Is Zapier safe with your data?

Training on derived data, with a way out

Zapier may build de-identified "Derived Data" sets from customer content and use them to develop its products, including through model training. There is an opt-out form for everyone, and Company Plan and Enterprise Plan accounts are opted out automatically for every user on the account.

No retention period anywhere

Neither the privacy statement nor the terms names how long customer content or personal information is kept. A separate retention schedule is pointed to but not stated, and the only number given is the twenty-four months of inactivity after which Zapier reserves the right to delete an account itself.

Content ownership stays with the customer

Customers retain ownership of their content, and the licence Zapier takes is non-exclusive and limited-term, scoped to operating the service, fixing security and support issues, and complying with law.

Security and breach handling stay thin

The terms promise physical, technical and administrative measures without naming encryption, access controls or any specific safeguard, and neither document says whether or how fast customers are told about a data breach.