1. Overview
Zavil is an all-in-one tool for creators: a link-in-bio page, short links, Instagram AutoDMs, email, bookings, courses and a community. This policy explains how Nodeflow Labs, a sole proprietorship owned by Amit Kumar Deenanath Yadav ("Zavil", "we") handles personal data on zavil.space (including creator pages like zavil.space/name), app.zavil.space and creators' own domains, and in the emails and DMs Zavil sends.
The short version
- We collect what's needed to run Zavil, and nothing to sell. We don't sell personal data or show ads.
- Zavil doesn't process payments, so we never collect fans' payment details. If a creator links to their own checkout, that checkout handles payment under its own terms.
- Creators can export or delete their data at any time; fans can unsubscribe in one click and ask to be removed.
- We name every company that processes data for us, below.
2. Who is responsible for your data
- Creators' account data: Zavil is the controller (the "data fiduciary" under India's DPDP Act).
- Fans' data on a creator's page (for example, the email you give to get a free guide): the creator is the controller and decides how it's used. Zavil processes it on the creator's behalf, under the creator's instructions and this policy. For questions about how a creator uses your data, contact that creator; we'll help if you can't reach them.
- Visitors to zavil.space: Zavil is the controller.
3. Data we collect about creators
| Data | Why we use it |
|---|---|
| Name, email address and password (stored hashed), or your Google account's name and email if you sign in with Google | Creating and securing your account, sign-in links, service emails |
| Your page: handle, bio, photos, links, offers, emails, community posts and files you upload | Showing your page and delivering your offers and emails |
| Plan and billing status from Dodo Payments (plan, renewal date, payment status) | Applying your plan's features and limits. Card details stay with Dodo. |
| Connected accounts: Instagram, Google Calendar, Zoom (see sections 5 to 7) | AutoDM, availability, call links |
| Usage and device data: pages viewed in the app, IP address, browser, logs | Security, fixing bugs, preventing abuse |
| Messages you send us | Support |
Our legal bases are performing our contract with you, our legitimate interest in running and protecting Zavil, and your consent where we ask for it (for example, the "AI training" switch in Settings → Data & privacy, which is off by default).
4. Data we collect about fans
When you visit a creator's page or sign up for one of their free offers, Zavil may collect:
- Sign-up details: your email address, your name if you give it, and the offer you signed up for.
- Email activity: whether you opened an email or clicked a link, and whether you unsubscribed.
- Bookings and events: the time you booked, your answers to the creator's booking questions, and the meeting link created for you.
- Courses and library: which lessons you've completed.
- Community: your display name, posts, comments, likes, points and direct messages to other members. Creators and the members you message can see these.
- Instagram: if you comment on or message a creator who uses AutoDM, see section 5.
- Visits: the page you viewed, the referring site, UTM tags, your browser type and your country (worked out from your IP address, which we don't store with the visit).
The creator uses this to send you what you signed up for and stay in touch. Every marketing email has an unsubscribe link. Creators may also send your sign-up to their own tools through webhooks they set up; that's their decision and their responsibility. We never use fans' data to market Zavil or anything else to you.
5. Instagram (Meta) data
Creators can connect an Instagram professional account through Instagram Login so Zavil can reply automatically ("AutoDM") when someone comments a keyword on a post or sends a keyword in a DM.
What we access
- From the creator's account: the Instagram user id, username and profile picture; a list of recent posts so the creator can choose which ones a rule applies to; and an access token, which we encrypt before storing.
- From people who interact: when someone comments on a post or sends a message to the connected account, Meta sends us the comment or message, their Instagram user id and username. We check it against the creator's rules and keep the raw event for up to 30 days to process it reliably. For comments and messages that match a rule, we keep the text and username in the creator's AutoDM activity, so they can see what triggered each DM.
How we use it
Only to send the DM and comment reply the creator set up, to record whether it was sent and whether the link was tapped, and to show the creator those results. We don't use Instagram data for advertising, don't sell it, don't use it to build profiles, and don't use it to train AI models. We follow Meta's Platform Terms and Developer Policies.
