Last updated: 28 September 2026
Zarpia ("we", "us", "our") helps property owners collate and organise the documents and figures relevant to their tax obligations in Spain and Australia, and — through Zarpia Worldwide — helps Australian tax residents organise the income and gains from accounts they hold outside Australia. This policy explains what data we collect, why, and how we protect it.
We use your data solely to provide the service: extracting and organising figures from your documents into a clear, structured record you can review and use however you need, and maintaining your account. We do not sell your data, and we do not use it to train AI models beyond the specific extraction task you've asked us to perform on your own documents.
If you choose to connect a Gmail account, Zarpia requests read-only access to your Gmail messages (the gmail.readonly scope). This section explains specifically what that access involves, separate from the general description above.
What we access: the content of email messages from senders you explicitly configure yourself (for example, your energy provider or property manager), and — only if you use Zarpia Worldwide — messages whose subject begins with "Investment" that you forward to your connected mailbox, together with their attachments. Zarpia never scans your entire inbox, and never accesses any other messages.
Why we access it and how we use it: to identify genuine invoices, receipts, and rental income statements matching your configured senders, and the overseas account statements you forward for Worldwide, and to extract structured figures (amounts, dates, suppliers, securities) from them into your Zarpia account. We do not use this data for any other purpose, including advertising.
Who we share it with: the content of matching messages is sent to Anthropic, our AI extraction provider, solely to extract the figures described above from that specific message — never for any other purpose, and never to train Anthropic's models on your data. We do not otherwise share, sell, or transfer your Gmail content to any other third party.
How it's protected: your Gmail OAuth tokens are encrypted at rest using AES-256-GCM before storage (see "How we protect your data" above); the connection is strictly read-only — Zarpia cannot send, delete, or modify anything in your mailbox; and you can disconnect Gmail access at any time from your account settings, which immediately revokes Zarpia's access.
Zarpia's use and transfer of information received from Google APIs adheres to the Google API Services User Data Policy, including the Limited Use requirements.
This section applies specifically to the Zarpia Android and iOS apps, in addition to everything above — each app is a native wrapper around the same Zarpia service described throughout this policy, not a separate product with its own data handling.
We keep your data for as long as your account is active. Zarpia is designed to work as your long-term document archive, not a temporary processing tool — some of the figures Zarpia tracks are only useful because they cover many years, in some cases decades. We do not automatically delete your documents or data based on their age, and we do not currently delete accounts or data due to inactivity.
You control deletion, not us. You may request permanent deletion of your account and all associated data at any time, from your account settings. Once requested, your data is retained for a further 14 days — in case you change your mind or want to export a copy first — after which it is permanently removed from our systems. We recommend exporting a copy of your data before requesting deletion if you may need it later, since deletion cannot be undone.
As the property owner, you remain responsible for retaining your own records for as long as required under the law that applies to you, which can vary depending on your circumstances. This is your own legal obligation, and continues regardless of whether or how long you keep using Zarpia.
Each of these providers has its own privacy policy governing how they handle data on our behalf.
If you're in the EU or UK, you have rights under GDPR including access, correction, deletion, and data portability. If you're in Australia, similar rights apply under the Privacy Act 1988 and the Australian Privacy Principles, including access to and correction of your personal information. Wherever you're based, you can exercise most of these rights directly from your account settings — exporting or deleting your data — or contact us using the details below for anything else.
For any privacy-related questions, contact us at privacy@zarpia.app.