Privacy Policy
How we collect, use and protect data: yours as a business on Zenai, and your customers' when they message you.
1. Introduction
ZENAI INTELLIGENT SOLUTIONS ("Zenai", "we", "us", or "our") operates zenai.pro and related services. This Privacy Policy describes how we collect, use, disclose, and safeguard information when you use our AI customer operations platform. By using Zenai, you consent to the practices described in this policy.
2. Information We Collect
We collect: (a) Account information — business name, owner name, email address, role, and WhatsApp Business phone number you provide at registration; (b) WhatsApp message data — message content and metadata received via the Meta WhatsApp Business API, processed to generate AI responses and stored as conversation history for the dashboard; (c) Business configuration — intent scripts, product catalog, booking settings, bot personality settings, uploaded images, and other content you create within the platform; (d) Billing information — M-Pesa phone numbers, payment references, subscription status, and transaction metadata processed via TUMA; (e) Technical and diagnostic data — IP address, browser/device data, error logs, and product analytics events collected when you use the website or dashboard.
3. How We Use Your Information
We use collected information to: deliver and operate the Zenai service; route customer messages through the AI pipeline and generate automated responses; display conversation history and analytics in your dashboard; process subscription payments; send transactional emails (account alerts, billing receipts, and service notifications); provide customer support; improve the platform through aggregated, anonymised analytics; and comply with applicable legal obligations. We do not sell your personal data or use it for advertising.
4. AI Processing of WhatsApp Messages
When an end-customer sends a message to a channel connected to Zenai, that message is transmitted through the Zenai pipeline. Messages may be processed by AI providers to generate or improve a response. Message content is stored in our database as part of the conversation record and is retained per the schedule in Section 6. You, as the business operator, are the data controller for your end-customers' messages; Zenai acts as a data processor on your behalf.
5. Third-Party Services
Zenai integrates with third-party processors including: Meta / WhatsApp for WhatsApp message delivery and embedded signup; AI providers for response generation and fallback (Groq, DeepSeek and Google AI Studio); TUMA for M-Pesa subscription payments; Resend for transactional and lifecycle email; Cloudinary and Cloudflare R2 for uploaded media and file storage; Google OAuth and Google Calendar when you connect those integrations; Sentry for error monitoring; PostHog for product analytics; and Hetzner for cloud infrastructure. We do not sell personal data or use it for third-party advertising.
6. Data Retention
We retain account and configuration data while your account is active, plus up to 30 days after cancellation to allow reactivation unless you request deletion earlier. Conversation message records are retained for 90 days by default and then purged by our retention job; this period may be adjusted where a customer contract or legal obligation requires it. Uploaded product/avatar media is retained while the related account or record remains active. Billing records are retained for 7 years for tax, audit, and financial compliance. You can request deletion of eligible account data by emailing support@zenai.pro or using the account deletion flow.
7. Your Rights
You have the right to: (a) Access — request a copy of the personal data we hold about you; (b) Correction — request correction of inaccurate or incomplete data; (c) Deletion — request erasure of your personal data, subject to legal retention obligations; (d) Portability — receive your data in a structured, machine-readable format; (e) Objection — object to certain processing activities. To exercise any of these rights, email support@zenai.pro. We will respond within 30 days. End-customers of businesses using Zenai should direct their requests to the relevant business, which is the data controller for those conversations.
9. Data Security
We implement security measures including TLS for data in transit, hashed passwords and reset/invite tokens, role-based access controls, session revocation, rate limiting, webhook verification where supported, and operational monitoring. Access to production systems is limited to authorised personnel. No system is completely secure, so you should use a strong password, enable two-factor authentication where available, and notify us immediately of any suspected unauthorised access.
10. Meta / Facebook Platform Data
Zenai integrates with the Meta WhatsApp Business API. We use Facebook Login for Business only so you can connect your WhatsApp Business account to Zenai through Meta's Embedded Signup. The Meta Platform Data involved is limited to your Meta user ID, email address, profile picture and a Meta API access token, which our servers use together with our Meta app secret to manage your WhatsApp Business account and its messages. We do not store your Meta user ID, email address or profile picture. The access token is stored encrypted on our own servers (hosted by Hetzner in Germany) and is deleted when you disconnect your number. This data is never shared with our AI providers, sold, or used for advertising. We do not receive or store Facebook social graph data. You may request deletion of data related to our Meta app integration via zenai.pro/data-deletion.
12. International Transfers
Zenai is operated from Kenya. Data may be transferred to and processed in the European Union (Hetzner infrastructure in Germany), the United States (Groq and Google AI Studio for AI processing; Cloudinary for media), China (DeepSeek for AI processing) and Cloudflare’s global network (file storage). Business details such as prices and payment numbers are replaced with placeholders before a message is sent to an AI provider. These transfers are covered by appropriate data processing agreements with our sub-processors.
13. Changes to This Policy
We may update this Privacy Policy from time to time. We will notify you of significant changes via email at least 14 days before they take effect. Continued use of Zenai after the effective date constitutes acceptance of the updated policy.
14. Governing Law
This Privacy Policy is governed by the laws of Kenya, including the Data Protection Act, 2019. Any disputes arising under this policy shall be subject to the jurisdiction of the courts of Nairobi, Kenya.
15. Contact
For privacy-related questions, data requests, or complaints, contact our privacy team at: support@zenai.pro — ZENAI INTELLIGENT SOLUTIONS, Mombasa, Kenya.