Super Zaaz Collective LLC — User Agreement and Privacy Policy
Introduction
Welcome to Super Zaaz Collective LLC ("Zaaz," "we," "our," or "us"). This User Agreement ("Agreement") is a binding legal contract between you ("User," "you," or "your") and Super Zaaz Collective. By creating an account and connecting your social media accounts, you agree to the terms outlined below.
Account Registration
- You must register an account with a valid email and password to access our services. You agree to keep your login credentials secure and update your account details as needed.
- You must be 18 or older, or have parental/legal guardian consent if under the age of majority.
- The same Instagram, TikTok or YouTube account can be connected to more than one Zaaz account. Each connection is authorized separately on the platform's own screen, and disconnecting or removing it from one Zaaz account does not affect the others.
Connecting Your Social Media Accounts
We connect directly to each platform's official API, through the platform's own authorization screen:
- Instagram — through the Instagram API with Instagram Login, provided by Meta.
- TikTok — through TikTok's official developer APIs (Login Kit and Display API).
- YouTube — through YouTube API Services (the YouTube Data API and the YouTube Analytics API), provided by Google.
- We only access an account after you connect it yourself, and we only read data from it. Instagram may grant Zaaz broader permissions than the ones we request; we never use them.
- We never post, comment, reply, send messages, delete content, or change any setting on your social media accounts.
- We never see or store your social media passwords. We store the access tokens that each platform issues to us, encrypted.
- You represent that you own each account you connect, or have legal authority to connect it.
- You can end our access at any time, in either of two ways:
- inside Zaaz, by disconnecting the platform in your account's connections; or
- on the platform itself: Instagram (Settings → Apps and websites), TikTok (Settings and privacy → Security → Manage app permissions; the exact menu can vary by app version), or Google (security.google.com/settings/security/permissions).
- Instagram does not let us remove Zaaz's authorization on your behalf. When you disconnect Instagram inside Zaaz we stop using your account and never use the stored authorization again, but the authorization stays listed on your Instagram account until you remove it there.
YouTube API Services
Zaaz uses YouTube API Services to access your YouTube data when you connect a YouTube account. By connecting YouTube, you agree to be bound by the YouTube Terms of Service. Google's handling of data is described in the Google Privacy Policy. You can revoke Zaaz's access to your YouTube data at any time through the Google security settings page, in addition to disconnecting inside Zaaz. Data we receive from the YouTube Data API (your channel statistics, your videos, the comments on them, and their thumbnails) is used for at most 21 days after we collect it and is deleted automatically within 30 days. If we have not collected it again by then, it stops appearing in your reports until the next collection. Your channel's name, handle and picture stay with your connection until you remove YouTube or delete your account. YouTube Analytics reports are not part of this limit; they are deleted as described in Section 9.
What Data We Collect
When you connect a platform, we collect the data the platform returns for the permissions you granted. It includes:
- Instagram: your profile (name, username, profile picture, biography, website, account type, follower, following and post counts); your posts (captions, media and links, like and comment counts, and whether Instagram labels the post as AI-generated); performance insights for your posts and your account (such as reach, views, follows and unfollows, when your followers are online, and taps on your profile's contact buttons); aggregated statistics about your audience and the people who engage with you (age range, gender, city and country, as reported by Instagram).
- TikTok: your profile (display name, username, biography, profile picture, verified status, profile links, the account identifiers TikTok issues to Zaaz, and follower, following, likes and video counts) and your public videos (title, description, cover image, publication date, duration, dimensions, links, view, like, comment and share counts, and whether TikTok labels the video as an ad or as AI-generated).
- YouTube: your channel information (including monetization and made-for-kids status); your videos (titles, descriptions, thumbnails, statistics, privacy status, paid-placement flag, and technical details YouTube provides about your uploads, such as the original file name and size); and YouTube Analytics reports (views and watch metrics over time, traffic sources, devices, operating systems, countries, and aggregated audience age and gender); and the public comments other people post on your videos (the text of each comment, its date, and its like and reply counts — not the replies themselves, and not the name, channel or picture of the person who wrote it).
- We store the platform's responses as we receive them — except YouTube comments, of which we keep only the details listed above — and copies of the images of your content (thumbnails and cover images, and for Instagram photo posts, the photo itself) so your reports keep displaying correctly.
- From you directly: the email address and details you give us when you register.
- When you use the Service: technical logs that record your IP address, account identifier and browser details (user agent) for security and operations. Our API access logs are kept for 30 days. Our cloud provider's security audit log also records each sign-in, sign-out and password reset with your IP address and browser details, and is kept for one year.
- When you visit our website: our website www.zaaz.co, and the pages of the previous version of the Zaaz app, use Meta's advertising tag (Meta Pixel) and Google Analytics. They store identifiers in your browser: Meta's _fbp (your browser) and, when you arrive from a Meta ad, _fbc (that ad click), by default for up to 90 days; and Google Analytics' _ga cookies (your browser and visit), by default for up to 2 years. Meta and Google use them to measure our ads and our website traffic. The pages where you sign up for and use Zaaz do not load these tags; if your browser already holds these identifiers, they may be included in the sign-up notice described in Section 11. You can block or delete them in your browser's settings, block Google Analytics with Google's opt-out add-on (tools.google.com/dlpage/gaoptout), and manage how Meta uses them in your Meta account's ad settings.
Some of this data concerns other people — for example, aggregated statistics about your audience and the people who engage with your content, and the text of public comments other people post on your YouTube videos. We do not collect who wrote a comment. We use this data only to produce your own reports, we show it only in your reports, and it is covered by the same disconnection and deletion rules as the rest of your data (Section 9).
Data Ownership and Use
- You retain ownership of your social media content and data.