Removing it
Creators can disconnect Instagram in Zavil at any time, which deletes the stored token, and can also remove Zavil in Instagram under Settings → Apps and websites. People who interacted with an AutoDM can ask us to delete their data: see Data deletion.
6. Google data
- Sign in with Google: your name, email address and profile picture, to create and sign in to your account.
- Google Calendar (only if you connect it): we read free/busy times from the calendars you choose so fans can only book times you're free. We don't read the titles, descriptions or attendees of your existing events. When a fan books a call, we create an event on the calendar you choose, with a Google Meet link if you select it, and update or delete that event if the booking changes.
- We store an encrypted access token and the email address of the connected Google account.
Zavil's use and transfer to any other app of information received from Google APIs will adhere to the Google API Services User Data Policy, including the Limited Use requirements. We don't use Google user data for advertising, don't sell it, don't let humans read it except with your permission, for security, or where the law requires, and don't use it to train AI models. You can disconnect Google Calendar in Zavil, or revoke access at myaccount.google.com/permissions.
7. Zoom data
If a creator connects Zoom, we store an encrypted access token, their Zoom user id and email, and use them only to create, update and delete Zoom meetings for the calls and events they host on Zavil. We store the meeting's join link and share it with the fan who booked. We don't access recordings, chats or participant lists. Creators can disconnect Zoom in Zavil or remove the app from their Zoom account at any time.
8. AI writing
When a creator asks Zavil to draft something (an email, a DM, an offer description), we send their request and the page or offer details it needs to Anthropic, which runs the AI model and returns the draft. We don't include fans' email addresses in these requests. Under its commercial terms, Anthropic doesn't use this data to train its models. Zavil only uses a creator's content to improve its own AI features if they turn on "AI training" in Settings → Data & privacy; it's off by default.
9. Subprocessors
These companies process personal data for us under contracts that require them to protect it and use it only to provide their service to Zavil.
| Company | Purpose | Data | Location |
|---|---|---|---|
| Vercel Inc. | Hosts the Zavil app, creator pages and this website. | All data passing through the app, request logs | United States and global edge network |
| Neon Inc. | Our main database. | Account, page, audience and activity data | United States |
| Inngest Inc. | Runs background jobs such as scheduled emails, sequences and AutoDM replies. | Job details, which can include email addresses and message content | United States |
| Resend (Plus Five Five, Inc.) | Sends email: sign-in links, newsletters, sequences, offer delivery and booking confirmations. | Recipient email and name, email content, delivery and open events | United States |
| Dodo Payments | Merchant of record for creators' Zavil plans: payments, tax and invoices. | Creator name, email, billing address and payment details (held by Dodo, not by us) | India and its payment partners |
| Anthropic PBC | AI model behind the AI writing assistant. | The creator's prompt and the page or offer details it needs | United States |
| Cloudflare Inc. | DNS for our domains and storage for files creators upload. | Uploaded files, DNS queries | Global |
| PostHog Inc. | Visit statistics for this website (zavil.space), without cookies. | Pages viewed, clicks, referrer, browser, device and approximate location (from the IP address) | United States |
Creators also choose to connect these services. Data goes to them only when a creator connects them, and their own privacy policies apply:
| Service | Used for |
|---|---|
| Meta Platforms (Instagram) | AutoDM: reading comments and DMs that match a creator's rules, and sending replies. |
| Google LLC | Sign in with Google; Google Calendar availability and events; Google Meet links for calls. |
| Zoom Video Communications | Creating Zoom meeting links for calls and live events. |
We'll update this list before adding a new subprocessor.
