Privacy Policy

Welcome to Zam APIs. We are committed to protecting your personal information and your right to privacy. This Privacy Policy explains how we collect, use, disclose, and safeguard your information when you use our API services.

By using Zam APIs, you agree to the collection and use of information in accordance with this policy. If you do not agree with this policy, please do not use our services.

2.1 Information You Provide

We collect information that you voluntarily provide when creating an account or using our services:

• Account Information: Email address, username, and encrypted password
• Profile Information: Display name, profile picture (optional, via OAuth)
• OAuth Credentials: Google Account ID, GitHub Account ID (when connected)
• Payment Information: Processed via third-party providers (we don't store card details)
• Support Communications: Messages, feedback, and support requests

2.2 Automatically Collected Information

When you use our services, we automatically collect certain information:

• API Usage Data: Request types, endpoints accessed, timestamps, response codes
• Device Information: IP address, browser type, operating system, device identifiers
• Performance Metrics: Response times, error logs, traffic patterns
• Cookies & Sessions: Authentication tokens, session IDs, preferences

We use your information for the following purposes:

• Service Delivery: Provide, operate, and maintain our API services
• Account Management: Create and manage your user account
• Authentication: Verify your identity and maintain secure sessions
• Transaction Processing: Handle payments and manage subscriptions
• Communication: Send technical notices, updates, security alerts, and support messages
• Analytics: Monitor usage patterns to improve service quality and performance
• Security: Detect, prevent, and address fraud, abuse, and technical issues
• Legal Compliance: Enforce our Terms of Service and comply with legal obligations
• Optimization: Improve, personalize, and expand our service offerings

We do not sell your personal information. We may share your information only in the following limited situations:

• Service Providers: Third-party companies that help us operate our services (e.g., MongoDB Atlas for database hosting, Google OAuth for authentication, payment processors, hosting providers)
• Legal Requirements: When required by law, court order, or government request
• Rights Protection: To protect our rights, property, or safety, or that of our users
• Business Transfers: In connection with a merger, acquisition, or sale of assets
• With Your Consent: When you explicitly authorize us to share information
• Aggregated Data: Anonymized, aggregated statistics that cannot identify individuals

We implement industry-standard security measures to protect your information:

• Encryption: All passwords are encrypted using bcrypt hashing (industry-standard one-way encryption)
• Secure Transmission: HTTPS/TLS encryption for all data transmitted between your device and our servers
• Rate Limiting: Automated protection against brute-force attacks and abuse
• Database Security: MongoDB Atlas with encrypted connections, restricted credentials, and least-privilege access
• OAuth Security: Google OAuth 2.0 for third-party authentication and token management
• Access Controls: Strict internal access controls and authentication requirements
• Regular Audits: Periodic security assessments and vulnerability testing
• Secure Infrastructure: Hosted on secure, monitored cloud infrastructure

When you sign in with Google, we receive the following information from your Google Account:

• Google Account ID: A unique identifier used for authentication
• Email Address: Your primary Google email
• Profile Information: Name and profile picture (if provided by Google)

We use this information solely for authentication and account management. We do not access your emails, files, or other Google services.

You can disconnect your Google account at any time from your Profile → Security → Connected Accounts section.

When you sign in with GitHub, we receive the following information from your GitHub Account:

• GitHub Account ID: A unique identifier used for authentication
• Email Address: Your public GitHub email
• Profile Information: Username, name, and profile picture

We use this information solely for authentication and account management. We do not access your repositories, code, or other GitHub resources.

You can disconnect your GitHub account at any time from your Profile → Security → Connected Accounts section.

We use cookies and similar tracking technologies for the following purposes:

• Authentication: Maintain your login session and remember your authentication state
• Preferences: Remember your settings and preferences
• Security: Protect against fraud and unauthorized access
• Analytics: Understand how you interact with our services (anonymized)

You can control cookies through your browser settings. However, disabling cookies may affect some features of our services, particularly authentication and session management.

You have the following rights regarding your personal information:

• Access: Request a copy of the personal information we hold about you
• Correction: Update or correct inaccurate or incomplete data
• Deletion: Request deletion of your account and associated data
• Export: Receive your data in a portable, machine-readable format
• Opt-Out: Unsubscribe from marketing communications (if applicable)
• OAuth Management: Connect or disconnect third-party OAuth providers (Google, GitHub)
• Restriction: Request limitation of processing in certain situations
• Objection: Object to processing based on legitimate interests

To exercise any of these rights, please contact us at versasoftid@gmail.com. We will respond within 30 days.

We retain your information for as long as your account is active or as needed to provide services. If you delete your account:

• Personal Information: Permanently deleted within 30 days of account deletion
• API Usage Logs: Retained for up to 90 days for security, fraud prevention, and troubleshooting
• Anonymized Analytics: Aggregated, non-identifiable data may be retained indefinitely for statistical purposes
• Legal Obligations: Certain data may be retained longer if required by law or for legal proceedings

Our services are not intended for users under 13 years of age. We do not knowingly collect personal information from children under 13.

If you are a parent or guardian and believe your child under 13 has provided us with personal information, please contact us immediately at versasoftid@gmail.com. We will take steps to delete such information from our systems.

We may update this Privacy Policy from time to time to reflect changes in our practices or legal requirements. We will notify you of significant changes by:

• Website Notice: Posting the updated policy on this page
• Date Update: Updating the "Last Updated" date at the top
• Email Notification: Sending an email to your registered address (for major changes)
• Dashboard Alert: Displaying a notification in your dashboard

Your continued use of our services after changes become effective constitutes acceptance of the updated policy. We encourage you to review this policy periodically.

Your information may be transferred to, stored, and processed in countries other than your country of residence, including Indonesia and the United States, where our servers and service providers are located.

These countries may have data protection laws that differ from your country. By using our services, you consent to the transfer of your information to these countries.

We take appropriate safeguards to ensure that your information remains protected in accordance with this Privacy Policy, regardless of where it is processed.

We comply with applicable data protection and privacy laws, including:

• Indonesia: Electronic Information and Transactions Law (UU ITE) and Personal Data Protection Law
• European Union: General Data Protection Regulation (GDPR) for EU users
• United States: California Consumer Privacy Act (CCPA) for California residents
• Google: Google API Services User Data Policy (for OAuth integrations)

If you are an EU resident, you have additional rights under GDPR, including the right to lodge a complaint with your local data protection authority.