: 'Application') and the services provided by the Service Provider.

2. The subject of the Agreement is the SaaS digital service described in § 3. The Application is used to collect video testimonials from the Customer's clients and to prepare those materials for publication, including on social media, in ads and on a website.

3. These Terms constitute the regulations referred to in Art. 8 of the Act of 18 July 2002 on the provision of services by electronic means.

4. The service provider is jdg. piotrfeder.pl - Piotr Feder, NIP: 8381776640, hereinafter referred to as the 'Service Provider'.

5. Contact with the Service Provider is possible via email at piotr.feder@piotrfeder.pl.

6. In accordance with the Digital Services Act (DSA), the Service Provider has designated a contact point for direct communication concerning matters covered by the DSA, available at: rodo@zaply.me.

7. Before using the Application, the Customer is obliged to read these Terms and the Privacy Policy.

8. An integral part of these Terms is the Data Processing Agreement set out in § 14. Acceptance of these Terms constitutes conclusion of the Data Processing Agreement between the Customer (controller) and the Service Provider (processor).

§ 2. Definitions

1. Price List – information about current Service prices, Plans, generation limits, the validity of unused generations and any functional restrictions, available in the Application interface or on the website.

2. Consumer – a natural person entering into a legal transaction with the Service Provider not directly related to their business or professional activity.

3. Account – the control panel within the Application enabling the Customer to use its features.

4. Non-conformity – lack of conformity of the digital service with the Agreement as understood in Art. 43k of the Consumer Rights Act.

5. Generation validity – the period of 6 months from payment for a Plan during which unused generations from that Plan remain available on the Account. A paid Plan specifies a number of generations, not a number of days of access.

6. Plan Fee – the fee paid in advance for the number of generations stated in the Price List for the selected Plan.

7. Plan – a Service tier specified in the Price List, in particular the Free Plan and the paid Basic and Professional plans.

8. Free Plan – a limited-scope service tier activated automatically upon Account registration, unless the Customer purchases a paid Plan.

9. End Customer – a natural person who, at the Customer's request, records or uploads a video testimonial via the Application's recording page.

10. Integration – a connection between the Application and the Customer's online store (in particular WooCommerce, Shopify or Shoper) through official plugins, apps or mechanisms made available by the Service Provider.

11. Generation – processing of a video recording by the Application (including editing, captions, branding and format variants) within the limit resulting from the Plan.

12. Customer Content – any data, recordings, graphics, logos, discount codes, settings and information entered by the Customer or an End Customer in connection with using the Application.

13. Agreement – the contract for the provision of the digital service under which the Service Provider provides the Service (paid or free).

14. Service – the SaaS digital service enabling the use of Zaply.me Application functionality to the extent resulting from the Plan.

15. Customer – a client (Entrepreneur or Consumer) using the Application under the Agreement.

16. Consumer Rights Act – the Act of 30 May 2014 on consumer rights.

17. GDPR – Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data.

18. Controller – the Customer, who alone or jointly with others determines the purposes and means of processing End Customers' personal data.

19. Processor – the Service Provider, who processes Entrusted Data on behalf of the Controller.

20. Entrusted Data – personal data of End Customers that the Customer entrusts to the Service Provider in order to provide the Service, to the extent described in § 14.

21. Data Processing Agreement – the agreement on the processing of personal data concluded in § 14, within the meaning of Art. 28 GDPR.

§ 3. Subject of the Agreement and scope of functionality

1. The subject of the Agreement is the provision by the Service Provider of a SaaS digital service consisting in making the Zaply.me Application available by electronic means, without transferring to the Customer the economic copyrights to the software.

2. The Application enables the Customer to collect short video testimonials from End Customers about the Customer's company, products or services, to process those recordings automatically and to prepare materials intended for marketing use.