10. Cookies
Zavil uses only first-party cookies needed to run the service and count visits. We don't use advertising or cross-site tracking cookies, and this marketing site sets no cookies: it counts visits with PostHog in cookieless mode, which stores nothing in your browser.
| Cookie | Who | Purpose | Lasts |
|---|---|---|---|
| Session cookie (better-auth.session_token) | Creators | Keeps you signed in to Zavil. | Until you sign out or it expires |
| zv_buyer | Fans | Keeps you signed in to a creator's library after you confirm your email. | 30 days |
| zv_claims | Fans | Lets you open free offers you just signed up for in this browser. | 1 year |
| zv_vid / zv_sid | Page visitors | Random ids that count visits and sessions on creator pages. They contain no personal details and aren't shared. | 1 year / 30 minutes |
| zv_dm | Fans | Remembers that you arrived from an AutoDM, so the creator sees which DM led to a sign-up. | 7 days |
| zv_ref | Visitors | Remembers which creator referred you to Zavil. | 60 days |
| zv_ig_state / zv_oauth_* | Creators | Security check while you connect Instagram, Google or Zoom. | 10 minutes |
You can block or delete cookies in your browser settings. Signing in won't work without the session cookies.
11. When we share data
- With the creator whose page you signed up on (for fans).
- With the subprocessors and connected services above, only for the purposes listed.
- When the law requires it, or to protect the rights, safety or property of fans, creators, Zavil or others.
- If Zavil is part of a merger or acquisition, in which case this policy keeps applying to your data.
We don't sell or rent personal data, and we don't share it for cross-context behavioural advertising.
12. How long we keep data
- Creator accounts: while the account is open. Deleting your account deletes its data right away.
- Closed pages: kept for 30 days so the creator can change their mind or export, then deleted.
- Fans' data: as long as the creator keeps you as a contact, until you ask us to delete it, or until the creator's account is deleted.
- Backups: deleted data can stay in encrypted backups for up to 30 days before it's overwritten.
- Raw events from Instagram, Zoom and Dodo Payments (webhooks): up to 30 days, after processing.
- Logs: kept for a short time, normally no more than 30 days.
- Billing records: kept by Dodo Payments, and by us where tax or accounting law requires, typically up to 8 years.
13. Security
Data is encrypted in transit (HTTPS) and at rest by our hosting and database providers. Access tokens for Instagram, Google and Zoom are encrypted again by Zavil before they're stored. Passwords are hashed. Only people who need access to run Zavil have it. No system is perfectly secure; if a breach affects your data, we'll tell you and the relevant authorities as the law requires.
14. International transfers
Zavil is based in India, and our providers mainly store data in the United States. Where data protection law requires it (for example, for people in the EU, UK or Switzerland), we rely on safeguards such as the European Commission's Standard Contractual Clauses in our providers' data processing agreements.
15. Your rights
Depending on where you live (for example under the GDPR, UK GDPR, India's DPDP Act or US state privacy laws), you may have the right to access, correct, delete or export your personal data, to object to or restrict some uses, to withdraw consent, and to nominate someone to act for you. We won't treat you differently for using these rights.
- Creators: export everything from Settings → Data & privacy, edit your details in Settings, and delete your account there too.
- Fans: unsubscribe from any email with one click, contact the creator, or email us at support@nodeflowlabs.com. See Data deletion.
We reply within 30 days. If you're unhappy with our answer, you can complain to your local data protection authority, or in India, to the Data Protection Board of India.
16. Children
Creators must be 18 or older. Creator pages aren't aimed at children under 13 (or under 16 in the EU), and we don't knowingly collect their data. If you think a child has given us personal data, email us and we'll delete it.
17. Changes to this policy
We'll update the date at the top when this policy changes, and email creators about material changes before they take effect.
18. Contact and grievances
Nodeflow Labs, a sole proprietorship owned by Amit Kumar Deenanath Yadav
Rupa Devi Pada No. 2, Indira Nagar, near Jost Building, opposite Laxmi Medical, Thane West, Maharashtra 400604, India
Email: support@nodeflowlabs.com
Grievance Officer (India's IT Rules, 2021 and DPDP Act, 2023): Amit Kumar Deenanath Yadav, reachable at support@nodeflowlabs.com. We acknowledge complaints within 24 hours and resolve them within the time the law allows.