Privacy Policy

We collect the following information to provide our services:

• Full name and contact information
• Email address and phone number
• Company information (optional)
• IP address and browser information
• Service usage data
• WhatsApp Business account data (phone numbers, message metadata)
• CRM integration data (contacts, deals, activities)
• Messages and account details from the Instagram, Facebook Messenger and WhatsApp channels that businesses connect (see section 3)

We use the collected information for the following purposes:

• Providing and improving our services
• Customer support and communication
• Security and fraud prevention
• Meeting legal obligations
• Statistical analysis and service optimization
• Personalizing user experience

Businesses can connect their Instagram professional accounts, Facebook Pages and WhatsApp Business accounts to ZenWapp through Facebook Login for Business or WhatsApp Embedded Signup. When they do, we receive the following data from Meta Platforms, Inc. and Meta Platforms Ireland Limited ("Meta"):

• Account and Page details: Instagram account ID, username, name and profile picture; Facebook Page ID, name, category and picture; WhatsApp Business account and phone number details
• Access tokens that let ZenWapp work on the connected account. They are stored encrypted (AES-256-GCM) and are never shown to anyone
• The app-scoped ID of the Facebook user who connected a Facebook Page or Instagram account, used only to process that person's data deletion requests
• Messages sent to and from the connected account (text, attachments, reactions, read receipts) and the sender's name, username and profile picture as provided by Meta

How we use this data

• To show the business's conversations in its ZenWapp inbox and let its team reply to customers who wrote to the business first, within the messaging windows Meta allows
• If the business turns on AI features, message content is sent to our AI service providers only to generate replies for that business
• We do not sell Meta data, use it for advertising or profiling, or share it with anyone other than the service providers listed in section 6
• When a customer unsends an Instagram message, it is removed from the business's inbox. For security and legal reasons, such as evidence of fraud or abuse, its original content is kept in a restricted record that is not shown in the inbox, can be accessed only by authorized ZenWapp staff when legally required, and is deleted together with the channel's conversation history. Media from Instagram story mentions is not copied to our servers

Retention and deletion

• Meta data is kept while the channel is connected. When a business removes an Instagram or Messenger channel in ZenWapp, the channel, its conversation history and its stored attachments are deleted. WhatsApp conversation history is retained as described in section 7
• If you remove ZenWapp from your Facebook account (Settings & privacy → Settings → Apps and websites) and ask for your data to be deleted, we disconnect the Facebook Pages and Instagram accounts you connected and delete their access tokens and your Facebook ID. Meta gives you a confirmation code to check the status of your request. To also delete conversation history, remove the channel in ZenWapp or write to [email protected]
• Your use of Instagram, Facebook and WhatsApp is also governed by Meta's own privacy policy

We implement the following measures to protect your data:

• SSL/TLS encryption (HTTPS) for all data in transit
• AES-256 encryption for data at rest
• Regular security audits and penetration testing
• Role-based access control and limited authorization
• Firewall and DDoS protection
• Automated backup and disaster recovery procedures

We may share your data with third parties in the following cases:

• Service providers (hosting, payment processing, WhatsApp Business API providers)
• CRM platform providers (e.g., Bitrix24) as part of integration functionality
• Meta (Instagram, Facebook Messenger, WhatsApp), to send and receive messages through the channels you connect
• AI service providers (Anthropic, OpenAI, Google), only when you turn on AI features, to generate replies for your business
• Legal requirements and regulatory compliance
• With your explicit consent

We never sell your data to third parties for marketing purposes.

We retain your personal data only for as long as necessary to fulfill the purposes for which it was collected, or as required by applicable laws and regulations.

When your account is terminated, you may request export of your data within 30 days. After this period, your personal data will be securely deleted or anonymized, except where retention is required by law.

Under applicable data protection laws (including GDPR and KVKK), you have the following rights:

• Right to access your personal data
• Right to rectification or erasure of your data
• Right to object to data processing activities
• Right to data portability
• Right to restrict processing
• Right to withdraw consent at any time

To exercise your rights, please email us at [email protected].

Your data may be processed and stored on servers located outside your country of residence. We ensure that any international data transfers comply with applicable data protection laws and that adequate safeguards are in place, including standard contractual clauses and encryption measures.