1. Who this notice concerns
This notice describes data handling in the current Zikap website, customer workspace and separate owner portal. Zikap is operated by Highlink LLC. Privacy contact: privacy@zikap.site.
2. Information the service processes
- Accounts: name, email address, salted password hash, hashed recovery information, session records and account timestamps. Account email ownership is not currently verified.
- Projects: website/page addresses, package and stored price, topic, language, market, goals, status, reports, project messages, read acknowledgements, revision requests and customer-managed action plans, support request subjects/topics/statuses and their conversations, plus owner-only internal review checklists and notes.
- Payments: Stripe checkout/payment references, amount, currency, mode, recorded payment/refund status and processing timestamps. Card details are entered on Stripe’s hosted checkout rather than in Zikap’s project forms.
- Website checks: requested public URLs, sampled HTML observations and evidence. Account-saved checks can also include optional AI suggestions and usage reservations.
- Request metadata: network metadata processed by the hosting service and application rate-limit counters using hashed address-derived keys. These support operation and abuse prevention.
3. Why this information is used
Information is used to manage accounts and access, review project requests, confirm agreed scope, deliver work, support project conversations, record payment events, operate website checks and apply safety and usage limits. The current service does not provide a public directory of customers or reports. The current Zikap application has no personal-data sale feature, advertising-network integration or automated eligibility decision feature.
Specialist project information is visible to the authorized owner through the separate administration workspace. A private receipt can also authorize access to its corresponding project, so it must be kept secret.
4. Hosting, payments and optional providers
- GitHub Pages serves the public website and its assets. Its infrastructure processes visitor requests under GitHub’s own terms and privacy practices.
- Cloudflare hosts the account/API and independent owner applications and the D1 database. It processes requests and stored service records.
- Stripe processes checkout/payment information. Its privacy practices also apply to Stripe-hosted checkout and its payment records.
- Optional Cloudflare Workers AI: the separate AI-consent step shares only finding IDs, fixed check codes, severity/category and human-review flags. The current prompt construction excludes raw page text, website addresses, names, account details, reports, messages and receipt keys. Suggestions and usage reservations are saved in the customer’s private review record.
- Resend, when transactional email is activated: sending uses a recipient address, configured sender/reply address and a short notification containing an order reference, package title or payment amount. Reports, messages, names, page URLs, passwords and receipt keys are excluded from the templates. Sending is a separate configuration step.
Service operation and authorized owner access, as well as provider processing, can involve handling information outside your country. This notice does not promise storage in a single country. Questions about a provider, data location or transfer arrangement can be raised through the privacy contact for review in relation to the relevant service.
5. Cookies and browser-local tools
The customer workspace uses an essential secure session cookie with a seven-day lifetime. The owner portal uses a separate session cookie. Signing out revokes the current session; password replacement or account recovery revokes existing sessions. My account also lets you inspect session creation/expiry dates and, after password confirmation, close other sessions. This is not device identification or a full sign-in audit.
Browser-local HTML checking and local CSV analysis do not send the pasted file contents through those local tools. A URL-based website check is different: the server requests the public pages. The content planner stores a plan on your device only when you choose its device-save option. Device copies and downloaded files are under your control and are not removed by signing out.
Opening a Zikap account recovery file reads it locally and fills the email and masked recovery-code fields. The file itself is not uploaded. Recovery details are sent to the account service only when you submit the recovery form.
Unsubmitted project and clarification drafts are held in the current tab’s memory. Workspace navigation can preserve them; page reload or account cleanup clears them. They are sent to the account service when you submit the corresponding form.
The current public site does not include Zikap advertising pixels or a Zikap marketing analytics integration. Hosting and checkout providers can process their own operational information.
6. Storage and retention
Retention principles: Highlink LLC keeps account and project information only for as long as reasonably necessary to provide the requested services, maintain account access, deliver agreed support, and address relevant payment or service issues. Keeping an account active is not a blanket reason to retain every record indefinitely. Records are reviewed when those purposes end or a deletion request is received.
- Private AI-review checks expire from customer access after seven days. Expired rows are purged when another account-saved check is created; this is not a promise of physical deletion at an exact minute.
