Privacy Policy

Last updated: 18 August 2026

1. Who we are

Zeno is a business software suite operated by Zeno Technologies Pvt. Ltd., registered at [Registered office address, city, postal code, country] under company number [Company registration number]. Where this policy says "we", "us", or "Zeno", it means that company.

The platform covers ten connected products — Work, CRM, Dev, Campaigns, Desk, Docs, Automate, HR, POS, and Finance — used by businesses to run their operations and to communicate with their own customers over email, SMS, voice, and the WhatsApp Business Platform.

Questions about this policy, or any request under it, go to privacy@zenohq.io. We answer, and we answer from a person.

2. The two roles we play, and why the distinction matters

Almost every complaint about a policy like this one comes from blurring two different relationships. We will separate them at the start.

When a business signs up for Zeno, we are the controller. We decide what account data we need, how long we keep it, and why. That covers the person who created the workspace, their colleagues, the billing contact, and anyone who writes to our support team. Sections 3.1, 3.4, and 12 apply to you directly.

When that business uses Zeno to talk to its own customers, we are the processor. The business is the controller. It decides who to contact, what to say, on what legal basis, and how long to keep the record. We supply the machinery and act on that business’s instructions. We do not decide to message you, and we do not use what is in those conversations for any purpose of our own.

So if you are a member of the public who received a WhatsApp message from a business running on Zeno, that business is who holds your data and who your rights are exercised against. We will not use this as a way to avoid you. Write to privacy@zenohq.io and we will identify the relevant customer, pass your request on, and confirm to you that we have done it.

3. What we collect

3.1 Account and workspace administration

Name, work email address, organisation name, job role, and the role assigned inside the workspace. Passwords are stored only as hashes, handled by our authentication provider; we cannot read them. If you sign in through a third-party identity provider, we receive your email address and display name from it and nothing else.

For paid plans we hold a billing contact, subscription state, and invoice history. Payment is processed by Paddle as merchant of record. Full card numbers never reach our systems.

3.2 Content your business puts into the platform

Contacts and companies, deals, support tickets, documents, tasks, invoices, product catalogues, employee records, and anything else a customer chooses to store. We do not inspect this content, we do not mine it, and it is isolated per organisation at the database level so that one customer cannot read another’s.

3.3 Messaging data, including WhatsApp

This is the category most people care about, so it is set out in full rather than summarised. When a business connects a WhatsApp Business Account to Zeno and exchanges messages with someone, we receive and store:

• The phone number of the person messaging the business, in the WhatsApp account identifier format Meta supplies.
• The WhatsApp profile name, where the sender has set one and Meta includes it in the delivery payload.
• Message content — the text of what was sent, in both directions, together with timestamps and the identifier Meta assigns to each message.
• Media — images, voice notes, audio, video, documents, and stickers. Meta does not send us the file. It sends an identifier, which we exchange for a temporary download link that expires within minutes. We fetch the bytes and store them in a private storage bucket, because the link dies and the conversation does not: a colleague opening that thread next month still needs to see the photo a customer sent.
• Interpretations we derive from media. Voice notes are transcribed to text. Images are described in words. This is done so that the message is searchable, and so that an assistant can act on it — someone who sends a photo of a damaged product should not be met with a grey placeholder. Section 8 names the providers that perform this and on what terms.
• Delivery and read receipts, and any failure reasons Meta reports back.
• Conversation state, including when the 24-hour customer service window opened and when it expires.

We also store configuration belonging to the business rather than to any individual: its WhatsApp Business Account identifier, phone number identifier, verified display name and number, quality rating, and its API access token. That token is encrypted at rest and is never rendered back into the interface after it is saved.

The equivalent applies to the other channels. SMS carries phone numbers and message bodies through Twilio. Voice calls carry call audio, transcripts, and call metadata. Email carries addresses, subject lines, bodies, and delivery events.

3.4 Information collected automatically

IP address, browser and device type, operating system, pages visited, actions taken inside the application, and timestamps. We collect diagnostic data when something breaks — a stack trace and the request that caused it — and aggregate product usage to understand which features are worth continuing to build.

Consent records are a deliberate exception to data minimisation. When someone opts in or out, we store the IP address, user agent, and country alongside the record. That is not profiling. It is evidence, and without it a business cannot demonstrate that permission was ever given, which is the first thing a regulator asks for.

4. Where the data comes from

Most of it comes from you or from our customers directly. We also receive data from Meta when someone messages a business through WhatsApp, from Twilio on inbound calls and texts, from email providers reporting delivery outcomes, and from any integration a customer connects on their own initiative. We do not buy contact lists, and we do not enrich records from data brokers.