3. In particular, the Service includes the following features and modules, to the extent resulting from the selected Plan and Account settings:

a) the Customer's Account and dashboard – registration, login, management of company data, branding (including the logo and the link to the store terms), reward settings and the recording link;

b) the recording page for the End Customer – access via an individual link in a browser, camera recording or video file upload, acceptance of required consents and selection of the scope of image use. The recording page accepts a recording only once a link to the Customer's store terms is saved in the Account and the End Customer accepts those terms;

c) invitations and rewards – sending the recording link (manually or automatically after a fulfilled order in a connected store) and handling a discount code according to the Customer's settings. The recording invitation is not sent until the Account has a saved link to the shop terms. Handling the discount code does not depend on that link;

d) e-commerce Integrations – connection with WooCommerce, Shopify or Shoper through official plugins or apps, to the extent made available by the Service Provider;

e) video processing – editing (including pause removal), captions, logo overlay, an advertising-material label (on until the Customer turns it off), an end card and format variants (in particular 9:16, 16:9 and 4:5), as well as retaining the original recording;

f) quality and content analysis of the recording using artificial intelligence, and labelling of materials in the dashboard;

g) approval or rejection of a recording by the Customer; the Customer alone decides which recording is published and has no obligation to publish; the Application does not select recordings for publication and does not publish a recording without the Customer's decision;

h) file downloads and – if the feature is enabled in the Account – publishing to selected social channels.

4. The Service is provided in tiers (Plans) specified in the current Price List. These include in particular: the Free Plan and the paid Basic and Professional plans. The Price List sets out fees, video generation limits and any functional restrictions of a given Plan.

5. Features marked in the Application as paid are available after payment for the relevant Plan and within its limits. Exhausting the generation limit does not close the Account, but suspends processing of further recordings on the terms set out in § 4 and § 8.

6. The Service does not include, in particular: manual editing or production of ads on request; any guarantee of reach, advertising results or publication on third-party services; operation of the Customer's online store; or a public developer API as a standalone product, unless the Service Provider makes it available expressly on separate terms.

7. The Service Provider may develop the Application, deploy updates and add, change or discontinue features. The Customer will be informed of a material change to the scope of the Service. Changes may not infringe mandatory Consumer rights.

8. The rules for using Service elements based on artificial intelligence are set out in § 5.

9. Labelling a recording as advertising material is an Account option, on by default. The option is selected when the Account is created. The Application applies the label on every Generation until the Customer intentionally turns the option off in the Account settings and saves that change. After it is turned off, subsequent Generations are made without the label. While the option is on, each Generation places on every format variant (9:16, 16:9 and 4:5) a white bar at the bottom of the frame, one ninth of the frame high, with centred black text. The text reads 'Advertising material' when the company language on the Account is English, and 'Materiał reklamowy' otherwise. The bar is visible for the first 3 seconds of the edited recording and does not appear on the end card. Recordings already edited are not re-rendered or updated merely because the setting changed, whether the option is turned on or off.

§ 4. Access to and use of the software

1. The Customer accesses the Application through a web browser, at zaply.me, after logging in to the Account.

2. The End Customer accesses the recording page solely through an individual link opened in the device browser (including a phone). The Service Provider does not provide a native Zaply.me mobile app, and the End Customer is not required to install Zaply software or create an Account.

3. Official store plugins and apps (WooCommerce, Shopify, Shoper) are an additional access channel to selected features, in particular automatic invitations after an order. They do not replace the Account in the Application.

4. The Service Provider does not provide a public API as a standalone product. Programming interfaces serve the operation of the Application and official Integrations. Use of APIs, bots, scripts or automation outside the official Application interface is prohibited unless the Service Provider grants express consent in writing (including by email).

5. To use the Application you need an Internet connection, a device with an up-to-date web browser and an active email address. To record, the End Customer needs a device with a camera or a video file in a format accepted by the Application.

6. The Account is intended for the Customer and persons authorised by the Customer (in particular employees and contractors acting solely on the Customer's behalf). The Customer is liable for those persons' actions as for their own.