- Account sessions expire after their stated lifetime. Expired sessions and rate-limit records are cleaned through service operations.
- Order history retains up to twenty previous saved states per order. That is a rolling recovery feature, not a complete backup.
- Necessary payment, accounting, fraud-prevention or dispute records are assessed separately. Where retention is required for an applicable obligation or unresolved issue, Highlink LLC retains only the information needed for that purpose and reviews whether continued retention remains necessary. No single accounting retention period is asserted for every record.
- Started notification attempts can store the rendered recipient/sender payload and provider acceptance reference. Provider acceptance does not establish inbox delivery.
Current operation: the application has no general automatic account/project deletion schedule. Retention and deletion reviews require manual handling. Some payment-linked records are protected from ordinary order deletion. Submitting or resolving a support request does not automatically erase an account, a project or a payment record.
Downloaded files and browser-local copies remain under the customer's control; closing a server account or signing out does not remove those device copies. Provider-held records are also subject to the relevant provider's own retention obligations and practices.
7. Questions and data requests
Use My account / Privacy requests to open Help & support with the Privacy or account data topic selected. You can request access, correction or deletion without a paid SEO order. You may also contact privacy@zikap.site without creating a customer account. Include enough information to identify your request; avoid unnecessary personal details.
Highlink LLC reviews the request's scope, verifies that it concerns the requesting person, and considers any necessary payment, legal or dispute-related retention before deciding what can be removed or corrected. A signed-in support request helps identify the account. Do not send passwords, recovery codes, receipt keys, payment-card details or unnecessary identity documents in a message.
The outcome and any reason for retaining relevant records are explained through the verified contact channel. Request handling is manual; a support status is not proof of completed deletion. The existing account download feature described below does not erase data. There is no self-service account-deletion control or automatic export covering every possible record.
Depending on the law that applies to you and the processing involved, rights may include confirmation/access, correction, deletion, a portable copy and objections or restrictions on certain uses. We review requests and any necessary verification under the applicable rules and response deadlines, including any permitted extension notices.
If you disagree with a response, ask for reconsideration in the same verified support conversation or contact privacy@zikap.site, identifying the original request and what you want reviewed. Where an appeal or a further complaint route is required by applicable law, we explain that route in the response. For Texas rights that apply, the appeal response includes how to raise an unresolved matter with the Texas Attorney General. The rights and deadlines that apply depend on your location and the relevant processing.
8. Account details and private downloads
In My account / Personal details, you can update your saved display name and view the account creation date. Other corrections can be requested through the Privacy topic; a name update does not rewrite older project records.
My account / Your data lets a signed-in customer re-enter the current password and prepare a private JSON file. It includes the profile, currently linked project briefs and reports, project conversations, customer action plans, recorded payment summaries, unexpired saved website checks and account support requests with their conversations. Private owner work, security credentials, receipt keys, processor secrets and browser-only tool data are excluded.
The authorization lasts up to ten minutes and is tied to the same login session. Only its hash is stored. The file is assembled in the browser. Its prepared download link has a separate ten-minute lifetime after the file is ready. Clear prepared file revokes that browser link; page/account cleanup or preparing another download also clears it. In-page workspace navigation alone does not unload the page. Files already saved on your device remain under your control and are not deleted by clearing the link. Zikap does not create a stored server archive. It is a collection across successive reads, so concurrent record changes can affect the result. A download does not erase an account or change a payment. The current file limit is 50 MiB and 1,000 records; an incomplete preparation does not offer a completed file. The convenience download and its exclusions do not limit the scope of a separate privacy-rights request, which is reviewed manually.
9. Information about children
Zikap is designed for people arranging SEO work for websites and businesses. Do not include children’s personal information in website briefs, reports or support messages. If you believe such information has been provided, contact privacy@zikap.site so the issue can be reviewed.
10. Changes and contact
This notice is effective November 9, 2026. Updated versions identify their effective date. Material changes to features, providers or the processing described here should be reflected in an updated notice. Privacy contact: privacy@zikap.site.