Zapier AI procurement policy evidence
Only topics backed by verified findings appear below. Each row preserves the platform's exact policy words and capture provenance.
| Topic | Plan or tier | Risk | Their words | Source |
|---|---|---|---|---|
| DPA, audit rights & data residency | All applicable tiers | low | “DPF, the Swiss-U.S DPF, and the UK Extension, and in a manner inconsistent with the DPF Principals, Zapier will remain liable. If you are located in the EEA, UK, or Switzerland and we receive your personal data in reliance on the EU-U.S. DPF, the UK Extension, or the Swiss-U.S. DPF, you have the right to opt out of (i) our disclosure of your personal data to third parties acting as independent controllers and (ii) our use of your personal data for a purpose that is materially different from the purpose for which it was originally collected or subsequently authorized. Where we process sensitive personal data (e.g., data revealing health, biometric identifiers, precise geolocation, or special categories under applicable law), we will obtain your affirmative consent (opt-in) before such use or disclosure, unless otherwise permitted by law. Please refer to the “Your Choices” section and “Your Data Privacy Rights” section above for more information on how to exercise your choices regarding your personal data.” | Captured 2026-06-07Open source →Finding permalink → |
| DPA, audit rights & data residency | All applicable tiers | low | “ (i) " DPA " means Zapier’s Data Processing Addendum for processing Personal Information (as defined in the DPA).” | Captured 2026-06-07Open source →Finding permalink → |
| DPA, audit rights & data residency | All applicable tiers | low | “ (g) “ DORA ” means the Digital Operational Resilience Act, Regulation (EU) 2022/2554, on digital operational resilience for the financial sector.” | Captured 2026-06-07Open source →Finding permalink → |
| DPA, audit rights & data residency | All applicable tiers | low | “ Data Security . Zapier takes reasonable steps to protect your personal information from loss, misuse, and unauthorized access, disclosure, alteration, or destruction, taking into account the risks involved in the processing and the nature of the personal data. However, no application, Internet, or email transmission is ever fully secure or error-free, and we do not guarantee the security of any personal information. You are also responsible for ensuring that your account and your passwords are protected. Data Storage and International Data Transfers . Information that we collect from the Sites will be transferred to, and processed in, the United States and in any other country where Zapier or its affiliates, subsidiaries, or third-party service providers maintain facilities or personnel. These countries may have data protection laws that are different from the laws of your country (and, in some cases, may not be as protective). We follow applicable data protection laws when transferring personal data. If you are a resident in or a visitor from the EEA, United Kingdom, or Switzerland, we will protect your personal information when it is transferred outside of such locations by processing it in a territory which the European Commission has determined provides an adequate level of protection for personal information, or otherwise by implementing appropriate safeguards to protect your personal information, including through the use of Standard Contractual Clauses or another lawful transfer mechanism approved by the European Commission.” | Captured 2026-06-07Open source →Finding permalink → |
| DPA, audit rights & data residency | All applicable tiers | low | “ (c) DORA Addendum : To the extent that you are an EU-based customer subject to DORA for whom Zapier is an ICT third-party service provider (as defined in DORA), the DORA Addendum shall supplement these Terms.” | Captured 2026-06-07Open source →Finding permalink → |
| DPA, audit rights & data residency | All applicable tiers | low | “ For data transfers and storage of information we collect from your use of the Services, please refer to the details in the Services Supplemental Notice .” | Captured 2026-06-07Open source →Finding permalink → |
| DPA, audit rights & data residency | All applicable tiers | low | “ Description of Change : Clarifying changes regarding Zapier’s EU-U.S. Data Privacy Framework (DPF), the UK Extension to the DPF, and the Swiss-U.S. DPF.” | Captured 2026-06-07Open source →Finding permalink → |
| DPA, audit rights & data residency | All applicable tiers | low | “ (h) “ DORA Addendum ” means Zapier's Digital Operational Resilience Act (DORA) Addendum for EU-based customers who qualify as financial entities using Zapier as an ICT third-party service provider (as defined in DORA).” | Captured 2026-06-07Open source →Finding permalink → |
