Who we are
Zyaro AI operates an AI-powered sales and customer engagement platform enabling businesses to automate conversations across WhatsApp, voice, and email channels. This policy applies to our business customers, their team members, and end customers whose conversations are processed through Zyaro on behalf of our customers.
We comply with India's Digital Personal Data Protection Act, 2023 (DPDPA). Under DPDPA, Zyaro acts as a Data Processor on behalf of its business customers, who are the Data Fiduciaries. End customers whose data is processed should contact the relevant business customer (Data Fiduciary) for queries about how their data is used.
Data we collect
Account & authentication data
Name, email address, phone number, organization name, and login credentials (passwords are hashed; never stored in plain text). Google account details if you use Google SSO.
Conversation & engagement data
WhatsApp messages, email threads, voice call recordings, transcripts, AI-generated summaries, call recaps, and agent notes.
Contact & lead data
Customer profiles including names, phone numbers, email addresses, and custom attributes imported or captured through the platform.
Usage & diagnostic data
Actions taken in the platform, workflow configurations, API logs, error logs, and WebRTC call quality diagnostics.
Integration data
CRM data synced via HubSpot, Salesforce, or Zoho connectors; Gmail metadata from connected accounts.
We do not knowingly collect sensitive personal data (financial records, health information, government IDs) unless explicitly provided in conversation content.
How we use your data
| Purpose | Legal basis |
|---|---|
| Delivering platform features and AI agent responses | Contract |
| Processing conversations through AI/LLM models | Contract / Legitimate interest |
| Generating call summaries, engagement insights | Contract |
| Monitoring service health, debugging, diagnostics | Legitimate interest |
| Sending operational notifications (escalations, alerts) | Contract |
| Improving our models and services | Opt-in consent only |
| Fraud prevention and security | Legitimate interest |
| Legal compliance | Legal obligation |
AI & LLM processing
Zyaro uses large language models (currently Google Gemini) for conversation agents, summaries, and insights. Conversation data is sent to these models for inference only.
We do not use your data to train AI models unless you explicitly opt in. You may withdraw consent at any time by contacting us.
WhatsApp message storage
Zyaro stores WhatsApp messages for 30 days by default (configurable per organisation). However, users should be aware of additional storage at the infrastructure level.
Meta Cloud API notice. WhatsApp messages are also transiently stored by Meta's Cloud API infrastructure as part of message delivery. This storage is independent of Zyaro's systems and is governed by Meta's own data policies. Meta automatically deletes these messages within 30 days of delivery. For details, refer to Meta's WhatsApp Cloud API FAQ.
In practice, this means WhatsApp messages may exist in three locations:
| Location | Retention |
|---|---|
| Zyaro's systems | 30 days default, configurable per org |
| Periskope (our WhatsApp infrastructure provider) | Per their retention policy |
| Meta's Cloud API | Up to 30 days, deleted automatically post-delivery |
Data sharing
We share data only with the following categories of processors:
| Category | Processors / details |
|---|---|
| Infrastructure | Google Cloud Platform (storage, compute), Render (hosting) |
| Communication | Plivo, Periskope (WhatsApp); LiveKit, Ringg, Bolna (voice calls) |
| AI inference | Google Gemini (inference only — not used for model training) |
| CRM integrations | Only when you configure a connector (HubSpot, Salesforce, Zoho) |
| Legal / regulatory | When required by law, court order, or to protect rights |
We do not sell personal data to third parties.
Data retention
| Data type | Retention period |
|---|---|
| Account & profile data | Duration of subscription + 30 days post-closure |
| Conversation & message data | 12 months (configurable per org) |
| WhatsApp messages | 30 days by default (configurable) |
| Voice recordings & transcripts | 90 days by default (configurable) |
| Usage logs & diagnostics | 30 days |
| Security incident records | 3 years |
On account termination, all your data is permanently deleted within 30 days unless you request otherwise in writing.
Security
- AES-256-GCM encryption for stored credentials and OAuth tokens
- TLS encryption for all data in transit
- Access controls scoped strictly to your organisation
- Regular security reviews
In the event of a breach affecting your data, we will notify you within 72 hours of becoming aware.
Your rights
Under DPDPA 2023, you have the right to:
- Access the personal data we hold about you
- Correct inaccurate data
- Erase your data (subject to legal retention obligations)
- Withdraw consent at any time
- File a complaint with the Data Protection Board of India
As Zyaro acts as a Data Processor, requests related to data processed on behalf of a specific business customer will be directed to that customer (the Data Fiduciary). We will assist in facilitating such requests wherever possible.
Changes to this policy
We will notify you of material changes by email or in-app notice at least 14 days before the change takes effect.
Grievance officer
In accordance with the Digital Personal Data Protection Act, 2023 (DPDPA), Zyaro Technologies Private Limited has appointed a Grievance Officer to address any concerns or complaints regarding the processing of personal data.
- Name
- Vaibhav Munjal
- Designation
- Co-Founder & CEO, Zyaro Technologies Private Limited
- vaibhav@zyaro.ai
- Website
- www.zyaro.ai
If you have any grievance regarding the collection, storage, processing, or use of your personal data by Zyaro, you may contact the Grievance Officer in writing. We will acknowledge your complaint within 48 hours and endeavour to resolve it within 30 days of receipt.
If your grievance is not resolved to your satisfaction, you may escalate it to the Data Protection Board of India once constituted under the DPDPA.
Contact
- Company
- Zyaro Technologies Private Limited
- zoya@zyaro.ai
- Website
- www.zyaro.ai