Privacy Policy

zkipzkip is operated by Speedrun Labs, a French simplified joint-stock company (SAS) currently being incorporated. Its registered address and company number will be stated here as soon as registration is complete.

For any question about your data, there is a single address: contact@speedrun-labs.com. We reply within 30 days at the latest, and in practice far sooner.

Nothing is collected "just in case". Every item below powers a specific part of the service.

This list matters as much as the previous one.

• Your location never leaves your phone. The app asks for your location to sort venues from nearest to furthest, but that calculation happens on your device. We do not receive it, we do not store it, we could not retrieve it. You may refuse: the app then centres on Paris.
• Your card number is never passed to us. Payment is handled by Stripe, on its own secure screens. We only receive confirmation that the payment took place, and its amount.
• No advertising, no ad trackers, no profiling. There is no tracker in this app.
• We do not sell, rent or trade your data with anyone. Ever, at any price.
• No automated decisions are made about you.

Running a service takes specialised tools. Here is everyone who touches your data, and what they do with it:

• Supabase — Hosts the database and manages accounts. This is where your email, first name and zkips live.
• Stripe — Takes payments and pays out venues. Receives your card details, which we never see. Stripe is its own data controller for those details.
• Brevo — Delivers our emails (address confirmation, password reset). Receives your email address.
• Sentry — Reports app crashes so we can fix them. Configured to send no personal data.
• Vercel — Hosts our web pages, including the one you are reading. This site sets no cookies and does not measure your visit (see the cookie policy).
• Apple and Google — Deliver notifications to your phone, under their own rules.

Each one is bound by a contract forbidding any use of your data beyond the service they provide to us.

In the European Union. Our database is hosted in Paris.

Some providers (Supabase, Stripe, Sentry, Vercel, Apple, Google) are international companies that may process data outside the European Union. Those transfers rely on the European Commission's standard contractual clauses.

For as long as you use the service, then according to two simple rules.

If you delete your account: your preferences, favourites, alerts and notification identifier go immediately. Your first name and email are erased. If you have already bought zkips, those purchases are anonymised rather than deleted: French law requires accounting records to be kept for 10 years, but nothing links them to you any more.

If you stop using the service: after 3 years with no login and no purchase, your account is anonymised automatically. You receive a warning email 2 months beforehand, then a reminder 1 month beforehand. If those warnings cannot be delivered to you, nothing is anonymised.

European law gives you rights over your data. Here they are, in plain words:

• Know what we hold about you and get a copy of it.
• Correct anything inaccurate.
• Erase your account — subject to the accounting caveat explained above.
• Take your data with you in a machine-readable format.
• Object to a use of your data, or ask us to restrict it.
• Withdraw your consent to notifications at any time, from your phone settings.

The simplest route is the app itself. Profile → Delete my account erases your data without going through us.

For anything else, write to contact@speedrun-labs.com. We may ask you to prove your identity before replying — that protection is for your benefit.

If our answer does not satisfy you, you may complain to the CNIL, the French data protection authority, 3 place de Fontenoy, 75007 Paris — cnil.fr. You may also contact the authority in your own country.

zkipzkip is not intended for anyone under 15, and we do not knowingly collect their data. If you are a parent and believe your child has created an account, write to us and we will delete it.

In addition to the above, we keep your business details: legal name, registration number, registered address, phone number, and the public details of your listing (name, description, opening hours, location).

Your bank details are collected directly by Stripe and never pass through us.

The income you earn through the platform is subject to an annual declaration to the tax authorities, as European rules require of platforms (the DAC7 directive).

The "scan station" logins you create see only what is needed to scan: not your prices, not your revenue, not your customers' details.

Traffic between your phone and our servers is encrypted. Passwords are stored in an irreversible form. Database access is compartmentalised: each account can read only its own data, and that rule is enforced by the database itself, not merely by the app.

Access to our admin tools requires two-factor authentication, and every operation there is logged.

No system is perfect. In the event of a data breach likely to put you at risk, we will tell you and notify the CNIL within the legal deadlines.

We will update it here, with a new date. If the change is significant — new data collected, a new use — we will tell you in the app or by email before it takes effect.

A question, a request, a doubt: contact@speedrun-labs.com.

We would rather have questions than misunderstandings.