7. The Account does not automatically include an unlimited number of independent user seats. Current rules on the number of Accounts, roles and access rights – if introduced – are set out in the Price List or the Application interface.

8. It is prohibited to: (a) share login credentials with third parties unrelated to the Customer's business; (b) sell, rent, sublicense, lend or otherwise make access to the Application available to third persons or third parties; (c) create additional Accounts in order to circumvent Plan limits; (d) provide services based on the Application to other businesses as an intermediary, unless the Agreement provides otherwise.

9. The video generation limit follows from the Plan specified in the Price List. After the limit is exhausted, collection of recordings may still be possible, but their processing (Generation) is suspended until another Plan or pack is purchased. After the limit is restored, the Customer starts processing of selected recordings manually in the Application.

10. The Customer is obliged to keep Account access data confidential. The Service Provider is not responsible for consequences of disclosing these credentials to third parties by the Customer.

11. The Customer must provide accurate and truthful data.

12. The use of viruses, bots or automation scripts that are not part of the official Application interface is prohibited, as are attempts to circumvent security, Plan limits or payment mechanisms.

13. The Service Provider uses SSL encryption of transmission and encryption of selected database fields (AES-256-GCM), in particular the End Customer's email address and first name. The scope of encryption is described in § 14(7).

14. On zaply.me, Google Analytics starts only after analytics is accepted in the cookie banner. The banner offers analytics or refusal. Advertising cookies are not used, and advertising storage stays off. After a choice the banner hides; the setting can be changed with the “Cookie settings” button in the footer or in the Privacy Policy. The Application does not place a Meta Pixel on zaply.me. Publication of a recording to Facebook Reels or Instagram Reels happens only on the Customer's instruction and is described in § 14.

§ 5. Use of artificial intelligence (AI)

1. The Application uses artificial intelligence models and tools, including OpenAI solutions, for speech transcription, quality and content analysis of recordings, caption generation and editing support (including pause removal).

2. Use of AI features is an integral part of the Service to the extent that the relevant Plan and the Application make them available. By accepting these Terms, the Customer consents to automatic processing of Customer Content for that purpose.

3. AI-generated results (in particular transcription, captions, quality scores and summaries) may contain errors or inaccuracies and require human verification before publication or other use.

4. The Customer is responsible for the decision to approve, publish and further use a recording and content prepared with AI.

5. Only the data necessary to perform the relevant processing are passed to AI models: the audio recording for transcription, and the transcript text for content moderation and quality analysis. The video file is not passed. Billing data (Tpay or Paddle) and encrypted API keys are not passed to external AI models. The calls use the OpenAI API's default rules. According to OpenAI's documentation, data sent to the API are not used to train models unless that option is turned on; the Application does not turn it on. Speech transcription and moderation are not, according to that documentation, retained for abuse monitoring. Text sent for quality analysis may be stored for up to 30 days for that monitoring. Shorter retention requires a separate approval from OpenAI and is not set in the Application.

6. The Customer may use AI-generated content in their business to the extent permitted by law and by the End Customer's consents. The Service Provider does not guarantee uniqueness, accuracy or that such content can be protected by copyright.

7. It is prohibited to use AI features to process content without a legal basis, in particular without the required End Customer consents to recording and use of their image.

§ 6. Agreement for provision of the Service

1. The Agreement is concluded upon confirmation of Account registration by the Customer.

2. Registration is carried out by completing the form and accepting these Terms and the Privacy Policy. Acceptance of these Terms includes the Data Processing Agreement set out in § 14.

3. A new Account is automatically assigned the Free Plan, with limits resulting from the Price List.

4. Purchase of a paid Plan is made by selecting a tier in the Price List and making payment.

5. The Customer may terminate the Agreement at any time by deleting the Account or sending an appropriate statement by email to the address indicated in § 1. Termination does not release the Customer from already due payments and does not result in a refund for an unused limit, unless mandatory law provides otherwise.

