Privacy policy

Every processor we appoint is bound to confidentiality, security standards no lower than our own, use limited to our instructions, and deletion or return of data on termination. A current list of sub-processors is available on request to privacy@zanoo.in, and we give customers notice of material changes to it.

7. Where data is stored and transferred

Zanoo data is hosted primarily in India. Some of our service providers — including Meta, the AI provider a customer chooses for Zanoo AI, and certain email, analytics and error-monitoring tools — process limited data outside India.

Where personal data leaves India, we rely on contractual safeguards (including standard contractual clauses where applicable), transfer only what is necessary, and do not transfer to any country restricted by the Central Government under the DPDP Act. Customers with data-localisation requirements should contact us before onboarding so we can confirm what we can support.

8. How long we keep data

• Account data — for as long as your account is active, then up to 90 days after closure to allow reactivation and to close out disputes.
• Conversation and contact data in your workspace — for the retention window of your plan, or as you configure it; exportable during your term and for 30 days after termination, then deleted or irreversibly anonymised within 90 days.
• Invoices, tax and payment records — 8 years, as required by Indian tax and companies law.
• Zanoo AI run records — 90 days; the customer’s knowledge for the assistant, until the customer removes it (section 10).
• Security and audit logs — typically 12 months.
• Support correspondence — 24 months from closure of the ticket.
• Marketing preferences and suppression lists — kept until you ask for erasure; a minimal suppression record is retained so we do not contact you again.

Where a legal hold, investigation or dispute applies, we retain the affected data until it is resolved. Backups roll off on their own schedule, normally within 35 days.

9. Data in a customer workspace (our processor role)

When a business uses Zanoo to talk to its customers, that business decides what to collect, what to send and how long to keep it. In that arrangement:

• The customer is the Data Fiduciary and is responsible for having valid opt-in consent for its messaging, for honouring opt-outs, and for responding to its End Users’ rights requests.
• Codexlab is the Data Processor. We process End User personal data — phone numbers, profile names, message content and media, delivery and read status, contact attributes and tags — only to run the Service for that customer, to keep it secure, to provide support, and where compelled by law.
• We do not use End User data to build our own marketing lists, we do not sell it, and we do not use message content to train general-purpose AI models. Where a customer turns on or uses Zanoo AI, content is sent to the AI provider the customer has chosen only to generate the response it asked for, as section 10 describes.
• We notify the affected customer of a personal-data breach without undue delay and in any case within 72 hours of becoming aware, with the information they need for their own notifications, and we report to the Data Protection Board of India where required.
• We assist customers with rights requests, deletion, export and audits as set out in our Terms and any data-processing addendum. Enterprise customers may request a signed DPA from privacy@zanoo.in.

If you are an End User and want your data corrected or deleted, contact the business you were messaging — they control it. You may also write to us at privacy@zanoo.in and we will route your request to that business and support them in acting on it. To stop receiving messages, reply STOP or use the opt-out option in the conversation.

10. Zanoo AI features

Zanoo AI is a set of optional features inside Zanoo that use a large language model, run by a third-party AI provider, to write text for a customer. When Zanoo AI handles End User personal data, the customer remains the Data Fiduciary and Codexlab acts as its Data Processor, exactly as described in section 9.

What Zanoo AI does

• Answers End Users, when the customer turns it on — the AI assistant reads incoming WhatsApp and Instagram messages on the numbers and accounts the customer chooses and, as the customer sets it, either replies on the customer’s behalf or writes a draft for a person on the customer’s team to approve. It passes the conversation to the team when the End User asks for a person, when it cannot answer from the customer’s knowledge, or on topics the customer has told it to leave to the team.
• Helps the customer’s team — when a team member asks, it suggests or rewrites replies, summarises conversations, fills in lead details from a conversation, drafts message templates and chatflows, and answers questions about the workspace (“Ask Zanoo”). On numbers and accounts where the assistant is on, it also summarises a conversation when it hands it to the team, fills in lead details once a conversation goes quiet, and groups the questions it could not answer into a weekly report for the customer.