5. How we use it

• To operate the platform, authenticate you, and keep your workspace available.
• To deliver the messages a customer sends, and to route inbound messages to the right conversation, ticket, or agent.
• To generate the assistant features a customer has turned on — drafting a reply, summarising a thread, extracting a delivery address from a paragraph of text.
• To bill for the service and meet tax and accounting obligations.
• To keep the platform secure: detecting abuse, investigating incidents, rate limiting, and verifying that inbound webhook traffic genuinely originated from the provider it claims.
• To provide support when someone asks for it.
• To improve the product in aggregate — which features are used, and where people get stuck.
• To comply with a legal obligation or a valid, lawful order.

Our lawful bases, where the GDPR or a comparable regime applies, are: performance of a contract, for operating the service and billing; legitimate interests, for security, diagnostics, and aggregate product improvement; consent, for marketing communications and non-essential cookies; and legal obligation, for financial record keeping. For data we process on a customer’s behalf, the lawful basis is theirs to determine and record — the platform stores it against every consent entry.

We do not sell personal data. Not to advertisers, not to brokers, not under any definition of "sale" or "share" used by California or any other state privacy law. We do not run behavioural advertising, and we do not use the content of customer conversations to target anything.

6. WhatsApp Business Platform

This section exists because WhatsApp has rules of its own that sit on top of everything above, and because people are entitled to know how a channel they use for family and friends came to carry a message from a business.

Opt-in comes first. A business may only message someone on WhatsApp who has given it permission to do so, through a channel where the WhatsApp name and the purpose were made clear. Our customers agree to this contractually before the channel is enabled, and the platform records each permission with its source, timestamp, and wording.

The 24-hour window is enforced in code, not in guidance. Once someone messages a business, a 24-hour window opens in which the business may reply freely. After it closes, the platform refuses to send free-form messages and permits only templates that Meta has reviewed and approved in advance. This is not a setting a customer can switch off.

Data from Meta is used only to run the messaging feature. Information we receive through the WhatsApp Business Platform is used to deliver, display, and respond to those conversations, and for nothing else. We do not combine it with data from other sources to build advertising profiles, we do not share it with other Zeno customers, and we do not transfer it to anyone outside the sub-processors listed in section 8.

Inbound traffic is verified. Every webhook delivery is checked against a signing secret before it is processed, and messages addressed to a phone number that no customer has connected are discarded rather than stored.

7. Artificial intelligence and automated processing

Assistant and automation features are central to the platform, so we will be specific about what happens rather than gesture at "AI-powered".

Customers build agents in the Automate application and grant each one an explicit set of capabilities and channels. An agent granted the WhatsApp channel can read the conversation it is assigned to and draft or send replies within it. An agent granted voice can take a call. Nothing is implicit: an agent that has not been granted a capability cannot use it, and every grant is recorded.

To produce a response, we send the relevant context to a model provider. That context is:

• The conversation the agent is working in.
• Records retrieved from the customer’s own workspace by semantic search, scoped to that organisation. Retrieval cannot cross an organisation boundary.
• The instructions the customer wrote for that agent.

Voice notes are sent to a speech-to-text provider for transcription, and images may be sent to a vision model for description, as described in section 3.3.

We do not train models on customer content. We do not build our own models from what passes through the platform, and we contract with our model providers on terms that prohibit them from using data we send to train theirs. Search indexes are built per organisation and are never pooled.

There is a human in the loop where it counts. Actions an agent proposes can be routed to an approval queue with a deadline before they take effect, and every action an agent takes is written to an audit log the customer can read. Automated processing here supports staff; it is not used to make decisions producing legal or similarly significant effects on an individual. If you believe an automated decision has affected you in that way, section 12 covers your right to contest it and to obtain human review.

8. Who we share data with

We use the sub-processors below to run the service. Each is bound by a written agreement limiting them to processing on our instructions, with confidentiality and security obligations that survive termination. We do not disclose personal data to anyone else for their own purposes.

Beyond this list, we disclose personal data only in three situations: where a customer instructs us to, for example by connecting an integration of their own; where we are required by law, by a binding order, or in order to establish or defend a legal claim; and in a merger or acquisition, in which case the acquirer is bound by this policy and affected customers are notified before any transfer completes.

This page is the current sub-processor list. Customers are notified before a new sub-processor is added, and may object under the Data Processing Addendum.

9. International transfers

Zeno operates across regions, and several providers in section 8 are based in the United States. Where personal data originating in the European Economic Area, the United Kingdom, or Switzerland is transferred outside it, we rely on the European Commission’s Standard Contractual Clauses, with the UK International Data Transfer Addendum where applicable, together with the supplementary technical measures described in section 13. Copies of the clauses we use are available from legal@zenohq.io.

10. How long we keep things

Retention is enforced by scheduled jobs against rules stored per data category, not left to someone remembering to run a cleanup. Customers can tighten these periods for their own workspace; they cannot extend them past the statutory maximum.