| DPA, audit rights & data residency | All applicable tiers | low | “ In compliance with the EU–U.S. DPF, the UK Extension, and the Swiss–U.S. DPF, Zapier commits to resolve DPF Principles-related complaints about our collection and use of your personal data. Individuals with inquiries or complaints regarding our handling of personal data received in reliance on the EU–U.S. DPF, the UK Extension, and the Swiss–U.S. DPF should first contact Zapier at the contact information provided below. In compliance with the EU-U.S. DPF, the Swiss-U.S. DPF, and the UK Extension, Zapier commits to refer unresolved complaints concerning our handling of personal data received in reliance on the EU-U.S. DPF, the Swiss-U.S. DPF and the UK Extension to JAMS, an alternative dispute resolution provider based in the United States. If you do not receive timely acknowledgment of your DPF Principles-related complaint from us, or if we have not addressed your DPF Principles-related complaint to your satisfaction, please visit https://www.jamsadr.com/DPF-Dispute-Resolution for more information or to file a complaint. The services of JAMS are provided at no cost to you. The Federal Trade Commission has jurisdiction over Zapier’s compliance with the EU–U.S. DPF, the UK Extension, and the Swiss–U.S. DPF. As a last resort, and in limited situations, EU, Swiss, and UK individuals may invoke binding arbitration from the E.U.-U.S. DPF Panel for complaints regarding DPF compliance not resolved by any of the DPF Mechanisms: https://www.dataprivacyframework.gov/framework-article/ANNEX-I-introduction .” | Captured 2026-06-07Open source →Finding permalink → |
| DPA, audit rights & data residency | All applicable tiers | medium | “ (b) Location of the Service : Zapier operates or controls the operation of the Service from a cloud service located in the United States. In addition, the Service and Customer Content may be accessed, mirrored, and/or managed from various locations outside the United States.” | Captured 2026-06-07Open source →Finding permalink → |
| DPA, audit rights & data residency | All applicable tiers | low | “ Zapier complies with the EU-U.S. Data Privacy Framework (“ EU-U.S. DPF ”), the Swiss-U.S. Data Privacy Framework (“ Swiss-U.S. DPF ”), and the UK Extension to the EU-U.S. DPF (the “ UK Extension ”) as set forth by the U.S. Department of Commerce. The Federal Trade Commission has jurisdiction over Zapier’s compliance with the EU-U.S. DPF, the Swiss-U.S. DPF, and the UK Extension. Zapier has certified to the U.S. Department of Commerce that it adheres to: (1) the EU-U.S. Data Privacy Framework Principles (“ EU-U.S. DPF Principles ”) with regard to the processing of personal data received from the European Union in reliance on the EU-U.S. DPF; (2) the Swiss-U.S. Data Privacy Framework Principles (“ Swiss-U.S. DPF Principles ”) with regard to the processing of personal data received from Switzerland in reliance on the Swiss-U.S. DPF; and (3) the UK Extension with regard to the processing of personal data received from the UK in reliance on the UK Extension (together with the EU-U.S. DPF Principles and the Swiss-U.S. DPF Principles, the “ DPF Principles ”). If there is any conflict between the terms in this Statement and any applicable DPF Principles, the applicable DPF Principles shall govern. To learn more about the Data Privacy Framework (DPF) Program, and to view our certification, please visit https://www.dataprivacyframework.gov . In cases of onward transfer of personal information to third parties of data of EU, Swiss, and UK individuals received pursuant to the EU-U.S. ” | Captured 2026-06-07Open source →Finding permalink → |
| DPA, audit rights & data residency | All applicable tiers | low | “ (b) Data Processing Addendum : To the extent that Zapier processes any Personal Information (as defined in the DPA) contained in Customer Content subject to Applicable Data Protection Law (as defined in the DPA), the DPA shall apply to such processing. To the extent that Zapier processes any personal data subject to GDPR, you are the data exporter and Zapier is the data importer.” | Captured 2026-06-07Open source →Finding permalink → |
| Data retention | All applicable tiers | low | “ (q) " Subscription Term " means the period during which you have agreed to subscribe to the Service.” | Captured 2026-06-07Open source →Finding permalink → |
