GapLap I Privacy Policy

For account, subscription, billing, support, security, website and business communication data, the controller is ZOREVIA LIMITED (“Zorevia”), a company incorporated in the Republic of Cyprus, with registration number HE 498835, registered office 67 Lemesou, VISION TOWER, 4th Floor, Aglantzia, 2121 Nicosia, Cyprus.

Email for personal data matters privacy@gaplap.com

Website https://app.gaplap.com

The Policy applies in accordance with the General Data Protection Regulation 2016/679, Cypriot Law 125 I of 2018, as amended, and applicable electronic communications and privacy legislation.

The Policy covers the public website, any demonstration access, the GapLap application, accounts, monthly and annual subscriptions, payments, technical support and related communications.

It does not cover acts of independent RCS providers or processing carried out by the Subscriber after exporting or distributing a campaign live. For those acts, the respective entity provides its own privacy notice.

Zorevia as controller determines the purposes and essential means of processing for account operation, subscription, billing, support, security, compliance and management of the business relationship.

The Subscriber as controller determines the purposes and means for personal data it includes in campaigns, JSON files, stored projects or artificial intelligence prompts.

Zorevia as processor processes personal data in User Content only to perform the functions requested by the Subscriber and in accordance with the Data Processing Agreement.

Agency or other intermediary if the Subscriber acts as processor for its client, Zorevia acts as sub-processor. The Subscriber declares that it has valid authorisation to use GapLap and to appoint Zorevia and the disclosed sub-processors.

Transient technical access, analysis, transformation or transmission of data constitutes processing even when Zorevia does not keep an independent copy. For this reason, the parties’ obligations are regulated separately by a Data Processing Agreement where required.

Zorevia does not request special categories of data, criminal conviction data, minors’ data, full payment details or third-party passwords within User Content. The Subscriber must not enter them.

Where processing is based on legitimate interest, Zorevia assesses necessity, proportionality and the data subject’s rights. Where it is based on consent, consent may be withdrawn at any time without affecting the lawfulness of previous processing.

Details marked as mandatory during registration or purchase are required to create an account, charge payment and issue a billing document. Without them, Zorevia cannot provide the paid subscription or a specific function.

The Subscriber is responsible for the accuracy of business and tax details and updates them before the next billing document is issued.

Data entered by the Subscriber belong to it or are under its lawful control. The Subscriber is solely responsible for their lawfulness, accuracy, necessity and transmission and for any required information, lawful basis, consent or authorisation.

The original file entered only for immediate validation or transformation is not retained by Zorevia as a separate independent copy after completion of the function. Zorevia does not sell it, use it for advertising or process it for an independent commercial purpose.

The application may automatically save a working draft so that it can be restored in the next session. Paid Subscribers may also save, organise and delete projects in the cloud. Content incorporated in a draft or stored project is retained in the account as active data and is not considered an independent copy held by Zorevia.

The Subscriber may delete a project through the relevant function. After deletion, the active copy is removed and any residual copy in a protected backup is deleted or replaced at the end of the technical retention cycle. Backups are not used for routine access or any other purpose.

Where User Content contains personal data, Zorevia processes them only for import, technical analysis, preview, validation, transformation, export, optional storage, support and security, in accordance with the Subscriber’s documented instructions.

Processing is governed by a Data Processing Agreement in accordance with Article 28 GDPR. The Agreement covers the subject matter and duration, nature and purpose, categories of data and data subjects, confidentiality, security, sub-processors, assistance with rights and incidents, audits and return or deletion of data.

If a data subject contacts Zorevia about data found exclusively in User Content, Zorevia generally refers the request to the responsible Subscriber and assists it in accordance with the Data Processing Agreement.

Optional AI functions, including AI Optimise, Global AI Fix and AI Fix JSON, send input through Lovable AI Gateway, which forwards it to Google Gemini. Depending on the function, input may include title or description text and technical instructions; AI Fix JSON may send the full campaign JSON, not merely titles and descriptions. The function is activated by the user and the suggested text is technically rechecked before being displayed or applied.

The Subscriber must not submit names, telephone numbers, emails, customer identifiers or other personal data as artificial intelligence input. If such data exist anywhere in the input, including the full JSON, the Subscriber must remove or anonymise them before activation. Any personal-data screening is limited and does not detect every instance or replace this obligation.

Zorevia does not use User Content to train its own models. Retention, processing locations, model-training use and safeguards for Lovable AI Gateway and Google Gemini depend on the applicable contracted services, terms and account configuration and require verification; no verified vendor no-training or data-location assurance is given here. Applicable processing arrangements must be addressed in the list of sub-processors and the Data Processing Agreement.

Access is restricted to authorised Zorevia personnel and collaborators who need it for operation, security, billing, support, legal or accounting compliance and are bound by confidentiality.

