Privacy policy
Last updated: 16 October 2026
This policy explains how Zpoa Inc., a Delaware corporation ("ZPOA", "we", "us"), 1309 Coffeen Avenue STE 1200, Sheridan, Wyoming 82801, USA, handles personal data when you visit our websites (zpoa.com, thoshika.com and ciyora.com), contact us, or hold an account with us. It also explains how we act when our customers use our products to process personal data.
Who is responsible
- For our websites, sales and account administration, ZPOA is the Data Fiduciary under the Digital Personal Data Protection Act, 2023 ("DPDP Act") and the controller under other laws that use that term.
- In India, Thoshika and Ciyora are sold, billed and supported by our India Authorized Partner, Qiaben Healthcare Solutions Pvt Ltd, 1/39, Veerappanur, Coimbatore, Tamil Nadu 641105, India, which handles the contact, account and billing details of Indian customers for those purposes under its agreement with ZPOA.
- For data our customers put into Thoshika or Ciyora Fabric (for example employee, payroll, customer or device data), the customer is the Data Fiduciary (in US terms, the business) and ZPOA is its Data Processor (service provider). We process that data only on the customer's instructions, under our agreement with them. If you are an employee or customer of one of our customers, please contact that organisation first; we will help them respond.
What we collect
- Contact and account details you give us: name, work email, phone number, company, job title and messages you send.
- Billing details for paying customers: billing contact, address, tax identifiers such as GSTIN, and payment records. We do not store full card numbers.
- Technical data when you use our services: IP address, device and browser type, sign-in events and security logs.
- Website data: our websites do not use advertising or third-party analytics cookies. The sites remember your colour theme in your browser, and set a cookie that remembers whether you chose the India or the United States version. We use the country of your IP address, as supplied by our hosting provider, only to show you the right version; we do not store it.
Why we use it
| Purpose | Basis |
|---|---|
| Replying to enquiries and providing demos | Your consent, which you give by contacting us, and our legitimate use of information you voluntarily provide |
| Providing, securing and supporting the services | Performance of our contract with the customer |
| Billing, tax and accounting | Compliance with law |
| Detecting and preventing fraud, abuse and security incidents | Legitimate uses permitted by law |
| Product news, where you have opted in | Your consent, which you can withdraw at any time |
We do not sell personal data, and we do not use customer data to train general-purpose AI models.
Where data is stored
Hosted in India · data stays in India. Customer data in our products, for customers in India and in the United States, is stored and processed in India. A US data region is planned; until it is available, customers in the United States should note that their customer data is hosted in India. Our public demo environments contain only sample data. Some supporting providers (for example email delivery) may process limited data, such as notification email addresses, outside India; we use providers bound by contract to protect it, and our processing follows DPDP Act 2023 obligations, including any restrictions the Government of India notifies on transfers outside India.
How long we keep it
We keep personal data only as long as needed for the purpose it was collected for, or as the law requires (for example, tax records). Customer data is deleted or returned at the end of the contract as the agreement provides.
Security
We apply reasonable security safeguards, including encryption in transit, role-based access with least privilege, tenant isolation, logging and monitoring. See Trust and security.
Your rights in India (DPDP Act)
Subject to the DPDP Act and other applicable law, you can ask us to:
- tell you what personal data we process about you and how;
- correct, complete, update or erase it;
- withdraw consent you have given (this does not affect processing before withdrawal);
- nominate another person to exercise your rights in the event of your death or incapacity.
You can also raise a grievance with us. If you are not satisfied with our response, you may complain to the Data Protection Board of India.
Grievance officer and contact
Email [email protected]. For contracts and legal notices, email [email protected]; to report a security issue, email [email protected]. We will acknowledge your request promptly and respond within the time the law requires.
Children
Our services are for businesses and are not directed at children. We do not knowingly collect personal data from children.
Changes
We will post changes to this policy on this page and update the date at the top. If a change materially affects how we use your data, we will tell account holders in advance.