6. The Service Provider may terminate the Agreement with immediate effect if the Customer materially breaches these Terms, in particular by sharing the Account with third parties, circumventing limits or using the Application unlawfully.

§ 7. Obligations of the parties

1. The Service Provider undertakes to provide the Service with due care, in accordance with these Terms and the selected Plan.

2. The Service Provider's obligations include in particular: (a) maintaining Application availability at the level specified in § 13; (b) deploying software updates and security patches to the extent justified by the nature of the Service; (c) applying technical and organisational measures for data security, described among others in the Privacy Policy; (d) providing standard technical support by electronic means.

3. Technical support is provided at the email address indicated in § 1, on business days. The Service Provider endeavours to reply as soon as reasonably possible, usually within one business day, but does not guarantee a specific response or fix time unless the Price List or a separate agreement provides otherwise.

4. The Plan fee includes the standard support referred to above. The fee does not include custom implementations, bespoke integrations, training or made-to-order development, unless the parties agree otherwise.

5. The Customer is obliged to: (a) use the Application in accordance with these Terms, the law and the intended purpose of the Service; (b) pay the fees resulting from the Price List on time; (c) keep Account access data confidential and not disclose them to unauthorised persons; (d) provide true data and keep them up to date; (e) ensure that they have a legal basis to process End Customer data and the required consents (including image rights and use of the recording); (f) not introduce into the Application unlawful content, content infringing third-party rights, or content that may disrupt the Service.

6. The Customer is fully responsible for Customer Content and for how downloaded materials are used, including publication on social media and in ads.

7. The advertising-material label is on by default. Leaving the option on, or intentionally turning it off, is the Customer's own decision and instruction. For subsequent Generations to be made without the text, the Customer must turn the option off in the Account and save the change. The Customer represents that: (a) they themselves assess whether a given recording is an advertisement or other content that the law requires to be labelled, and whether they wish to leave the label on; (b) where the option stays on, they hold the End Customer's consent to editing that includes this label, to the extent that consent is required; (c) they are responsible for whether the text applied by the Application is sufficient for a particular publication, including on a social platform or in a paid campaign, and for the consequences of turning the label off; (d) the on-frame label does not replace a notice that the author received a benefit for a licence to use the material, such as a discount code. The Service Provider performs only the technical step of applying the text, or of omitting it, according to the current Account setting and the company language. The Service Provider does not assess whether a recording is an advertisement and does not provide legal advice on that point.

8. The Customer alone decides which recording is published. The Customer has no obligation to publish a recording. The Application does not select recordings for publication and does not publish them on its own. Publication in the Application is possible after the Customer approves the recording; approval by itself is not publication.

9. It is prohibited to use the Application to hide lawful testimonials that are technically in order and to pretend that the published materials are the complete picture of the reviews.

10. The Customer grants a discount code or other reward for a recording in return for a licence to use the material (the recording, image and voice within the scope chosen by the End Customer), not for the content of the testimonial in a particular direction. The reward does not depend on whether the Customer publishes the recording. The Customer sets the code and the moment of sending in the Account settings: immediately after recording or after approval. The Application performs only the technical step that follows those settings. Where the Customer's store sends the message with the code, the Service Provider does not take part in sending the reward.

11. The Customer publishes their own store terms covering the video testimonial, image consent, the licence and the reward, and then saves a working link to those terms in the Account settings (an http or https address). Providing the link is the Customer's obligation and a condition of collecting recordings. Until the link is saved in the Account, the Application does not accept an End Customer's recording: it does not create a recording record and does not store the file. It also does not send the recording invitation. The store plugin (WooCommerce) holds that send as well. The Customer is responsible for the content of the store terms, for their compliance with the law, and for the End Customer being able to read them before recording. The Service Provider does not draft those terms and does not review their content.

§ 8. Payment terms and billing models

1. Prices in the Price List are gross prices. The current Price List, generation limits and available Plans form an integral part of the Agreement as regards fees.

