Privacy policy

1. Who we are

Zenvlo ("Zenvlo", "we", "us") is based in Coimbatore, Tamil Nadu, India. We make Zenvlo CRM and Zenvlo Engage and run this website. This policy covers all three.

We play two roles. For this website, our own sales and support, and our customers' account details, we decide how information is used. For the information a business stores about its own customers in Zenvlo (its leads, contacts and conversations), that business decides how it is used and we act as its service provider, handling the data only on its instructions. If you are a customer of a business that uses Zenvlo, that business is the first place to ask about your data, and we will help.

2. What we collect

On this website

• Contact and deletion forms: name, email, phone number (optional), company (optional), topic, and what you write.
• Technical data: pages requested, browser type, and approximate location from your IP address, kept in server logs to run and protect the site.

When you create a Zenvlo account

• Your name, work email, phone, company name and role, and a password that we store only in hashed form.
• Billing details for paid plans (invoice records; card or UPI details are handled by our payment provider, not stored by us).
• Records of what you do in the product, kept in an audit trail for your workspace admins.

Data a business stores in Zenvlo about its customers

• In Zenvlo CRM: leads, contacts, companies, deals, notes, tasks, meetings, follow-ups, documents and emails that the business adds or imports.
• WhatsApp (Zenvlo Engage): phone numbers, WhatsApp profile names, the content and time of messages and media, delivery and read status, and message templates, through the official WhatsApp Business API.
• Shopify (Zenvlo Engage): for a connected store, checkout and order events and the customer contact details, cart items and order status needed to send reminders and order updates.

3. Meta platform data (Instagram and WhatsApp)

Zenvlo Engage connects to Meta's platforms only when a business turns that connection on. This section describes exactly what we do with that data.

Instagram (Instagram API with Instagram Login)

When a creator or business connects a professional Instagram account, we ask for three permissions, and use each only for the purpose below.

• instagram_business_basic. To read the connected account's ID and username, so we can show which account is connected and send each event to the right workspace.
• instagram_business_manage_comments. To receive comments on the connected account's posts and reels, match them against the creator's keyword rules, and, if the creator chose, post a public reply.
• instagram_business_manage_messages. To send a private reply to a comment that matched a rule, to send messages in conversations a person started, and to show those conversations in the creator's inbox.

What we store: the Instagram-scoped user ID and username of people who comment or message, the text of their comments and messages, the messages we sent, and the connected account's access token, which is stored encrypted. We process comments only on accounts a creator connected, ignore comments made by the connected account itself, and send a private reply only in response to a person's own comment, within Meta's allowed window, and once per comment. We do not send bulk or unsolicited messages.

WhatsApp (WhatsApp Business Platform)

Businesses send and receive messages through their own verified WhatsApp Business number. Messages that start a conversation use templates approved by Meta, and businesses must have their customers' consent to message them. We store the messages and contact details described in section 2 so the business can run its inbox, campaigns and automations.

Our commitments for Meta platform data

• We use it only to provide the features above to the business that connected it.
• We do not sell it, license it, or share it with data brokers or advertising networks.
• We do not use it for advertising, or to build profiles of people for purposes unrelated to the business's own conversation with them.
• We do not use it to train our own artificial intelligence models.
• We follow the Meta Platform Terms and Developer Policies, and WhatsApp's Business and Commerce policies.
• If a business switches on an AI agent, the text of a customer's message is sent to the AI provider that the business chose, only to write a reply.

4. How we use information

• To provide, run, secure and support Zenvlo, and to send service messages such as sign-in links, receipts and plan notices.
• To reply to your enquiries and, if you ask, to tell you about product launches such as the bundle plan. You can opt out of these at any time.
• To prevent abuse and fix faults, and to meet legal duties.
• To understand how the product is used, using aggregated information wherever we can.

Where the law requires a basis for processing, we rely on your consent, on the contract we have with you or your business, and on our legitimate interest in running a secure service.

5. Who we share it with

We do not sell personal information. We share it only with:

• Meta Platforms (WhatsApp and Instagram), to send and receive messages for a connected business.
• Shopify, for a connected store.
• Service providers that help us run Zenvlo, such as cloud hosting, email delivery, payment processing and, where a business turns on an AI agent, the AI provider it selected. They may use the information only to do their job for us.
• Authorities and advisers, where the law requires it or to protect rights and safety.
• A successor, if Zenvlo is part of a merger or sale, with the same protections.

6. How long we keep it

• Messages sent through our website forms: as long as needed to deal with your request, and for a reasonable time afterwards.
• Workspace data: as long as the account is active. After an account closes, we delete or return the data when asked, within 30 days, subject to legal requirements.
• Instagram data: removed when we receive a valid deletion request from Meta or from you. When an account is disconnected, its access token is erased and Zenvlo can no longer act for it.
• Audit records: according to the retention period of the workspace's plan, then archived or deleted.
• Invoices and tax records: for as long as the law requires.

7. Deleting your data

You can ask us to delete your data at any time. The steps, the exact list of what is deleted, how long it takes, and a tool to check the status of a request are on our data deletion page. You can also write to admin@zenvlo.com.

If you connected an Instagram account, you can remove the connection in Zenvlo and remove Zenvlo from your Instagram settings. Meta then sends us a deletion request, which we process and confirm with a code.

8. Security

We protect information with role-based access, separate workspaces, hashed passwords, encrypted access tokens and an audit trail, and we log any support access to your workspace. More on our security page. No system is perfectly secure. If we learn of a breach that affects you, we will tell you and the relevant authorities as the law requires.

9. Your rights

Subject to applicable law, including India's Digital Personal Data Protection Act, 2023, you may ask to access, correct or delete the personal information we hold about you, ask for a copy, withdraw consent you gave, and complain if you think we have mishandled your data. If your information sits in a business's workspace, we will pass your request to that business or act on its instruction. We may ask you to prove who you are before we act.

10. Cookies, children and transfers

Cookies. This website does not use advertising cookies. It uses Google Analytics, which sets cookies to count visits and see which pages are useful. Google receives your browser details and the pages you view, not your name or contact details. You can block these cookies in your browser or with Google's opt-out add-on at tools.google.com/dlpage/gaoptout.

Children. Zenvlo is for businesses and is not directed at children. We do not knowingly collect personal information from children. If you think we have, write to us and we will delete it.

Transfers. Our providers may process information in other countries. Where they do, we require them to protect it to the standard of this policy.

11. Changes

We may update this policy. We will change the date above and, for significant changes, tell account holders by email before the change takes effect.

12. Contact and grievances

For questions, requests or complaints about privacy, write to admin@zenvlo.com, call +91 93842 93940, or write to Zenvlo, Coimbatore, Tamil Nadu, India. We reply within 7 days.