| Data retention | All applicable tiers | low | “ (e) EU Data Act : This Section applies to you only if you are subject to Regulation (EU) 2023/2854 (the “EU Data Act”). During your Subscription Term: (i) if your Subscription Term is monthly, you may terminate your Zapier Account following the process described in Section 3(f) above, and once you have exported your Customer Content, delete your Zapier Account, and (ii) if your Subscription Term is annual, then you may terminate your Zapier Account by providing a notice under the EU Data Act to Zapier Support, and once you have exported your Customer Content, delete your Zapier Account. Prior to deleting your Zapier Account, you may access, export, and delete your Customer Content in connection with such termination of your Zapier Account and switch to a new provider by following the process described in Zapier’s Data Retention/Deletion/Export Schedule . Once you delete your Zapier Account, you no longer have access to export your Customer Content. You must pay any outstanding Fees covering the remainder of the Subscription Term as an early termination fee in connection with any termination under the EU Data Act. Zapier will not charge any other fees or penalties.” | Captured 2026-06-07Open source →Finding permalink → |
| Subprocessors & data sharing | All applicable tiers | medium | “ We use TikTok’s services to place ads that we think may interest our users and potential users.” | Captured 2026-06-07Open source →Finding permalink → |
| Subprocessors & data sharing | All applicable tiers | medium | “ We may use LinkedIn’s services to place ads that we think may interest our users and potential users, as well as to advertise openings to potential employees.” | Captured 2026-06-07Open source →Finding permalink → |
| Subprocessors & data sharing | All applicable tiers | medium | “ Partner Programs. We have several partner programs that we make available, including our developer platform program (which allows third-party application providers to build integrations to Zapier), our experts program (which connects experts who help our customers set up and use the Services), our partner reseller program (where authorized partners may resell our Services), our partner referral program (where authorized partners may market and refer users to our Services), and other business partner programs. Partners may also help us to market and promote our Services, generate leads, or they may resell our Services. Through partner programs, we collect account registration information (like name, email address, company, and phone number), information about an individual’s technical skill set, comments, questions or feedback, rating or ranking information, images, content, or other information you provide. We may also receive information from our partners (like business contact information, address, job title, email address, or phone number). Third Parties . We may obtain personal information about you from other sources, including from third parties that help us update, expand, and analyze our records, identify new customers, or detect or prevent fraud. We may also receive personal information about you from social media platforms, such as when you interact with us on those platforms or access our social media content. What information we receive from third parties is governed by the privacy settings, policies, and/or procedures of those third parties, and we encourage you to review them. ” | Captured 2026-06-07Open source →Finding permalink → |
| Subprocessors & data sharing | All applicable tiers | medium | “You acknowledge and agree that your Account Information and Usage Information regarding your use of a Third-Party Service integration through your Zapier Account may be shared with that Third-Party Service. Pursuant to your configuration and usage of the Service, Customer Content will be transmitted to and from your Zapier Account to one or more Third-Party Service(s) you’ve linked with your Zapier Account. We may also share your Customer Content with a specific Third-Party Service that you linked to your Zapier Account in order to prevent or resolve service, security, support, or technical issues related to that Third-Party Service.” | Captured 2026-06-07Open source →Finding permalink → |
| Subprocessors & data sharing | All applicable tiers | low | “ (u) " Third-Party Services " means any third-party service, connection, site, platform, application, software, or integration that interoperates with the Service.” | Captured 2026-06-07Open source →Finding permalink → |