2. Payments follow two paths. When the billing country is Poland, Tpay handles the payment and the Service Provider issues the sales document. For any other billing country, Paddle handles the payment and issues the document to the buyer. The Customer provides the billing details needed for settlement.

3. A paid Plan includes the number of generations stated in the Price List. Unused generations remain on the Account for 6 months from payment. After those 6 months, unused generations expire. The passage of time alone is not a reason for an automatic charge.

4. The next fee for the same Plan is charged only after every generation in the paid pack has been used. On the Tpay path, if the Customer has not turned off automatic payment, the fee is charged to the stored card. If automatic payment is off or the charge cannot be taken, the Application says the Plan must be paid for. On the Paddle path the Customer pays for the next pack in the Application after the generations are used. Turning off Tpay automatic payment is possible in the Application or by an email statement to the address indicated in § 1, and it does not remove generations that are still valid.

5. Until the generations are used or expire, the Customer uses the paid Plan. The Free Plan is not a paid pack and is not subject to the 6-month validity or to automatic payment.

6. Failure to pay, a declined payment, a chargeback or expiry of a paid Plan results in suspension of access to paid features, in particular video Generation. Collection of recordings may still be possible, but their processing remains blocked until the amounts due are settled or another Plan is purchased.

7. After payment for another Plan, access to paid features is restored within the new limit. The Customer starts processing of selected previously blocked recordings manually (using the relevant button in the Application).

8. The fee includes access to the Plan features and the standard technical support referred to in § 7. It does not include additional services unless the Price List provides otherwise.

9. The Service Provider may change the Price List, Plan names, limits and the scope of paid features. The Customer will be notified of a change at least 14 days in advance, by electronic means or in the Application. A change does not affect generations that are already paid for and still valid. New rates apply from the next payment for a Plan, unless mandatory law provides otherwise.

10. A Consumer who does not accept a Price List change may terminate the Agreement with effect on the day preceding the change. Failure to terminate within that time means acceptance of the new Price List.

11. The Service Provider does not currently bill per minute of recording or by a subscription counted in days or years. The fee is for the number of generations in the Plan, unless another option appears in the Price List.

§ 9. Complaints (Consumers and Entrepreneurs with Consumer rights)

1. The Service Provider is liable for Non-conformity of the Service with the Agreement revealed during the period of its provision.

2. Complaints should be submitted by email to the address indicated in § 1.

3. The Service Provider considers complaints within 14 days.

4. If the complaint is upheld, the Service Provider will bring the Service into conformity with the Agreement at its own cost.

§ 10. Complaints (Entrepreneurs)

1. In relations with Entrepreneurs (other than those with consumer rights) a complaint must be filed within 30 days of discovering the irregularity.

2. The Service Provider considers complaints within 21 days.

§ 11. Right of withdrawal

1. A Consumer and an Entrepreneur with consumer rights may withdraw from the Agreement without giving a reason within 14 days of its conclusion.

2. The declaration of withdrawal may be sent electronically to the address indicated in § 1.

§ 12. Copyright and intellectual property

1. All intellectual property rights in the Application, including the source code, architecture, interface, layout, graphics, documentation, the name 'Zaply.me', the logo and trademarks, belong to the Service Provider or to entities that have granted it the relevant licences.

2. Conclusion of the Agreement does not transfer to the Customer the economic copyrights in the software or in other works of the Service Provider. Unless the Agreement provides otherwise, the Service Provider retains those rights in full.

3. The Customer receives a non-exclusive, non-transferable and non-sublicensable right to use the Application solely for conducting their own business, during the term of the Agreement and to the extent resulting from the Plan.

4. The Customer does not acquire the right to copy, reproduce, modify, translate, decompile, reverse engineer, distribute or make the Application software available to third persons or third parties, except for rights arising from mandatory law.

5. It is prohibited to remove copyright notices, trademarks or other markings of the Service Provider, or to use the Zaply.me brand in a way that may mislead as to cooperation or the origin of the service.