- You grant us permission to store, retrieve, process, and analyze this data solely to provide the Service to you as described in this Agreement and our Privacy Policy.
- You can view your personal reports in the Service at any time.
Data Privacy, Storage and Protection
- We comply with Brazil's LGPD (Lei Geral de Proteção de Dados).
- Your connected-account data is private to you and Zaaz. We do not share your connected-account data with other Zaaz members, brands or other third parties, and we never sell your personal data.
- We rely on the following service providers to run the Service, under contract: Amazon Web Services (hosting, storage, sign-in and email) and ClickHouse Cloud (analytics database).
- To measure our advertising, we notify Meta and Google when a new account is created, with the limited information described in Section 11. This does not include any data from your connected accounts.
- We use industry-standard security to protect your data: access tokens are encrypted with dedicated keys.
- You have the right to request access to, correction of, or deletion of your data, and the other rights granted by the LGPD, by contacting us at privacy@zaaz.co.
Rankings and Leaderboards
We do not combine data from different creators to produce rankings, benchmarks or comparisons that are shown to anyone other than you. YouTube and TikTok data is never used in cross-creator rankings or benchmarks.
Disconnecting and Deleting Your Data
- Disconnecting a platform. When you disconnect a platform inside Zaaz, we stop collecting data from it immediately and stop using our access to your account. For TikTok and YouTube we also ask the platform to revoke our authorization, unless the same account is still connected to another Zaaz account; if the platform does not confirm it, you can remove Zaaz in the platform's own settings (Section 3). For Instagram, see Section 3. Disconnecting keeps the data we have already collected; to delete it, remove the platform (below), delete your account, or write to privacy@zaaz.co.
- Removing a platform. When you remove a platform inside Zaaz, we stop collecting from it and end our access immediately, and we delete the data we collected from that platform account, and its stored images, on the date shown to you when you make the request, 5 to 6 days later. Until that date you can reconnect the platform to cancel the removal and keep your data. If the same platform account is also connected to another Zaaz account, removing it ends your connection only: the data stays available to that other account, and our authorization on the platform stays in place for it.
- Deleting your account. You can request deletion of your Zaaz account at any time in your account settings. Deletion is scheduled for the date shown to you when you make the request, 5 to 6 days later. You can cancel it until 24 hours before that date; after that, it cannot be undone. While a deletion is scheduled, you cannot connect or disconnect platforms.
- What we delete. On the scheduled date we ask your connected platforms to revoke our access where the platform allows it; we delete your Zaaz account and sign-in, the access tokens we hold, the data we collected from your connected platforms and the stored images; and we permanently exclude your data from our analytics database so it is never used or shown again.
- What we keep. To make sure deleted data is never imported again, and to show that the deletion was carried out, we keep a minimal record: an internal reference, the identifiers of the social media accounts that were connected, and the date of the request. We also keep a log of the deletion steps, without your name or email, for one year, and a record of the sign-in deletion in our cloud provider's audit log for one year. Database backups expire within 7 days and operational logs within 30 days. The security audit log, which records sign-ins with their IP addresses, keeps them for one year. The minimal record itself is kept indefinitely.
- Reconnecting after deletion. Because of that record, if you later connect the same Instagram, TikTok or YouTube account to a new Zaaz account, data from that social media account will not appear there.
Communications
- We send you emails that are necessary to operate your account — for example email verification and password-reset codes.
- We send marketing messages by email, SMS or WhatsApp only if you agree to receive them, and you can withdraw that consent at any time. Declining does not affect anything else in the Service.
Measuring Sign-ups From Our Advertising
We advertise Zaaz on Meta (Facebook and Instagram) and Google. To learn which ads bring people to Zaaz, our servers notify Meta and Google once, when a new Zaaz account is created. We do not report your later activity in the Service, and we never send them data from the social media accounts you connect.
- To Meta (through Meta's Conversions API): that an account was created and when; your email address, converted to a one-way code (trimmed, lower-cased and hashed with SHA-256), never the address itself; an identifier of your Zaaz account and a hashed copy of it; the IP address and browser details (user agent) of the request; and, if your browser holds them, the identifiers that Meta's advertising tag stores on our websites. Meta compares these details with the information it already holds to recognize whether you saw or clicked one of our ads, and uses the result to measure our ads and decide who sees them, under Meta's own terms and privacy policy.
- To Google (through the Google Analytics Measurement Protocol): that an account was created and when, the sign-up method, and, if your browser holds them, the Google Analytics identifiers of your browser and visit. We do not send Google your email address or your IP address. Google uses this to report our sign-ups in Google Analytics, under Google's terms.
- We keep no copy of this notice. It waits in a queue for at most two days if Meta or Google is unavailable, and is then deleted.
- Once Meta or Google receives it, the information is held under their terms, and deleting your Zaaz account does not recall it. You can manage how Meta and Google use your information in their own privacy settings.
- We do this based on our legitimate interest in measuring our advertising (LGPD, art. 7, IX). You can object at any time by writing to privacy@zaaz.co: we will not send any further information about you. To limit what Meta and Google already received, use their own settings.
- Meta and Google may process this information outside Brazil, under the safeguards in their terms.
Subscription Plans
- The service is offered under a freemium model with usage limits based on your plan.
- Functionality is consistent across tiers, but usage volume may vary.
Suspension and Termination
- You can delete your account at any time, as described in Section 9.
- We may suspend or terminate your account for violations of this Agreement.
Changes to This Agreement
We may update this Agreement. When we make a material change, we will notify you by email or in the Service before it takes effect.
Governing Law
This Agreement is governed by the laws of Brazil. Disputes will be subject to the jurisdiction of Brazilian courts.
Contact
Questions or complaints? Email us at help@zaaz.co. For privacy and data requests, email privacy@zaaz.co.