Privacy Policy

1. Who is responsible for your data

The data controller is Ziera Technology, Ziera HQ, Somodaran, Kalasan, Sleman, DI Yogyakarta, Indonesia 55571. For any privacy question or request, email support@zieads.com.

This policy covers the Apizie website, dashboard, REST API, MCP server, bulk jobs and webhooks.

2. Data we collect

Account data. Your name, email address and profile picture URL. If you sign in with Google, GitHub or Discord we receive these from that provider together with your user ID there. If you sign up with email, we store your password only as a salted scrypt hash.

Keys and security. Your API keys (stored encrypted so you can reveal them in the dashboard), key names, optional IP allowlists, and session records with sign-in time, IP address and browser user agent.

Request logs and usage. For each API or MCP call: time, method, API and endpoint, status code, response time, which key was used, IP address, source (REST, MCP or bulk), cache result and any error message. We count requests per day and per API to show usage and enforce quotas. We do not store your request parameters or response bodies in your logs.

Provider keys. Keys you send in x-upstream-key are forwarded to the Upstream Provider for that request only. They are never stored or logged.

Billing. Plan, invoices, amounts, tax, the transfer reference or sender name you enter when confirming a payment, pay-as-you-go balance and referral commissions.

Webhooks and apps. Webhook URLs, signing secrets, event settings and delivery history, and the MCP or OAuth apps you have authorised.

Things you send us. Support requests, issue reports, showcase submissions and any other messages.

Referrals. If you arrive through a referral link, we record the referral so the referrer can earn commission.

We do not ask for sensitive personal data (such as health, biometric or financial account data), and we ask you not to send it through the Service.

3. How and why we use it

We process personal data only for clear purposes and on a lawful basis under UU PDP (Article 20):

• To provide the Service under our contract with you: create and secure your Account, authenticate requests, run the API and MCP server, show usage, logs and invoices, and send webhooks.
• To meet legal obligations: keep billing and tax records and respond to lawful requests from authorities.
• For our legitimate interests: prevent abuse and fraud, enforce rate limits and the Acceptable Use Policy, keep the Service secure, fix problems and improve features. We balance these interests against your rights.
• With your consent: optional emails such as product news, where we ask for it. You can withdraw consent at any time.

We do not sell personal data, show advertising or build advertising profiles. We do not make automated decisions that have legal or similarly significant effects on you; automated checks such as rate limiting only limit request volume.

4. Who we share it with

We share personal data only as needed to run the Service, with service providers bound by confidentiality and data protection obligations:

• Vercel (application hosting and compute)
• Supabase (database and sign-in)
• Dodo Payments (card payments, as merchant of record: it receives your email, name and payment details for card checkouts)
• Resend (transactional email, when email notifications are enabled)
• Google, GitHub and Discord (only if you choose to sign in with them)

Upstream Providers. When you call an endpoint, we send the request parameters to the relevant Upstream Provider from our servers. They see our server's address, not your identity or your API key. Their own privacy policies apply to what they receive.

We may also disclose data when required by law or a valid order, to protect the rights and safety of our users or the public, or to a successor if the business is reorganised or sold, in which case this policy continues to apply.

5. International transfers

Our hosting and database providers may store and process data on servers outside Indonesia. When data leaves Indonesia we make sure the receiving provider offers a level of protection equal to or higher than UU PDP, or that appropriate contractual safeguards are in place, as required by Article 56 of UU PDP.

6. How long we keep it

• Request logs: shown in your dashboard for 7 days on Free, 30 days on Pro and 90 days on Ultra and Max, and limited to the most recent 5,000 entries per Account.
• Account, keys and settings: for as long as your Account is open.
• Sessions: up to 30 days, or until you sign out or revoke the session.
• Billing records: 10 years, as required by Indonesian company document and tax rules.
• Support messages and reports: until resolved and for up to 2 years after, to handle follow-ups.

When you delete your Account in the dashboard, we delete your profile, keys, logs, webhooks, notifications and sessions from our active systems straight away. Invoices are kept as billing records. Copies in provider backups expire on their normal schedule, usually within 30 days.

7. How we protect it

All traffic uses HTTPS. Passwords are hashed, API keys are encrypted at rest, session and sign-in cookies are signed, access to admin tools is restricted, and webhook targets are checked to block requests to private networks.

No system is perfectly secure. If a personal data breach affects you, we will notify you and the relevant authority in writing within 3 x 24 hours of becoming aware of it, as required by Article 46 of UU PDP, and tell you what happened and what we are doing about it.

8. Your rights

Under UU PDP you have the right to:

• get information about how we process your data and access a copy of it;
• correct inaccurate or incomplete data;
• have your data deleted or destroyed;
• withdraw consent you have given;
• object to decisions based solely on automated processing;
• restrict or suspend processing;
• receive your data in a commonly used format and have it transferred to another controller;
• claim compensation for violations of your data rights.

Many of these you can do yourself in the dashboard: edit your profile, revoke keys and sessions, export logs as CSV, and delete your Account. For anything else, email support@zieads.com. We may need to verify your identity first. We respond within the time limits set by UU PDP, generally 3 x 24 hours for access, correction and similar requests.

If you are in the European Economic Area, the United Kingdom or another region with similar laws, you have equivalent rights, and you can complain to your local data protection authority. We would appreciate the chance to address your concern first.

9. Cookies

We use only strictly necessary cookies and a referral cookie. Details are in the Cookie Policy.

10. Children

The Service is not meant for anyone under 18. We do not knowingly collect personal data from children. If you believe a child has given us personal data, contact us and we will delete it.

11. Changes to this policy

We will post any changes on this page and update the date at the top. If a change materially affects how we use your data, we will tell you by email or in the dashboard before it takes effect.

12. Contact

Ziera Technology

Office: Ziera HQ, Somodaran, Kalasan, Sleman, DI Yogyakarta, Indonesia 55571

Email: support@zieads.com