6. Rights in Customer Content (including End Customer recordings, logos, branding materials and discount codes) belong to the Customer or to entitled third parties. The Service Provider does not acquire those rights, other than the licence necessary to provide the Service.

7. The Customer grants the Service Provider a non-exclusive licence to store, process, transcode and create derivative versions of Customer Content (including captioned, branded and trimmed versions and, where the advertising-material label is turned on in the Account, which is the default until the Customer turns it off, versions carrying that label) solely in order to perform the Agreement, for its duration and for the time needed for settlement, backups and legal obligations.

8. The Customer represents that they hold the rights and consents necessary to introduce Customer Content into the Application and to use it further to the extent they themselves choose (including End Customer consents to use of their image).

9. The rules concerning AI-generated content are set out in § 5. The Service Provider does not claim rights in Customer Content or in materials resulting from its processing for the Customer's needs.

§ 13. Liability and service levels

1. The Service Provider makes reasonable efforts to ensure Application availability at 99.5% per calendar month, excluding maintenance windows and events beyond the Service Provider's control.

2. The Service Provider's liability for lost profits towards Entrepreneurs is excluded.

3. The Service Provider is not responsible for outages or errors caused by force majeure or by third-party providers whose use is necessary to provide the Service (in particular the payment operator, AI providers, hosting, email and e-commerce platforms), or for necessary maintenance work.

4. After termination of the Agreement the Service Provider may provide limited access to data in Free Plan mode, after which Entrusted Data are deleted on the terms set out in § 14, subject to obligations arising from personal data protection law.

5. An Account with no recorded login for 30 days may be deleted, in particular if it operates on the Free Plan. The Service Provider will endeavour, where possible, to notify the Customer in advance by electronic means.

§ 14. Data processing agreement (GDPR)

1. This section constitutes an agreement on the processing of personal data within the meaning of Art. 28 GDPR (hereinafter: the 'Data Processing Agreement') and forms an integral part of these Terms. The parties to the Data Processing Agreement are: the Customer as Controller and the Service Provider as Processor.

2. The Data Processing Agreement covers only Entrusted Data, that is personal data of End Customers that the Customer transfers to the Service Provider or that arise in the Application when the Service is performed. The Customer's Account data, billing data (on the Tpay path the Service Provider issues the sales document; on the Paddle path Paddle issues the document to the buyer) and data collected on zaply.me for the Service Provider's own purposes (in particular cookies and analytics) are processed by the Service Provider as a controller; the rules of that processing are set out in the Privacy Policy, not in this Data Processing Agreement.

3. The subject-matter of the processing is the processing of Entrusted Data in the Application's IT system, to the extent necessary to provide the Service, in particular to: (a) receive order data from an Integration; (b) generate a security token and an individual recording link; (c) send a recording invitation or a discount code where the Application sends the message on the Customer's behalf; (d) receive a video recording, the required consents and the choice of the scope of image use; (e) edit, transcribe speech, generate captions, analyse quality, prepare format variants and – where the advertising-material label is turned on in the Account – burn the text 'Advertising material' or 'Materiał reklamowy' into the output file; (f) make the materials available in the Customer's dashboard; (g) publish to selected social channels, solely if the Customer issues such an instruction in the Application.

4. The nature of the processing is electronic, including automated processing (job queues, editing, artificial intelligence models). The purpose of the processing is solely performance of the Agreement and of the Service described in § 3.

5. The categories of data subjects are End Customers – natural persons who placed an order in the Customer's store or who recorded or uploaded a video testimonial via the Application's recording page.

