Last updated: October 11, 2026 · A product of ZenbitX LLC

Zenbichat Privacy Policy

This policy explains how Zenbichat, operated by ZenbitX LLC, collects, uses, stores, shares and protects information across our website, unified inbox, AI Agent, CRM, orders and integrations.

We never

  • Sell personal data
  • Use your customers' conversations for advertising
  • Show one business's data to another

We always

  • Ask for consent before using data for AI training
  • Let you withdraw consent without losing the service
  • Let you access, export or delete your data

What we collect, and in what role.

ZenbitX LLC is the controller for account and usage data. Merchants are the controllers for their end-customer data; Zenbichat processes it on their instructions. Merchants are responsible for privacy notices, lawful collection, messaging consent and opt-outs.

Account and billing

We are the controller

Details about you and your team, used to run your subscription.

What we collect

  • Name, email, phone, authentication data and business details
  • Workspace, team roles and permissions
  • Subscription plan, invoices and transaction records
  • Payment details processed by payment providers; we do not store full card numbers

Why we use it

To create your workspace, manage your subscription, process payments and keep your account secure.

Your customers' conversations

We are your processor

Content that flows in from the channels and stores you connect.

What we collect

  • Messages, images, voice notes, attachments and opt-in status
  • Customer names, phone, email, channel IDs, tags and notes
  • Hot/Warm/Cold lead scores, pipeline stages, orders and courier tracking
  • Product catalog, knowledge base, AI instructions and follow-up schedules

Why we use it

Only to provide the unified inbox, AI replies, CRM, order and delivery tools, reporting and integrations, on your instructions.

Technical and usage data

We are the controller

Information generated when you use the dashboard, website and API.

What we collect

  • IP address, device type, browser and operating system
  • Log files, timestamps and usage behaviour
  • API usage data
  • Generated outputs kept for service delivery and quality assurance

Why we use it

To keep the service reliable, prevent fraud and abuse, and improve performance.

Communications

We are the controller

What you send us when you ask for help or use your rights.

What we collect

  • Support requests and feedback
  • Legal or data rights requests

Why we use it

To answer you, resolve problems and meet our legal obligations.

Why we process data.

  • Provide the unified inbox, AI Agent, CRM, sales pipeline and order tools
  • Manage accounts and subscriptions
  • Process payments and invoices
  • Generate analytics and AI insights, and improve platform performance
  • Keep the platform secure and prevent fraud
  • Comply with legal and regulatory obligations

AI training is opt-in.

We do not use private conversations to train foundation models without consent. Trusted AI infrastructure providers process prompts, knowledge base content and conversation context to generate replies under data protection agreements.

  • Private conversation data is not used for foundation model training without consent
  • AI providers are contractually prohibited from using your data for model training
  • Personal data is never sold
  • You remain responsible for reviewing AI configuration and responses

Our legal basis for using data.

Under GDPR Article 6, we rely on one of these grounds each time we process personal data.

Consent
AI training, marketing and optional features
Contractual necessity
Providing the services you subscribed to
Legal obligation
Complying with laws and regulations
Legitimate interest
Service improvement, security and fraud prevention

Your choices and rights.

Choose a right below to send a request, or use our data rights request page.

Under GDPR

Under CCPA (California)

  • Know what personal data is collected
  • Request deletion of personal data
  • Opt out of the sale or sharing of personal data (we do not sell it)
  • Non-discrimination for using your rights

Who we share data with.

Only service providers that help us run ZenbiChat, under agreements that limit how they can use it.

TypeWhoPurpose
Messaging platformsMeta (Messenger, Instagram, WhatsApp) and other channels you connectTo receive and send your customer messages
Cloud infrastructureAmazon Web Services (AWS)To host and run the service
AI model providersAI infrastructure providers such as OpenAI and Anthropic, under data protection agreementsTo generate replies from your instructions and knowledge base
PaymentsPayment and billing providers such as Stripe and PaddleTo process subscription payments
Email and support toolsSMS, email and support service providersTo send service emails and answer your questions

We may also disclose data when the law requires it, or to protect rights, safety and the security of the service.

How long we keep data.

Only as long as needed to provide the service, meet legal requirements, resolve disputes and enforce agreements. After that it is securely deleted or anonymized.

Account details
While your account is active, plus 12 months after closure
Customer conversations
While your account is active, or according to your deletion request and legal or backup requirements
Billing records
7 years
Security and error logs
As needed for security, fraud prevention and legal obligations

More details.

Security measures

We use encryption of data at rest and in transit, role-based access control, secure AWS infrastructure, continuous monitoring and incident response procedures. No system can guarantee absolute security.

Cross-border transfers

ZenbiChat runs on secure cloud infrastructure, including AWS, and data may be processed outside your country. Where personal data leaves the EU, we use safeguards such as Standard Contractual Clauses and data protection agreements. Primary data residency is the USA (AWS us-east-1). A data protection agreement is available on request.

Your customers' requests

If your own customers ask to access or delete their messages, they should contact you first. As your processor, we help you respond to those requests.

Children

ZenbiChat is built for businesses and is not intended for anyone under 18. We do not knowingly collect personal data from children, and we delete it promptly if we find it.

Policy updates

We may update this policy from time to time. Changes appear on this page with a new Last updated date, and we will notify you of material changes. Continuing to use ZenbiChat means you accept the updated policy.

Contact our privacy team.

Send privacy questions or data requests to privacy@zenbichat.com. We verify your identity and respond within 30 days, or 45 days for complex CCPA requests. Merchant end-customers should contact their merchant first.

ZenbitX LLC
1209 Mountain Road PL NE, STE R, Albuquerque, NM 87110, USA
Product: ZenbiChatSee also our Terms of Service and Security page.