Privacy

Last updated 1 October 2026

Zapfront is owned and operated by Ryan McDonnell, a sole proprietor. References to ‘we,’ ‘us,’ and ‘our’ in this Privacy Policy refer to Ryan McDonnell operating Zapfront.

We collect your email so you can sign in, public information from your Instagram account so we can build your website, and whatever you type into your site's settings. We sell nothing to anyone, we run no advertising trackers and no analytics, and you can have any of it deleted.

Zapfront builds and hosts websites for businesses whose public presence is on Instagram. This page covers zapfront.com, the sites we build at yourname.zapfront.com, and the editor you change them in. Questions about any of it go to ryan@zapfront.com.

What we collect

Your email address

Given when you claim a site. It is how you sign in — we never set a password and never ask for one — and how we reach you about your site.

Public information from Instagram

Your handle, display name, bio, profile photo and your most recent posts: their images, captions and dates. We read this from your public Instagram profile, the same page anyone can open without logging in. If you connect your account, we read the same things through Instagram's API instead.

What you type

Your business name, description, phone number, email address and street address, your banner and the links to your other profiles, plus your choices of template, colours and images. Images you upload are stored alongside your site's files.

Messages through a site's contact form

When a visitor to a website we host sends its contact form, we pass their name, email address and message to that business by email, through Resend, with the visitor's address to reply to. We keep no copy of the message.

Ordinary server records

IP address, browser user agent and timestamps, in server logs. We use them to keep the service up and to enforce rate limits.

We do not ask for, and do not want, payment card numbers, government identifiers, or any special category of personal data.

Connecting your Instagram account

Connecting is optional, and it happens only after your site is already live. Your site works whether or not you ever connect it.

When you do, we ask Instagram for one permission — instagram_business_basic, which is read-only access to your profile and your media. We store an access token, your Instagram account ID and your handle. We use the token for exactly one thing: reading your profile and recent posts so your website stays current.

We do not post, comment, send messages or read your messages. We could not if we wanted to — we did not ask for permission to.

You can disconnect whenever you like by removing Zapfront on Instagram, under Settings → Apps and websites. That ends our access immediately, and Instagram tells us so we delete the connection. What each kind of deletion covers is set out on Deleting your data.

Who else handles it

We use a small number of providers, and only to run the service:

• Supabase — the database holding your account and site records, and the issuer of your sign-in links.
• Resend — sends our email.
• DigitalOcean — the server your website runs on.
• Cloudflare — DNS for zapfront.com and for customer domains.
• Google Places — when you type into the address or business search in your site's settings, what you type is sent to Google to offer matches. And when we build a site or a preview from an Instagram account, we look up that business's public Google listing by its name (and its town, if its bio names one) to show its phone number, address and opening hours, and we check an address its bio gives against Google's maps before showing it.
• Meta — besides the connection you can make yourself, we read public Instagram business and creator profiles, and public Facebook Pages, through Meta's own APIs, by the account's name. That is how a site or a preview gets its photos, and sometimes its phone number, address, email and opening hours.
• Hugging Face and Groq — when we build a site or a preview, the Instagram bio is sent through Hugging Face to an AI model run by Groq, which sorts its lines into hours, address, phone, email and the rest. They process it on our behalf.
• IPRoyal — the network connection we use to read public Instagram pages.
• Google Maps — a website we build that has an address shows Google's map of it. The map loads from Google only when a visitor scrolls to it, and Google then receives that visitor's IP address and handles it under Google's privacy policy.

We do not sell personal information, we do not share it for advertising, and there are no analytics or advertising trackers of any kind on this site or on the websites we build. The one thing a website we build loads from anyone else is that map, and only when the site has an address. We may disclose information if the law requires it.

Cookies and local storage

One cookie, zf_session. It is set when you sign in, it is httpOnly — no script running on the page can read it — and it lasts 90 days, so a product you visit rarely does not make you sign in every time. Nothing here is used for tracking.

Your browser also keeps your own preferences, such as light or dark theme, in local storage. That never leaves your browser.

How long we keep it

• Your site's data, for as long as your site exists.
• Instagram access tokens, until you disconnect, or until Instagram expires them — 60 days without use.
• Anonymous previews expire within seven days, after which they are no longer served.
• Server logs, short-term, for operations.

Your choices

Ask us for a copy of what we hold, ask us to correct it, or ask us to delete it, at ryan@zapfront.com. Deleting your data explains what each kind of deletion covers and how to ask for it.

If you are in the EU or UK, or in California, your local law gives you specific rights — access, correction, deletion, portability and objection among them. Use the same address to exercise any of them. We do not charge for it and we will not treat you differently for asking.

Children

Zapfront is a product for businesses. It is not directed at children, and we do not knowingly collect data from anyone under 13.

Changes

We will change this page when the product changes, and update the date at the top. The Instagram section in particular will change when we move from reading public profile pages to reading the API.

Zapfront is not affiliated with, endorsed by or sponsored by Instagram or Meta.