6. The types of Entrusted Data correspond to the data that the Application actually receives and produces:

a) WooCommerce Integration – the order identifier, the End Customer's first name (or another designation used in the greeting) and a security token. The End Customer's email address is not transferred to the Application and is not stored in it; the recording invitation and the discount-code message are sent by the Customer's store.

b) Shopify or Shoper Integration – the order identifier, email address and first name (both only until the discount-code message is sent), security token (stored as a hash or as a record linked to the link), information whether the invitation and the reward have been sent, and the dates of those events.

c) recording page – the video file (image and voice), the choice of the scope of use of the recording (ads and social media, or social media only), the speech transcription, captions, the result of automatic quality analysis, output file variants (in particular 9:16, 16:9 and 4:5) and – if the Application sends the reward – the encrypted email address linked to the recording until the code is sent.

d) the Application does not ask for the End Customer's phone number, residential address, payment data or the full contents of the shopping cart, and does not store them as separate fields. The Service does not ask for special-category data under Art. 9 GDPR and does not collect them on purpose. The Customer does not ask the End Customer for them. A statement in a recording may nevertheless contain a name, an address or health information, in particular for cosmetics and services. The transcription, captions and quality-analysis result are then ordinary text in the recording record. If such information appears in a recording, the Customer, as Controller, deletes that recording.

7. The End Customer's email address and first name stored in the Application database are encrypted (AES-256-GCM). The speech transcription, captions and quality-analysis result are stored as ordinary text. Transmission to the Application uses SSL/TLS. The token in the recording link does not contain the email address in clear text.

8. The duration of the processing corresponds to the term of the Agreement and the time needed to delete the data, for backups and to perform legal obligations. The detailed retention and deletion rules are as follows:

a) the order identifier, the security token and the invitation and reward status, together with the dates of those events, are stored for the life of the Account, in order to send the invitation after the delay set by the Customer (by default 5 days, at most 90 days from the store event, according to the Integration settings), to match the recording to the order, to send the reward once, and to prevent a repeat invitation for the same order. A first name transferred through the WooCommerce Integration is stored for the same period. An email address and first name transferred through the Shopify or Shoper Integration are deleted immediately after the discount-code message is sent; the order identifier is enough to prevent a repeat invitation for that order;

b) recordings and output files, as well as the original recording, are stored until the Customer deletes the given recording in the Application or until the Account is deleted; the option to keep the original full length (no pause removal) follows from Account settings and does not by itself change the retention period;

c) if the Application sends the discount code, the email address assigned to the recording record is deleted from that record immediately after the message with the code is sent. For the Shopify and Shoper Integrations the email address and first name on the order record are deleted immediately after the discount-code message is sent, whether the Application or the store sends it, and a later event for the same order does not restore them. The same applies to a linked order-tracking record where one exists. The order identifier remains;

d) the Customer may at any time delete a selected recording in the dashboard; the Application then deletes the recording record and the related files from object storage;

e) deletion of the Account by the Customer constitutes an instruction to delete Entrusted Data; the Service Provider deletes them from production systems without undue delay, no later than within 30 days, subject to backups overwritten on a cycle of no more than 30 days;

f) temporary files created during editing on the video-processing server are deleted after the job ends;

g) after termination of the Agreement, § 13(4) also applies. The right in § 13(5) does not set the storage period for Entrusted Data.

9. The Service Provider processes Entrusted Data solely on the documented instructions of the Controller. Instructions are: these Terms, Account and Integration settings, and the Customer's actions in the Application (including approval, rejection, deletion of a recording and publication). Other instructions are given by the Customer in writing, including by email to rodo@zaply.me, provided they are compatible with the law and the nature of the Service.

10. The Customer represents that they have a legal basis to entrust Entrusted Data and to instruct that messages be sent to the End Customer (in particular a legitimate interest, performance of a contract with the End Customer, or consent). Consents to recording, image and the scope of use are collected on the Application's recording page. The Customer must publish their own store terms and provide a link to them in the Account settings on the terms of § 7(11). Without that link the Application does not collect recordings and does not send recording invitations; the store plugin holds that send as well. The Customer is responsible for the content of those terms.

11. The Service Provider does not use Entrusted Data for its own marketing purposes or to train its own artificial intelligence models. Only data necessary for transcription, captions, quality analysis and editing support are passed to external AI models, in accordance with § 5.

