Privacy Policy

Who we are

zapyt.io is a service operated by DForce (dforce.com.ua). We help businesses find people who are PUBLICLY asking for the products or services those businesses provide, we prepare reply drafts for a human to review and approve, and we help run the customer's social media content plan.

How the service gets access

The service works through accounts the customer connects themselves in their account dashboard. There are three kinds of access:

• Threads search - through an authorized browser session of the customer's Threads account: the customer logs in themselves in the login window in the dashboard, or transfers their own session; we do not ask for or store the password;
• Telegram - through an authorized session of the customer's Telegram account, which the customer connects themselves (by QR code);
• publishing content-plan posts to Threads, Facebook and LinkedIn - through the platform's official authorization (consent screen), after which we receive an access token.

What data we process

Through the connected accounts, the service reads:

• public Threads posts and replies returned by keyword search for the keywords configured for the customer;
• messages in public Telegram groups and channels the connected account is a member of;
• other people's replies to comments and messages the customer sent through the service (including replies in Telegram direct messages);
• pages of posts the customer replied to - to check whether people responded;
• basic profile data of the connected account (id, username).

Why, and what the service publishes itself

To find posts relevant to the customer's business, prepare a suggested reply, send it if the customer approved it, and show the customer the outcome. Who actually publishes depends on the channel:

• Threads: the service only prepares the draft; the customer copies it and publishes the reply themselves;
• Telegram: once the customer approves a lead in the dashboard, the service itself sends the approved comment and/or direct message from the customer's Telegram account;
• content plan: if auto-publishing has been turned on in agreement with the customer, the service itself publishes the post scheduled for the current day to the connected networks; without it, a post is published only with the button in the dashboard.

What we store

The text of a matched post or message, its link, the author's username and publication time - only for content matched by the customer's search settings. Plus the reply drafts we generate, the customer's decisions (approved / skipped), messages sent and the replies to them, content-plan posts, and the results of outcome checks.

Access tokens and session data (browser cookies, the Telegram session) are available only to the server side of the service (the dashboard never shows them) and are never shared. We do not store account passwords, payment data or any special categories of personal data, and we do not read the customer's private conversations unrelated to messages sent through the service.

The website request form

When you submit a trial request on zapyt.io, we store what you entered: the business (and your own wording if you chose “Other”), city, plan, contact (and its type, which we detect automatically) and, optionally, a comment. Along with it we store the page the request was sent from, the site language, the browser's user agent and a salted hash of the IP address - used only for anti-spam rate limiting; we do not store the IP address itself.

The request is also sent to the operator's Telegram chat. The purpose is to contact you about the trial. We keep requests until they are deleted at your request or no longer needed for the conversation about the trial; there is no fixed period and no automatic deletion. To have a request deleted, write to us from the same contact or name the contact you left in the form: the team manually deletes both the database record and the request card in the operator's Telegram chat (see the data deletion instructions).

Data deletion instructions

The Demand index on the website

The public “Demand index” page shows only weekly aggregates by type of business: how many requests from public Threads and Telegram posts our clients' searches found, plus a few examples. A type of business appears there at 10 or more requests per week. Examples are paraphrased by a model that is instructed to remove names, handles and business names. A separate automatic filter drops examples that still contain contacts, links, email addresses, phone numbers or messenger mentions; it does not check for names. We do not show individual people or clients there.

Website analytics

The public website zapyt.io uses Google Analytics to count visits and page views, so we can see which pages are useful. Google sets cookies in your browser and receives technical visit data (the page, the referring source, device and browser type, approximate location based on the IP address). Google processes this data under its own privacy policy. Analytics is enabled only after you click “Accept” in the cookie banner; until then the Google script is not loaded. You can change your choice at any time with the “Cookie settings” button at the bottom of the site. The customer dashboard app.zapyt.io does not use Google Analytics.

Retention

Data is kept for as long as the service agreement is in force. After it ends, we delete the data within 30 days, and from backups within a further 30 days. Access tokens are deleted immediately when the account owner disconnects the integration or asks us to.

Sharing

We do not sell personal data and do not share it with third parties for their own purposes. Post text is sent to Anthropic only to assess it and generate the draft; Anthropic processes it under its own terms and privacy policy.

To run the service, data is processed by these providers:

• Anthropic - the AI model that assesses posts and writes drafts;
• Supabase - database (EU, Frankfurt);
• Netlify - hosting of the customer dashboard;
• Telegram - notifications to the customer about new leads, and the website trial request card for the operator (contact, business, city, plan, comment up to 500 characters, plus the page and the site language);
• Google - visit analytics for the public website (Google Analytics).

Your rights

The account owner can revoke access at any time: remove the app in the platform's own settings (Threads: Settings → Account → Websites and apps), end the service's session in the platform itself, or contact us. On revocation we delete the stored token and, on request, all associated data. You can also ask for a copy of what we store about you, or ask us to correct an inaccuracy.

Step-by-step data deletion instructions

Contact

Questions about data, access and deletion: a.bakhtalovskyi@dforce.com.ua.