11. Consent and opting out

To stop WhatsApp messages from a business: reply to the conversation asking it to stop, or reply STOP. The request is recorded against that contact and the business is prevented from sending further marketing messages to that number. Businesses using Zeno are contractually required to honour it, and the platform enforces it rather than relying on someone to action it by hand.

The same applies on every channel. Email carries an unsubscribe link in each marketing message and supports one-click unsubscribe. SMS honours STOP. Preferences can also be set per topic and per channel through a preference centre, so someone can keep receiving delivery notifications while declining promotions, rather than facing an all-or-nothing choice.

Withdrawing consent does not affect the lawfulness of anything sent beforehand, and it does not stop service messages a business must send you to fulfil something you asked for, such as an order confirmation or an appointment reminder.

Every change is written to an append-only record chained by checksum, so a consent history can be shown to be complete and unaltered. This matters in the direction you would expect: it makes it hard for anyone, including us, to quietly delete the evidence that you said no.

12. Your rights

Depending on where you live, you have some or all of the following rights over your personal data:

• Access — a copy of what is held about you, and an explanation of why.
• Rectification — correction of anything inaccurate or incomplete.
• Erasure — deletion, where there is no overriding obligation to keep it.
• Restriction — a pause on processing while a dispute is resolved.
• Portability — your data in a structured, machine-readable format.
• Objection — to processing based on legitimate interests, and at any time to direct marketing.
• Withdrawal of consent — at any time, as easily as it was given.
• Human review — of any decision made solely by automated means that significantly affects you.

If you are in California, you additionally have the right to know the categories of personal information collected and disclosed, the right to correct and to delete, the right to limit the use of sensitive personal information, and the right to opt out of sale or sharing. We do not sell or share personal information, so there is nothing to opt out of, but the right exists and we will confirm that position in writing on request. We will not discriminate against you for exercising any right.

How to exercise them. Write to privacy@zenohq.io. For deletion specifically, step-by-step instructions are here, including what survives an erasure request and why. We acknowledge within 5 working days and respond within 30 days, extending only where a request is genuinely complex, and telling you if that happens. We may need to verify your identity first, and we will ask for the minimum needed to do it.

If your data sits inside a customer’s workspace — the usual case for anyone who received a message from a business — the request belongs to that business as controller. Send it to us anyway if you cannot identify or reach them. We will locate the customer, forward it, and confirm to you that we have. The platform gives them a data inventory tool for exactly this, so the answer is a lookup rather than a search party.

You also have the right to complain to your data protection authority. We would rather you came to us first, but it is your right and we will not obstruct it.

13. How we protect it

• TLS 1.3 in transit on every connection. Encryption at rest with managed keys.
• Tenant isolation enforced in the database itself through row-level security, so a query cannot reach another organisation’s rows even if application code is wrong.
• Third-party credentials — WhatsApp access tokens, integration keys — held encrypted in a dedicated store, never written into workflow definitions and never exposed back through the interface.
• Signature verification on inbound webhooks. Unrecognised traffic is dropped.
• Media held in private buckets, reachable only through short-lived signed URLs rather than public links.
• Role-based access control, with administrative actions written to an append-only log.
• Encrypted backups, with restores tested rather than assumed.

On certifications, plainly: SOC 2 Type II is in progress and we are not claiming it until the report exists. ISO 27001 is planned to follow. We would rather tell you the true status than display a badge we have not earned.

If a breach affects personal data, we notify affected customers without undue delay, and within 72 hours of becoming aware where the law requires it, with what we know, what we do not yet know, and what we are doing about it. Security issues can be reported to security@zenohq.io; we triage within two working days and will not pursue good-faith research.

14. Children

Zeno is a business tool and is not directed at children. We do not knowingly collect personal data from anyone under 16. If we learn that we have, we delete it. If you believe a child’s data has reached us, write to privacy@zenohq.io and we will act on it promptly.

15. Cookies

We set four cookies, three of which are required to keep you signed in. There are no advertising cookies and no third-party trackers on the marketing site. The full list, with the purpose and retention of each, is in the Cookie Policy.

16. Changes to this policy

When this policy changes, the date at the top changes with it. For material changes — a new category of data, a new purpose, a new sub-processor handling message content — we notify account holders by email at least 30 days before the change takes effect, so there is time to object or to leave. We do not make material changes quietly and backdate them.

17. Contact

Privacy questions and data rights requests: privacy@zenohq.io
Contractual and DPA matters: legal@zenohq.io
Security reports: security@zenohq.io
Product support: support@zenohq.io

Postal: Zeno Technologies Pvt. Ltd., [Registered office address, city, postal code, country].

See also our Terms of Service, our Data Processing Addendum, our Cookie Policy, and the step-by-step instructions for how to delete your data.