Zippy

Privacy policy

Last updated October 1, 2026

Zippy (zippy.sp-ce.co) is an internal workspace operated by SP-CE for its team members. This policy explains what information Zippy collects, how it is used, and the choices you have. Zippy is invitation-only; it is not offered to the general public.

Information we collect

Account information

  • Your name, email address and profile photo.
  • Sign-in data: passkeys, two-factor authentication settings, and session details (such as IP address and browser type) used to keep your account secure.

Work information

  • Content you and your team add, such as time entries, projects, clients, briefs, comments and notifications.

Google account and calendar data

If you choose to connect a Google account, Zippy asks for permission to access your Google Calendar. Connecting is optional. With your permission, Zippy may access:

  • Your basic Google profile (name, email address and profile photo) to identify the connected account. If you don't have a Zippy profile photo yet, we may use your Google photo.
  • The list of calendars in that account.
  • Events on those calendars, including their times, titles, locations, attendees and availability, and the ability to create, update and delete events.

SP-CE Google Workspace mail and calendars (assistants)

Two optional assistants work inside SP-CE's own Google Workspace, set up by SP-CE's Workspace administrator (not through a Google sign-in). They only ever act on sp-ce.co mailboxes and calendars:

  • The scheduling assistant reads the emails sent to its own mailbox (scheduling@sp-ce.co), reads team members' free/busy times, and creates, moves or cancels meetings on the calendar of the team member who asked for them.
  • The email ghostwriter, for team members it is switched on for, reads new emails in their inbox and writes reply drafts there for them to review. It never sends email. With an admin's approval it can read up to 100 of their sent emails once to describe their writing tone.

Each assistant is off until an admin gives a team member access, and team members can switch theirs off at any time. People outside SP-CE who email with the team may have their name, email address and message text processed this way.

People who book time with a team member

If someone books a meeting through a Zippy scheduling link, we collect the name, email address and answers they provide in the booking form, so the meeting can be scheduled and confirmed.

How we use Google user data

Zippy uses Google Calendar data only to provide calendar features you turn on, such as:

  • Blocking time on one of your calendars when you are busy on another (for example, adding a "Busy" block to your work calendar for a personal appointment).
  • Adding buffer time around events that have a location.
  • Placing and adjusting time blocks you set up, such as focus time or lunch.
  • Showing your availability on scheduling links and creating events when someone books a meeting.
  • Showing your calendars to you inside Zippy.

When a scheduling link includes several team members, Zippy checks only whether each person is free or busy. Event details are never shown to other team members or to the person booking.

Zippy's use and transfer to any other app of information received from Google APIs will adhere to the Google API Services User Data Policy, including the Limited Use requirements.

In particular:

  • We do not sell Google user data.
  • We do not use Google user data for advertising, and we do not share it with advertisers or data brokers.
  • We do not use Google user data to develop, improve or train generalized AI or machine learning models.
  • People at SP-CE do not read your Google user data, except with your explicit permission, when needed for security or to comply with the law.

How we share information

We do not sell personal information. We share it only:

  • With service providers that run Zippy on our behalf: Railway (hosting and database), Cloudflare (file storage), Resend (email delivery), Google (calendar and Workspace features), Anthropic (the Claude AI that reads email threads and writes drafts and scheduling replies for the assistants) and Slack (notifications to team members who link their account). They process data only to provide their service to us; Anthropic does not use it to train its models.
  • Within your team, as the product requires (for example, a brief you are assigned to is visible to its creator and admins).
  • When required by law, or to protect the security of Zippy and its users.

How we protect information

  • All traffic is encrypted in transit (HTTPS).
  • Access tokens for connected Google accounts are encrypted before they are stored.
  • Workspace access is limited to sp-ce.co accounts, and every time an assistant acts as someone it is logged.
  • Each person's calendar data is private to them and enforced on our servers, not only in the interface.
  • Every account is protected by two-factor authentication.

Retention and deletion

  • You can disconnect a Google account in Zippy at any time. When you do, we delete its access tokens and the calendar data we stored for it, and remove the blocks Zippy created where possible.
  • You can also revoke Zippy's access from your Google account permissions.
  • To delete your Zippy account and its data, email roberto@sp-ce.co. We delete it within 30 days, except where we must keep records by law.

Cookies

Zippy uses only essential cookies to keep you signed in, and your browser's local storage for preferences such as the color theme. We do not use tracking or advertising cookies.

Children

Zippy is a workplace tool and is not intended for anyone under 16.

Changes

If we change this policy, we will update the date above. For significant changes, we will let team members know in Zippy or by email.

Contact

Questions or requests about your data: roberto@sp-ce.co.