It is off until the customer turns it on

The assistant does not read or answer any conversation until the customer switches it on for a specific WhatsApp number or Instagram account. The team features run only when a member of the customer’s team uses them. The customer also chooses which AI provider its workspace uses (see below).

Personal data Zanoo AI processes

• Conversation messages — the recent messages in a conversation the assistant answers or a team member asks about, and the End User’s profile name. Text and captions are sent; for photos, voice notes, documents and other media, the provider is told only what kind of media arrived, not given the file.
• The customer’s knowledge — what the customer adds for the assistant to answer from: its business profile, FAQs, price list, and the website pages and files it adds. A PDF the customer uploads is sent to the provider once, to turn it into text.
• The team’s instructions — the assistant’s settings (its name, persona, topics to hand over and lead details to collect), and the prompts, notes, corrections and questions team members type into Zanoo AI.
• Lead details — the details already held on the lead for that conversation, the customer’s custom lead fields, and the details the assistant draws from the conversation.
• Workspace records, for Ask Zanoo — short extracts of the leads, chats, templates, flows, usage, plan and ad results that the team member asking is already allowed to see in Zanoo.

The assistant answers from the knowledge the customer adds or approves, not from other End Users’ conversations, and one customer’s data is never used to answer for another customer.

AI providers

Zanoo AI uses one of three providers, chosen by the customer in its assistant settings: Anthropic, PBC (Claude), which is the default, OpenAI, L.L.C. (ChatGPT) or Google LLC (Gemini). Every Zanoo AI feature in a workspace uses the provider the customer has chosen. If that provider is unavailable, we do not switch to another one; the assistant stays silent and leaves the conversation to the customer’s team.

The customer’s own API key. A customer may instead connect its own account with one of these providers and have Zanoo AI use it. In that case the data is sent to the provider under the customer’s own agreement with that provider, which governs how the provider handles it; we store the key encrypted and use it only for the customer’s Zanoo AI requests. If the customer’s key stops working, we do not fall back to our own account.

We use these providers’ business API services, as our sub-processors. We send the chosen provider only the data a response needs, and only so that it can generate that response. Under their API terms, the providers do not use the data we send them to train their models, and they may keep it for a limited period, for example for abuse and safety monitoring or where the law requires, before deleting it. These providers process data outside India (see section 7).

How long Zanoo AI data is kept

• AI run records — the inputs and outputs we need to show what Zanoo AI did: its replies and drafts, summaries, the lead details it saved, the tools it used, the knowledge its answers relied on, and any End User question it could not answer. Kept for 90 days, then deleted automatically. For live WhatsApp and Instagram conversations, a run record refers to the messages it read rather than keeping a second copy of them; those messages, and the replies the assistant sends, are kept with the rest of the conversation data (section 8). Weekly reports of unanswered questions are also kept for 90 days.
• The customer’s knowledge — kept until the customer edits or removes it. Website pages are read again about once a week to stay current, until the customer removes the website.
• Usage counts — the number of AI replies and AI credits a workspace has used and, for AI credits, which kind of action used them and which team member asked, kept with its billing records (section 8). The workspace owner can see this breakdown in the workspace; other team members see their own use.

The customer’s responsibilities

As the Data Fiduciary for its End Users’ data, the customer is responsible for:

• telling its End Users that an AI assistant may answer them. By default, the assistant introduces itself as the customer’s AI assistant in its first reply in a conversation. A customer that turns this off must tell its End Users in another way;
• having a lawful basis under the Digital Personal Data Protection Act, 2023 and any other law that applies to it, including any notice or consent that law requires, for having its End Users’ messages processed by Zanoo AI and the AI provider it chooses, including outside India;
• the knowledge and instructions it gives the assistant, which should not include personal data or sensitive information that the assistant does not need to answer, and for reviewing the replies and drafts the assistant writes in its name.

