Privacy Policy

There are two kinds of people this policy covers, and we collect different data from each:

• Agencies and their team members, who create an account, set up client workspaces, and configure AI employees.
• End customers, the people who message a business that uses Zekho Chat, on the business’s website chat, WhatsApp, Facebook Messenger, Instagram, or email. We process this data as a service provider to the business, not as our own customer relationship with that person.

• Name, email address, and a hashed password. We never store your password in a form we or anyone else could read.
• Agency and client workspace names, branding you set (logo, brand name, accent color) if you use white labeling.
• Billing details handled by our payment processor, Stripe. We store which plan you are on and Stripe's identifiers for your subscription. We never see or store your card number.
• Access tokens for any channel you connect (WhatsApp, Facebook, Instagram, or a mailbox), encrypted at rest and used only to send and receive messages on that channel.
• Files you upload to train an AI employee (documents, FAQs, pasted text, or pages your AI employee is told to read), used to answer questions about that business.
• Records of actions taken in the platform (who invited whom, who changed a setting), kept for security and support.

When someone messages a business that uses Zekho Chat, we store what is needed to answer them and to give the business a record of the conversation:

• The content of their messages, and the AI employee's or a team member's replies.
• An identifier for who they are on that channel: a phone number, a page-scoped social media ID, or an email address. Whichever the channel itself provides.
• A name, if the channel or the customer provides one, and any phone number, email, company, or note a team member adds to that customer's record by hand.
• For email specifically, the result of standard authentication checks (SPF, DKIM, DMARC) on the sender's address, so a business can tell a genuine sender from a spoofed one.
• Timestamps of when each message arrived and was answered.

This data belongs to the business the customer is messaging. We store and process it on that business’s behalf so their AI employee can answer, and so their team can see the conversation in their inbox.

• A session cookie, so a signed in user stays signed in. It identifies a session, not a person for tracking purposes, and is not shared with any advertiser.
• IP addresses, recorded briefly to prevent abuse (rate limiting) and kept longer in security logs for actions taken on an account.
• Standard server logs (timestamps, request paths, error details) used to operate and debug the platform.

We do not use third-party advertising or analytics cookies on the application itself.

• To operate the service: routing a message to the right AI employee, generating a reply, and storing the conversation.
• To bill agencies for their plan and track AI credit usage.
• To secure accounts and workspaces, including detecting abuse and enforcing rate limits.
• To provide support when an agency contacts us about their account.

We do not sell any of this data, and we do not use end customer conversation content to serve ads.

We use a small number of service providers (subprocessors) to run Zekho Chat. Each receives only what it needs to do its job:

• DeepSeek, our AI model provider, receives conversation content in order to generate a reply. It is not asked to, and we do not permit it, to use that content to train models made available to other customers.
• OpenAI receives text from a business’s uploaded knowledge base in order to generate the embeddings that let an AI employee find relevant answers.
• Stripe receives billing details needed to process a subscription payment. Card numbers go directly to Stripe; we never see them.
• Meta Platforms (WhatsApp, Messenger, Instagram) is the channel itself when an agency connects one of those accounts. See the dedicated section below.
• Our email delivery provider, used to send outbound emails on a connected mailbox's behalf and to receive inbound ones.
• Our hosting provider, which stores the database and runs the application.

We do not share data with data brokers or advertising networks.

When an agency connects a client’s WhatsApp Business number, Facebook page, or Instagram account, we receive, through Meta’s APIs, the messages sent to that account and the identifiers needed to reply (a phone number or a page-scoped user ID). We use this data solely to let the connected business’s AI employee, or a team member, read and reply to those messages, and to show that business their own conversation history.

We do not use data obtained through Meta’s platforms for advertising, and we do not sell it or share it with anyone outside the business the customer is messaging and the service providers listed above. Disconnecting a channel from the Zekho Chat dashboard revokes our access to it immediately. This use complies with Meta’s Platform Terms and Developer Policies.

We keep account and conversation data for as long as the agency’s account is active, so their team can see their own history. If an agency closes its account, we delete or anonymize their data within a reasonable period afterward, except where we are required to keep billing records for longer to meet our own legal obligations.

An agency can ask us to delete a specific customer’s conversation data at any time by contacting us at the address below.

Depending on where you live, you may have the right to ask what data we hold about you, to correct it, or to have it deleted. If you are an end customer of a business that uses Zekho Chat, the fastest way to exercise these rights is to contact that business directly, since they control the relationship with you. You can also contact us and we will help route the request.

Zekho Chat is not directed at children, and agency accounts must be created by an adult. We do not knowingly collect account data from anyone under 16.

If we make a material change to how we handle data, we will update the date at the top of this page and, where the change is significant, notify agency account holders directly.

Questions about this policy, or a request about your data, can be sent to info@zekhochat.com.