Privacy Policy
Welcome to ZempFlow ("we," "our," or "us"). We are committed to protecting your privacy and ensuring the security of your data. This Privacy Policy explains how ZempFlow collects, uses, discloses, and safeguards personal data when you visit our website, use our software-as-a-service (SaaS) unified customer relationship management (CRM) platform, or connect third-party messaging channels to our service. By accessing or using ZempFlow, you consent to the practices described in this Privacy Policy.
Information We Collect
A. Account & Billing Information (Provided by You) Identity Data: Full name, business name, and job title. Contact Data: Email address, phone number, and physical business address. Financial & Billing Data: Payment details and billing history. All payment transactions are securely processed through our trusted third-party payment gateways. We do not store your raw credit card data on our servers. B. Connected Channel & Customer Data (Processed on Your Behalf) Because ZempFlow is a unified communication platform, we ingest and process data from the channels you connect (such as WhatsApp, Instagram, Telegram, Email, and SMS). This includes: Message Content: The text, images, media, and attachments contained within incoming and outgoing customer messages. Communication Metadata: Sender/receiver identifiers (e.g., phone numbers, WhatsApp IDs, Instagram handles, email addresses), message timestamps, routing information, and transmission status. Contact Profiles: Public profile data synchronized from third-party networks (e.g., Instagram profile names or avatars) to help you manage your leads. C. Technical & Usage Data (Collected Automatically) Device & Log Data: IP addresses, browser types, operating systems, access times, and referring URLs. Platform Activity: Metrics on how you interact with our dashboard, active session data, configuration choices, and API usage tracking.
How We Use Your Information
We utilize the collected data strictly for the following operational and commercial purposes: Service Provision: To operate, maintain, and provide the core functionalities of the ZempFlow platform, including real-time message routing and synchronization across your connected accounts. AI & Automation Management: To power our AI features (such as thread summarization, automatic lead tagging, and automated message drafting). Billing & Account Management: To process payments, handle subscription renewals, issue invoices, and manage account statuses. Customer Support: To diagnose technical bugs, investigate performance degradation, and respond to your inquiries. Security & Compliance: To monitor for fraudulent activities, detect spam bots, enforce our Terms of Service, and safeguard our system infrastructure.
AI Data Processing & Data Training Protections
ZempFlow utilizes advanced artificial intelligence features driven by trusted third-party large language model (LLM) API providers (such as OpenAI and Anthropic). Purpose of Processing: Communication data is securely sent to these providers via API solely to execute user-requested AI behaviors—such as drafting responses, summarizing chat threads, or extracting lead parameters. Data Training Shield: None of your communication data, proprietary customer logs, or inputs are used by ZempFlow or our third-party AI partners to train public, shared, or foundation machine learning models. Data Retention by AI Partners: Our enterprise contracts stipulate that text data sent to third-party AI APIs is kept strictly for short-term transient processing or temporary abuse-monitoring purposes, after which it is deleted.
Third-Party Integrations & Channel Platform Compliance
ZempFlow allows you to integrate your account with various third-party platforms (including Meta's WhatsApp Business API, Instagram Graph API, Telegram API, and Google/Microsoft Email APIs(If necessary)). Independent Ecosystems: This Privacy Policy applies solely to data handled within ZempFlow. Your use of third-party platforms is simultaneously governed by the respective privacy policies and developer terms of those specific services (e.g., Meta's Data Policy). Token Management: When you authorize a channel, ZempFlow securely stores access tokens required to pull and push messages on your behalf. You can revoke these permissions at any time through the respective platform's security settings or within your ZempFlow account. Google API User Data & Limited Use Disclosure When you integrate your Google Account (such as Google Calendar or Gmail) with ZempFlow, our platform accesses, reads, and processes your Google user data strictly to provide user-facing CRM features—such as displaying scheduled appointments, syncing events created by workflows, and routing email notifications. Specifically regarding Google API data: • Scope Usage: We request access to Google Calendar APIs (including calendar.events and calendar.readonly) solely to sync and display your scheduled events inside your ZempFlow dashboard and automate event creation. • No Model Training: We do not use, share, or transfer raw or derived data received from Google Workspace APIs to create, train, fine-tune, or improve foundational machine learning or artificial intelligence (AI/ML) models. • Data Transfer Restrictions: We do not sell, rent, or transfer your Google user data to any third parties, except as strictly required to deliver our core SaaS services or comply with valid legal processes. • Policy Adherence: ZempFlow's use and transfer to any other app of information received from Google APIs will adhere to the Google API Services User Data Policy, including the Limited Use requirements.