12. The Customer grants the Service Provider a general written authorisation, referred to in Art. 28(2) GDPR, to use subprocessors insofar as this is necessary to provide the Service. These currently include in particular:

a) the hosting and PostgreSQL database provider – storage of Application records;

b) Cloudflare R2 – video file storage;

c) OpenAI – speech transcription from the audio recording, and content moderation and quality analysis from the transcript text, on the terms of § 5(5);

d) Postmark – sending the invitation and the discount code where the Application sends those messages (in particular with the Shopify Integration); with the WooCommerce Integration, messages to the End Customer are sent by the Customer's store;

e) Redis – job queues (including invitations and editing); data in the queue are transient;

f) video-editing compute infrastructure, including – if used – processing in the EU region (among others AWS eu-central-1);

g) Meta Platforms – solely when the Customer instructs publication of a recording to Facebook Reels or Instagram Reels.

13. The Service Provider will notify the Customer of an intended addition or replacement of a subprocessor at least 14 days in advance, by electronic means or in the Application. Failure to object within that time means acceptance. An objection that cannot be accommodated without making it impossible to provide the Service entitles either party to terminate the Agreement on the terms of § 6.

14. Entrusted Data are processed primarily in the European Economic Area. If a given subprocessor uses infrastructure outside the EEA (in particular OpenAI, Postmark or Cloudflare), the Service Provider applies appropriate compliance mechanisms, including standard contractual clauses, where required.

15. The Service Provider applies technical and organisational measures appropriate to the risk, in particular: encryption of transmission (SSL/TLS), encryption of selected database fields (AES-256-GCM), access control and authentication, input validation, abuse limiting (rate limiting) and monitoring of errors and security. Persons authorised to process Entrusted Data are bound by confidentiality, including after the end of cooperation.

16. Taking into account the nature of the processing, the Service Provider assists the Customer in fulfilling data-subject rights (access, rectification, erasure, restriction, portability, objection). A request from an End Customer addressed directly to the Service Provider is forwarded to the Customer without undue delay, if the Controller can be identified. The Service Provider replies within a time enabling the Customer to meet the statutory 30 days.

17. The Service Provider reports a personal-data breach affecting Entrusted Data to the Customer without undue delay, no later than 48 hours after becoming aware of the breach, to the email address linked to the Account. The report includes – to the extent available – a description of the nature of the breach, the categories and approximate number of data subjects and records, the likely consequences and the measures taken or proposed.

18. The Service Provider makes available to the Customer the information necessary to demonstrate compliance with Art. 28 GDPR. An audit (including an inspection) may be carried out no more than once per calendar year, on at least 14 days' notice, during business hours, without disrupting the Service and without access to other clients' data. The Service Provider may fulfil the audit obligation by providing a current report or attestation of security measures, if that is sufficient.

19. After termination of the Agreement or on the Customer's earlier instruction, the Service Provider deletes Entrusted Data on the terms of paragraph 8, unless a legal provision requires further storage. Entrusted Data are returned if the Customer requests this in writing before Account deletion, in a readable format (in particular an export available in the Application or files downloaded by the Customer).

20. The Service Provider shall promptly inform the Customer if it considers that an instruction infringes the GDPR or other data-protection provisions. Until the matter is clarified, the Service Provider may suspend performance of such an instruction.

21. Contact for matters concerning the Data Processing Agreement: rodo@zaply.me.

§ 15. Final provisions

1. This version of the Terms is effective from 30 September 2026.

2. Polish law applies to matters not regulated herein.

3. Disputes with Entrepreneurs shall be resolved by the common court competent for the Service Provider's registered office.

4. Customers will be notified of any changes to the Terms, including the Data Processing Agreement, by email or directly within the Application. A change takes effect on the date stated in the notice, no earlier than 14 days after it is sent, subject to Consumer rights.

← Back to home