Privacy Policy

Last updated: 20 October 2026

This Privacy Policy explains how Gempluse infotech pvt. ltd., which operates Zooqq ("Zooqq", "we", "us"), collects, uses, shares and protects personal data when you visit our website, create a Zooqq account, or use the Zooqq platform to communicate with your customers on WhatsApp. It is written to meet India's Digital Personal Data Protection Act, 2023 (DPDP Act) and the Information Technology Act, 2000 and its rules, and also explains rights you may have under other laws such as the GDPR.

1. Who this policy covers and our role

• Customers: businesses that sign up for Zooqq and the team members they invite. For their account data, Zooqq is the data fiduciary (controller).
• End contacts: people who message, or are messaged by, a business that uses Zooqq. For their data, the business is the data fiduciary (controller) and Zooqq processes it only on that business's instructions, under our Data Processing Agreement.
• Website visitors: anyone who visits this website or submits the demo form. For their data, Zooqq is the controller.

If you are an end contact, please contact the business you messaged first. If you cannot reach them, contact us and we will pass your request on and help them handle it.

2. Information we collect

When you sign up and onboard

• Your name, email address, role and password (we store only a hashed form of the password).
• Whether you agreed to receive product updates by email.
• Business details: company name, business address, city, postal code, country, business type, whether you already use WhatsApp Business, how you heard about us and, if you provide it, your GSTIN for invoices.

About you and your team while using Zooqq

• Profile details such as phone number and profile picture, your role and permissions, notification preferences, and recently used pages and searches (to show shortcuts).
• Security data: two-factor authentication settings (an encrypted authenticator secret, or passkey details such as device type and last use), password-reset and invitation tokens, and the IP address of sign-in attempts (used to block repeated failed logins).
• Browser push-notification subscriptions, if you allow notifications.
• Billing-related actions, together with the IP address they came from, and the IP address of calls to our developer API.

From Meta when you connect WhatsApp

• When you connect through Facebook Login and Meta's Embedded Signup, we receive the Meta Business account, WhatsApp Business Account and phone number IDs you choose to share, your number's display name, quality rating and messaging limits, and access tokens that let us send and receive messages on your behalf.

Messaging and contact data (processed for the business)

• Contact names, phone and WhatsApp numbers, email addresses, profile pictures and notes.
• WhatsApp messages and media sent or received, including locations a contact chooses to share, delivery and read statuses, WhatsApp Flow form responses and campaign replies.
• Opt-out status: when a contact sends a word such as STOP or UNSUBSCRIBE, we record that they opted out of marketing messages and when.
• Insights created by AI features the business enables, such as conversation summaries, sentiment, lead scores and extracted details.

From apps you connect

• Data you authorise us to receive from connected services such as Shopify, WooCommerce, HubSpot, Salesforce, Zoho, Slack, shipping carriers and Google or Microsoft calendars, for example customer, order or appointment details, and the access tokens for those connections.

Billing

• Your plan, invoices, wallet balance and payment status. Card, UPI and bank details are collected by our payment provider (currently Razorpay); we never receive or store full card numbers.

From this website

• The details you enter in the demo form: name, company, email, phone, team size, interest and message, together with the IP address it was sent from (to prevent spam and abuse). We email you a confirmation that we received it.
• Your cookie choice (see section 11). This website does not use analytics or advertising trackers.

3. How we use information

• To provide the Service: create and secure your account, connect your WhatsApp number, send and receive messages, run campaigns, chatbots, flows and automations, and show conversations in your team inbox.
• To run AI features you or your business enable (see section 4).
• To bill you: process plan and wallet payments, issue GST invoices and handle payment disputes.
• To keep the platform safe: authenticate users, block brute-force and abuse, enforce our Terms and Meta's WhatsApp policies, and investigate fraud.
• To support you: answer questions and fix problems, including when you ask us to look at your account.
• To communicate with you: send service, security, billing and plan-expiry messages, and, only if you opted in, product updates (you can unsubscribe at any time).
• To meet legal obligations: tax, accounting and lawful requests from authorities.

We process your data on the basis of your consent, to perform our contract with you, to comply with law, and for other legitimate uses permitted by law. We do not sell personal data, and we do not use data received from Meta or Google for advertising.

4. AI features

• When a business turns on AI replies, AI bots, summaries or the knowledge base, the relevant message content, contact context and knowledge-base documents are sent to an AI model provider to generate a result. Depending on the business's settings, this may be Google (Gemini), OpenAI, DeepSeek or models available through OpenRouter, or a provider account the business connects with its own key.
• We remove email addresses and phone numbers from the AI usage records we keep for billing and monitoring.
• The business decides whether to use AI features and is responsible for telling its contacts where required.