Data Sharing & Third-Party Disclosures
We do not sell, rent, trade, or monetize your personal data or your customers' communication data under any circumstances. We share data only with the following restricted categories of recipients: Subprocessors & Infrastructure Providers: Essential services required to run our software, such as cloud hosting infrastructure (e.g., AWS or Google Cloud), performance monitoring tools, database backups, and our AI API vendors. Payment Processors: Financial information required to manage subscriptions is handled directly by payment gateways and Merchant of Record (MoR). Law Enforcement & Legal Compliance: We cooperate fully with government, regulatory, and law enforcement officials to enforce compliance with applicable laws. We reserve the right to disclose account records, usage statistics, and communication data if required to do so by a valid, legally binding government mandate (such as a signed subpoena, search warrant, or court order). ZempFlow may execute such disclosures without obtaining your prior permission and without providing notice to you, where permitted or required by law, to protect our assets, defend against legal liability, or preserve public safety.
Data Security
We implement industry-leading technical and organizational measures to defend your data against unauthorized access, loss, or alteration: Encryption protocols: Data is strongly encrypted using SSL/TLS protocols during transit across networks, and encrypted at rest utilizing AES-256 standard encryption keys. Access Control: Multi-factor authentication mechanisms are available for account access, and internal access to system databases is restricted to verified personnel under strict confidentiality terms. Security Audits: We perform routine vulnerability scans and internal security audits to continuously test our defenses.
Global Privacy Rights (GDPR / CCPA / CPRA Compliance)
Depending on your jurisdiction (such as the European Economic Area, UK, or California), you may possess specific legal rights over your personal data. These typically include the right to access, rectify, port, restrict, or permanently erase your data. Data Processor vs. Data Controller Notice: ZempFlow acts as a Data Controller for your account setup, profile, and billing information. However, regarding the customer conversation logs synced from your connected channels, ZempFlow acts strictly as a Data Processor operating on your behalf. If your end-customers submit a privacy request regarding their chat logs, they must contact you (the account owner) directly. We will assist you in fulfilling these requests upon formal instruction.
Data Retention & Account Deletion
We store your data for as long as your ZempFlow account remains active. Voluntary Account Deletion: When you choose to close your account, all associated database records, authorization tokens, and message indices are immediately marked for deletion. Purge Window: Data is permanently and irreversibly wiped from our live production databases and active backup loops within 30 days of termination. We cannot recover data once this purge window closes.
Cookies & Analytical Tools
We use functional, session-based cookies to maintain your login status, preserve your dashboard preferences, and secure your account interface. We also employ non-identifying, aggregate analytical scripts to monitor platform load times, feature adoption rates, and user navigational patterns to continuously improve our user interface. You can manage or disable cookies via your web browser settings, though doing so may degrade dashboard functionality.
Changes to This Privacy Policy
We may update this Privacy Policy from time to time to mirror regulatory changes, API updates, or infrastructure modifications. If material revisions are made, we will notify you at least 14 days before the changes take effect by sending an alert to your registered account email or displaying a prominent notice inside your user dashboard. Your continued use of ZempFlow after the effective date of an update constitutes acceptance of the modified policy.
Recourses On Data Retention & Deletion
ZempFlow provides dedicated resources explaining how we retain, manage, and delete personal data, including data associated with connected third-party messaging services such as WhatsApp, Instagram, and Facebook Messenger. Data Deletion Instructions — Learn how to request deletion of data associated with connected Meta accounts and other applicable data. Visit: https://zempflow.com/data-deletion Data Retention & Deletion Policy — Learn about our data retention periods, deletion procedures, backup retention, and available data-management options. Visit: https://zempflow.com/data-retention-deletion-policy
If you have questions about this policy, wish to execute your privacy rights, or need to raise an issue, please contact us through the official channels .
Questions about your data? Contact our privacy team