Third-party web requests to Google Fonts (fonts.googleapis.com and fonts.gstatic.com) and Cloudflare can also occur, as documented by the Cookie Policy and production HTTP audit. These request recipients are not identified here as directly contracted processors; exact attribution and applicable necessity or consent bases require verification. Published vendor notices and observed requests do not establish Zorevia’s contract acceptance, an exhaustive inventory or legal certification.

Data may also be disclosed to banks, accountants, auditors, legal advisers, insurers, competent authorities or potential business successors, only where there is a lawful basis, appropriate confidentiality and restriction to necessary data.

GapLap’s main application and database infrastructure is located within the European Union, specifically in a recognised data centre in Frankfurt, Germany.

Location of the main infrastructure in the EU does not preclude technical access or processing by group companies or providers in third countries. Where personal data are transferred outside the EU or EEA, Zorevia uses a lawful mechanism under Chapter V GDPR, such as an adequacy decision or standard contractual clauses, and implements additional measures where required.

Information about the applicable mechanism and a copy of the relevant safeguards, with necessary redactions, may be requested at privacy@gaplap.com.

After expiry of the period, data are deleted or anonymised. Zorevia may restrict rather than delete data where temporary retention is required for a legal obligation, court order or the establishment, exercise or defence of a claim.

Zorevia implements technical and organisational measures proportionate to the risk. The current architecture provides for HTTPS and TLS in transit, password hashing with bcrypt or a corresponding secure mechanism, JWT for sessions, Row Level Security at database level, API authentication, rate limiting, segregation of data by user and event logging. Backup availability, retention and restoration capabilities depend on the actual contracted vendor service and configuration; point-in-time recovery is not guaranteed and requires verification.

Access by administrators and collaborators is granted on a need-to-know basis and subject to confidentiality. Zorevia reviews access rights, remedies vulnerabilities and maintains an incident response procedure. Measures evolve according to technology and risk.

In a breach incident, Zorevia acts without undue delay. When acting as controller, it notifies the competent authority within seventy-two hours of becoming aware, where required by Article 33 GDPR. When acting as processor or sub-processor, it notifies the responsible Subscriber without undue delay and assists it in accordance with the DPA.

Subject to the conditions of the GDPR, the data subject may request access, rectification, erasure, restriction, portability or object to processing based on legitimate interest. They may also withdraw consent at any time and object at any time to direct marketing.

A request concerning data controlled by Zorevia is submitted to privacy@gaplap.com. Zorevia may request reasonable information to verify identity and responds without undue delay and generally within one month, with the extension permitted by the GDPR for complex or numerous requests.

For data within an organisation’s campaign or project, the request should generally be addressed to the organisation acting as controller. Zorevia does not act independently on User Content without instructions, unless required by law.

GapLap uses strictly necessary cookies or similar local identifiers for authentication, sessions, security and storage of basic interface preferences. These operate because they are necessary for a service requested by the user.

Analytics and other non-essential cookies are disabled by default and activated only after the required information and consent. They may be rejected without loss of basic functionality. The current policy does not provide for advertising cookies or third-party tracking for targeted advertising.

A separate Cookies Policy provides the cookie and storage names identified to date, together with the observed or documented purposes, providers and durations to the extent verified, and distinguishes the items that remain outstanding; it does not claim to be an exhaustive or complete list. The user may change or withdraw their non-essential preferences for optional external content in the application at https://app.gaplap.com/cookie-settings, which applies only to the application’s own origin. The Cookies Policy at https://gaplap.com/cookies is informational and does not itself change any preference. Other cookies and similar local storage are managed by the browser, separately for each website.

Zorevia sends operational notices concerning accounts, subscriptions, security, renewal, changes to terms and support where necessary for the contract or lawful operation of the Service.

Optional product updates or commercial communications are sent only on the required lawful basis and include an easy way to unsubscribe. Unsubscribing from commercial communications does not affect necessary operational notices.

Zorevia does not, for its own purposes, make decisions based solely on automated processing that produce legal or similarly significant effects for the data subject. Compatibility checks and artificial intelligence suggestions generate technical or creative output which the Subscriber evaluates and approves.

The Service is not directed at persons under eighteen years of age. Zorevia does not knowingly collect minors’ account details. The Subscriber must not enter minors’ data in User Content.

The data subject may lodge a complaint with the Office of the Commissioner for Personal Data Protection of the Republic of Cyprus or the supervisory authority of the Member State of their habitual residence, place of work or alleged infringement. Exercising this right does not preclude prior contact with Zorevia to resolve the matter at e-mail: privacy@gaplap.com

Zorevia may update the Policy when the Service, technical infrastructure, providers or legal framework changes. The new version is published with an effective date. For material changes, additional notice is provided within the application or by email, where required.