ZUDAKOZUDAKO
Legal

Privacy Policy

Last updated: 30 May 2026

ZUDAKO INDIA ("ZUDAKO", "we") is the Data Fiduciary for personal data you provide directly to us, and a Data Processor for personal data you upload or route through the platform on behalf of your end-users. This policy is drafted with reference to the Digital Personal Data Protection Act, 2023 ("DPDP Act").

1. What we collect

  • Account data: name, work email, password hash, profile photo.
  • Business data: business name, industry, team size, location, channels, languages.
  • Operational data: agent configurations, knowledge you upload, conversation logs, lead records.
  • Technical data: IP address, device, browser, cookie identifiers, security event logs.

2. Why we process it

  • To provide, secure, and improve the Service.
  • To send transactional, billing and security notices.
  • To meet legal, accounting and tax obligations in India.
  • With your consent: product updates, marketing, beta invitations.

3. Sharing

We share data only with sub-processors needed to deliver the Service (hosting, email, payments, WhatsApp Business Solution Providers), all bound by confidentiality and data protection obligations. We do not sell personal data.

4. Retention

We retain account data while your account is active and for a reasonable period thereafter for legal and accounting purposes. Conversation logs are retained per your account's retention setting (default 12 months) and then deleted or anonymised.

5. Your rights under the DPDP Act

  • Access a summary of personal data we hold about you.
  • Correct or update inaccurate personal data.
  • Erase personal data, subject to legal retention obligations.
  • Withdraw consent for processing where consent is the basis.
  • Nominate another individual to exercise your rights in case of death or incapacity.
  • Lodge a grievance with our Grievance Officer (below) and, if unresolved, with the Data Protection Board of India.

6. Security

Data is encrypted in transit (TLS 1.2+) and at rest. Access is scoped via row-level security and audited. See our Security page for details.

7. Children

The Service is not directed to anyone under 18. We do not knowingly process the personal data of children without verifiable parental consent as required by the DPDP Act.

8. WhatsApp messaging

When you or your end-users connect a WhatsApp number through ZUDAKO, we process the following data via Meta-approved Business Solution Providers ("BSPs") under the WhatsApp Business Solution Terms:

  • Phone number storage: the WhatsApp phone numbers of contacts who message you, or whom you have explicit opt-in to contact, are stored on your account for the lifetime of the lead record.
  • Message content: the body of inbound and outbound WhatsApp messages is stored against the lead and used to power conversation history, AI replies, and analytics.
  • Opt-in basis: we record where and when each contact opted in (website widget, manual entry, prior business relationship) on the lead record. You are responsible for ensuring valid consent before initiating business-initiated messages.
  • Retention: message content follows your account's retention setting (default 12 months) and is then deleted or anonymised. Phone numbers tied to active leads are retained for the life of the lead.
  • Opt-out: any contact can opt out by replyingSTOP to a WhatsApp conversation. We honour opt-outs immediately and block further outbound messages to that number.

Meta processes WhatsApp messages under its own Privacy Policy. We share the minimum data needed (the message, the recipient phone number, the WhatsApp Business Account ID) with the chosen BSP and with Meta for delivery.

9. International Transfers

Customer data is primarily hosted in India. Where data is transferred outside India, it is to jurisdictions and sub-processors that meet our security and contractual standards.

10. Grievance Officer

Grievance Officer (DPDP Act, 2023)
ZUDAKO INDIA
Email: grievance@zudako.in
We will acknowledge complaints within 7 working days and aim to resolve them within 30 days.

11. Changes

We may update this policy from time to time. Material changes will be notified by email or in-app at least 14 days in advance.

This is a first-draft policy provided for transparency. It is not legal advice. Please have your counsel review before relying on this document for compliance purposes.