5. How we share information

We share personal data only as needed to run Zooqq, with service providers bound by contract to protect it and use it only for us:

• Meta Platforms, to deliver WhatsApp messages through the WhatsApp Business Platform (Cloud API), and the Facebook SDK used during WhatsApp connection.
• Hosting and infrastructure: cloud hosting (such as Railway and Amazon Web Services), databases, caching and queue services, and a vector database for the AI knowledge base.
• File storage: providers such as Amazon S3 or Microsoft Azure, for media and documents.
• Email delivery: providers such as Amazon SES or Mailgun, to send account and notification emails.
• Payments: Razorpay, to process subscription and wallet payments.
• AI model providers, as described in section 4.
• Apps you connect, such as Shopify, calendars or Microsoft Teams, as you direct.

We may also disclose data if required by law or a valid government request, to protect the rights, safety and security of Zooqq, our customers or others, or to a buyer or successor if our business is merged or sold, under the same protections.

6. Where data is stored

We and our providers may store and process data in India and in other countries. WhatsApp messages pass through Meta's Cloud API, which Meta operates from data centres outside India. Where data is transferred abroad, we rely on providers that protect it under contract and comply with any restrictions set by the Government of India under the DPDP Act.

7. How long we keep data

• Account and messaging data: for as long as the account is active. When an account is closed or deletion is requested, we delete or anonymise it within 30 days, as described on our Data Deletion page.
• Technical records: raw WhatsApp webhook logs are deleted automatically after 30 days, and short-lived records used to avoid duplicate processing are deleted within hours to 14 days.
• Invoices and payment records: for the period required by tax and accounting law.
• Demo requests: for as long as needed to respond and follow up, unless you ask us to delete them sooner.
• Copies in backups are removed as backups expire.

8. Security

• Data is sent over encrypted connections (HTTPS/TLS), and sign-in cookies are secure and HTTP-only.
• Passwords are stored only as salted hashes. Authenticator secrets, AI provider keys, storage and email credentials, webhook secrets and connected-app tokens are encrypted at rest.
• Each business's data is kept in a separate database, and access inside an account is controlled by roles and permissions.
• We support two-factor authentication and passkeys, and rate-limit sign-in and other sensitive actions.

No system is perfectly secure. If a personal data breach affects you, we will notify you and the authorities as required by law.

9. Your rights

Depending on the law that applies to you, you may have the right to:

• get a summary of the personal data we process about you and how we use it;
• correct, complete or update your data, and ask us to erase it;
• withdraw consent you have given (this does not affect processing already done);
• nominate another person to exercise your rights if you die or become unable to;
• have your grievances addressed by us, and then complain to the Data Protection Board of India;
• if the GDPR or similar laws apply, object to or restrict processing and receive a portable copy of your data.

Many details can be changed directly in your account settings. For anything else, email [email protected]. We may need to verify your identity before acting on a request.

10. Choices for end contacts

If you receive WhatsApp messages from a business that uses Zooqq, you can reply STOP or UNSUBSCRIBE at any time to stop its marketing messages, and you can block the business in WhatsApp. To access or delete your data, contact that business; see also section 1.

11. Cookies and browser storage

• Zooqq app: we use essential, HTTP-only cookies to keep you signed in (access_token, refresh_token), to complete two-factor sign-in (pending_2fa_token), and short-lived cookies while you connect WhatsApp. The app also stores your selected workspace in your browser. These are needed for the app to work and cannot be switched off.
• Facebook SDK: when you connect WhatsApp, Meta's Facebook SDK loads and may set its own cookies, under Meta's Privacy Policy.
• This website: we store only your cookie choice (zooqq_cookie_consent) in your browser. We do not use analytics or advertising cookies. If we add them, we will load them only after you accept, and update this policy.

12. Google and Meta data

Zooqq's use of information received from Google APIs adheres to the Google API Services User Data Policy, including the Limited Use requirements. Data from Google and Meta is used only to provide the features you turn on, is not sold, is not used for advertising, and is not used to train general-purpose AI models.

13. Children

Zooqq is a business service and is not intended for anyone under 18; we do not knowingly collect their data for our own purposes. Businesses that message children through Zooqq are responsible for obtaining verifiable parental consent where the law requires it.

14. Grievance Officer

If you have a concern or complaint about how your personal data is handled, contact our Grievance Officer:

• Name: Ashutosh Upadhyay
• Email: [email protected]
• Address: Gempluse infotech pvt. ltd., 7/449, Sector 7, Opposite The Lalit hotel, Malviya Nagar, Jaipur

We will acknowledge your complaint promptly and resolve it within the time required by law.

15. Changes to this policy

We may update this policy from time to time. The "Last updated" date above shows when it last changed. For significant changes, we will notify account owners by email or in the app before they take effect.

16. Contact us

Questions about this policy or your data: [email protected]. Postal address: Gempluse infotech pvt. ltd., 7/449, Sector 7, Opposite The Lalit hotel, Malviya Nagar, Jaipur.