This Privacy Policy explains how ZEN SYNCRO ("we", "us") handles information in connection with ZenWats, a business messaging product built on the ZenSyncro platform.
ZenWats lets a business connect its own WhatsApp Business Account to the WhatsApp Business Platform (Cloud API) and manage customer conversations from one place. This policy covers both this website and the ZenWats application.
1. Who operates this service
ZenWats is operated by ZEN SYNCRO at 16/9 SALMAN COMPLEX, MANNARPURAM - RACE COURSE ROAD, TRICHY 620020, TAMIL NADU.
For any question about this policy or about how your information is handled, contact hello@zensyncro.com.
2. Information we collect
We collect only what the product needs in order to work. The categories below reflect what the application actually stores.
- Account and organization information. The name and email address of each user, a securely hashed password, the organization name, and each user's role within that organization.
- Authentication and security records. Sign-in attempts (the email address used and the originating IP address, used to rate-limit and detect abuse), active session records, and an audit log of significant actions that may include the acting user, the action, an IP address, and browser information.
- WhatsApp Business account information. Identifiers for the WhatsApp Business Account and business phone numbers you connect — the account ID, phone number ID, display phone number, verified display name, and quality rating reported by WhatsApp.
- Access credentials. The access token issued when you connect your WhatsApp Business Account. It is stored encrypted (see Security) and is never displayed back to you or to us in readable form.
- Message and conversation data. When your WhatsApp Business Account is connected, WhatsApp sends events to our systems and we store them. These events can include message content, the phone numbers of the sender and recipient, message identifiers, timestamps, and delivery or read statuses.
- WhatsApp Business app data (only if you use coexistence onboarding). If you connect a number that is also in use in the WhatsApp Business app, WhatsApp may additionally send us your WhatsApp contacts (names and phone numbers from that account) and past message history for that number, so the two can stay in sync. This applies only to numbers onboarded through that specific flow.
- Website information. This website is a set of static pages. It sets no cookies, runs no analytics, and uses no advertising or tracking technologies. Fonts are requested from Google Fonts, which means your browser contacts Google to load them; we receive nothing from that request.
We do not collect special categories of personal data, and we do not ask you to provide them.
3. How we use information
We use the information above to:
- provide the service — sending, receiving, and organising WhatsApp conversations for your business;
- authenticate users and keep accounts secure, including rate-limiting sign-in attempts;
- route each incoming WhatsApp event to the correct organization, and to no other;
- maintain audit records so an organization can see what was done in its account;
- diagnose faults and keep the service running;
- respond to your requests and support enquiries.
We do not sell personal information, and we do not use your messages or contacts for advertising or to build profiles.
4. WhatsApp and Meta
ZenWats integrates with the WhatsApp Business Platform provided by Meta. To use the product you connect your own WhatsApp Business Account through Meta's Embedded Signup, which is operated by Meta and takes place in a Meta-hosted window.
Because the service is built on WhatsApp, information necessarily flows between us and Meta: messages you send are delivered through Meta's systems, and messages sent to your business number reach us through Meta. Meta's own handling of that information is governed by Meta's terms and privacy policy, not by this one.
We access only the WhatsApp Business assets you grant us during signup, and we use that access only to operate the product for you. We do not use it to access assets you have not connected.
6. Storage and security
The measures below are the ones actually implemented in the product:
- Passwords are stored only as salted hashes; we cannot read them.
- WhatsApp access tokens are encrypted before storage using envelope encryption — a per-secret data key, itself protected by a key held in a managed hardware security module. The database alone does not yield a usable token.
- Traffic between your browser and the service, and between the service and its database, is encrypted in transit using TLS.
- The database enforces per-organization row-level isolation, so a query made in one organization's context cannot return another organization's rows.
- Incoming WhatsApp webhooks are verified against Meta's signature before they are processed; unverified payloads are rejected.
- The application runs under a restricted system account with a read-only program directory.
No system is perfectly secure, and we do not claim certification under any particular security standard. If we become aware of a breach affecting your information, we will act on it and notify affected customers as required by applicable law.
7. Data retention
We keep information for as long as it is needed to provide the service. Specifically:
- Session records. removed 24 hours after the session expires or is revoked.
- Sign-in attempt records. removed 24 hours after they are recorded.
- Account, WhatsApp connection, message, and audit data. retained while your account is active, and until you ask us to delete it (see Data deletion).
We do not currently operate an automatic expiry for stored conversation data. If you need a specific retention period for your organization, contact us and we will agree it with you rather than leaving it implicit.
8. Your rights and choices
You can ask us to give you a copy of the personal information we hold about you, correct it if it is wrong, or delete it. You can also ask us to stop processing it, understanding that we may then be unable to continue providing the service.
To make any of these requests, email hello@zensyncro.com. We will ask you to verify your identity — or your authority to act for the organization — before we act, so that no one else can make a request about your data.
Depending on where you live, local law may give you additional rights. Nothing in this policy limits any right you have under applicable law.
9. Deleting your data
There is no self-service delete button in the product today. Deletion is handled on request, and we would rather say so plainly than imply an automated process that does not exist.
To request deletion, email hello@zensyncro.com from the address associated with your account, stating whether you want your individual user account removed or the organization's data removed in full.
- We will acknowledge your request and confirm what will be deleted before we act.
- On confirmation, we delete the account, the organization's stored WhatsApp connection details, stored credentials, and stored message and conversation data.
- Disconnecting your WhatsApp Business Account from our app at Meta is a separate step you control from your Meta Business account, and it stops further data reaching us.
- Backups are retained for a limited period for disaster recovery and are overwritten in the ordinary course; data already deleted from the live system is not restored to it.
10. Children's privacy
ZenWats is a business tool. It is not directed to children, and we do not knowingly collect personal information from a child. If you believe a child has provided us with personal information, contact hello@zensyncro.com and we will delete it.
11. International data transfers
The service is hosted in the ap-hyderabad-1 (India) region of Oracle Cloud Infrastructure, and information you provide is stored there.
Because the product operates on the WhatsApp Business Platform, information also passes through Meta's infrastructure, which is global. If you or your customers are located elsewhere, information will therefore be transferred across borders as an ordinary part of delivering messages.
12. Changes to this policy
We may update this policy as the product changes. When we do, we will update the “last updated” date at the top of this page. If a change materially affects how we handle your information, we will take reasonable steps to tell you rather than relying on you to notice.
13. Contact us
Questions, requests, or complaints about this policy or your information should go to hello@zensyncro.com.
ZEN SYNCRO, 16/9 SALMAN COMPLEX, MANNARPURAM - RACE COURSE ROAD, TRICHY 620020, TAMIL NADU.