| Subprocessors & data sharing | All applicable tiers | medium | “ (b) Linking to Third-Party Services : You acknowledge and agree that your Account Information and Usage Information regarding your use of a Third-Party Service integration through your Zapier Account may be shared with that Third-Party Service. Pursuant to your configuration and usage of the Service, Customer Content will be transmitted to and from your Zapier Account to one or more Third-Party Service(s) you’ve linked with your Zapier Account. We may also share your Customer Content with a specific Third-Party Service that you linked to your Zapier Account in order to prevent or resolve service, security, support, or technical issues related to that Third-Party Service.” | Captured 2026-06-07Open source →Finding permalink → |
| Subprocessors & data sharing | All applicable tiers | low | “ (g) Bulk Data Transfers : You confirm that you are not a covered person and will not engage in any covered data transaction, including a prohibited transaction or restricted transaction, or otherwise share or transfer, any bulk U.S. sensitive personal data with any country of concern or covered person, and that you are otherwise in compliance with Executive Order, Preventing Access to U.S. Sensitive Personal Data and Government-Related Data by Countries of Concern or Covered Persons, 28 CFR part 202 (2025) (the “DOJ Rule”). In the preceding sentence, the terms “prohibited transaction”, “restricted transaction”, “bulk U.S. sensitive personal data”, “covered data transaction,” “country of concern,” “covered person” shall have the meanings ascribed to such terms in the DOJ Rule at §202.201-202.259. Each party agrees to not evade or avoid, cause a violation of, or attempt to violate any of the prohibitions set forth in the DOJ Rule. Each party shall report to the other party any known or suspected violations of the requirement in the previous sentence in accordance with paragraph (b) of §202.201 of the DOJ Rule.” | Captured 2026-06-07Open source →Finding permalink → |
| Subprocessors & data sharing | All applicable tiers | medium | “ We may share information when one of the following circumstances applies: Consent . We may share information with companies, organizations, and other third parties with your consent or to fulfill the purpose for which you provided the information. Public Posts . Any information that you voluntarily choose to post to a publicly accessible area of our Sites will be available to anyone who has access to that content. Service Providers . We may share information with service providers retained in connection with the provision of Sites or the Services. These service providers are only permitted to use this information to provide their services to us, not for their own purposes. Business Partners . We may share information with our partners (including resellers, referral partners, integration partners, experts in our community, or developer platform partners) for the purposes of the applicable partnership agreement or to enable our partner programs. At your request, we may provide information to business partners to provide you with a product or service of interest to you. We may also provide information to business partners with whom we jointly offer products or services. To Provide the Services, Partner Programs, and Communities . We may share information with your teammates, account administrators, billing contact, or technical account users. We will also share your information with third-party applications (at your direction or the direction of an account owner) when an account holder uses the Services. ” | Captured 2026-06-07Open source →Finding permalink → |
| Subprocessors & data sharing | All applicable tiers | low | “ (c) Zapier Extended Team : The Zapier extended team, which includes our workforce and our affiliates' workforce (the "Zapier Extended Team"), may assist us in exercising our rights and performing our obligations under these Terms. The Zapier Extended Team does not include any Third-Party Services or their personnel. We will be responsible for the Zapier Extended Team’s compliance with our obligations under these Terms.” | Captured 2026-06-07Open source →Finding permalink → |
| Tier differences | All applicable tiers | low | “ (k) " Fees " mean the fees applicable to your use of the Service in accordance with the applicable package as included in our pricing notice included in the Service or on Zapier’s website or, if applicable, as set forth in a Zapier order form.” | Captured 2026-06-07Open source →Finding permalink → |
Informational only, not legal advice. Terms can change; verify every cited source and capture date during procurement review.
📢 POLICY UPDATES ALERT
AIRIN Brief
Built for compliance officers, legal counsel, and SaaS founders. Subscribe to the email digest — one short brief when a tracked vendor materially changes its terms, training policy, or risk rating. Prefer in-app? Watch platforms in your alerts inbox instead.