The customer’s controls

• Switch it off at any time, for one number or account or for the whole workspace, or set it to draft replies only, so that a person approves each one before it is sent.
• Choose the provider, and change it at any time; the change applies from the next response.
• Edit or delete knowledge: removing a website or file removes it and the text taken from it from the assistant’s knowledge.
• Request deletion of AI run records or other Zanoo AI data before the end of their retention period, by writing to privacy@zanoo.in.

If you are an End User and do not want to talk to an AI assistant, ask for a person in the conversation and the assistant will hand it to the business’s team. For anything else about your data, contact the business, or write to us as section 9 explains.

Automated decisions

Zanoo AI may give a lead a score and suggest moving it to a next stage, each with its reason. These are suggestions for the customer’s team: a stage changes only when a person accepts it, and the assistant never marks a lead as won or lost. Zanoo AI does not make decisions that have legal or similarly significant effects on End Users.

11. How we protect data

We maintain reasonable security practices proportionate to the sensitivity of the data we hold, including:

• encryption in transit (TLS 1.2+, 256-bit) and encryption at rest for databases, object storage and backups;
• role-based access control, least-privilege administration, and multi-factor authentication for internal systems;
• tenant isolation so one workspace cannot read another’s data, plus scoped API keys and signed webhooks;
• secrets management, encrypted storage of Meta access tokens, and rotation on suspicion of compromise;
• audit logging of administrative and data-access events, monitoring and alerting;
• hardened deployment pipelines, dependency scanning, and security review of changes;
• regular backups with restore testing, and a documented incident-response plan;
• confidentiality obligations, background-appropriate access limits and security training for personnel.

No system is perfectly secure. Please protect your own credentials, enable multi-factor authentication, review invited users periodically, and report anything suspicious to support@zanoo.in.

12. Your rights

Subject to verification and to legal limits, you may:

• Access — ask what personal data we hold about you and how it is processed, and receive a summary.
• Correct and complete — have inaccurate or incomplete data rectified or updated.
• Erase — ask us to delete data we no longer need for the purpose it was collected, or where you withdraw consent.
• Withdraw consent — for anything based on consent, including marketing. Unsubscribe links appear in every marketing email; withdrawal does not affect processing already carried out.
• Port — receive your account and workspace data in a structured, machine-readable format, or export it yourself from the app.
• Nominate — appoint another individual to exercise your rights in the event of death or incapacity, as provided under the DPDP Act.
• Grieve — raise a complaint with us and, if unsatisfied, escalate to the Data Protection Board of India. Individuals in the EU/UK may also complain to their local supervisory authority.

Write to privacy@zanoo.in from your registered email address. We acknowledge within 24 hours and respond within 30 days, extending only where a request is complex and telling you if so. We may ask for information to verify identity, and we may decline a request that would breach law, override another person’s rights, or is manifestly unfounded or repetitive.

13. Grievance Officer and escalation

For privacy complaints, contact our Grievance Officer:

• Grievance Officer, Codexlab Enterprise Pvt Ltd
• Email: privacy@zanoo.in (subject line: “Privacy Grievance”)
• Address: Kandivali West, Mumbai 400067, Maharashtra, India

We acknowledge within 24 hours and aim to close complaints within 15 days. If you remain unsatisfied, you may approach the Data Protection Board of India under the DPDP Act, 2023.

14. Changes to this Policy

We update this Policy when our practices, our providers or the law change. The current version is always on this page with its effective date. For material changes — a new purpose, a new category of recipient, or a change in your rights — we give at least 15 days’ notice by email or in-app before the change takes effect. Continued use after that date means you accept the updated Policy.

Questions about this document?

Talk to a person about your data — we would rather answer a question early than handle a complaint later.

• Privacy, rights requests and DPAs: privacy@zanoo.in
• Product & account support: support@zanoo.in
• Security disclosures: security@zanoo.in (subject line: “Security”)

Codexlab Enterprise Private Limited · Kandivali West, Mumbai 400067, Maharashtra, India
CIN U62013MH2025PTC450983