Privacy Policy

We collect the following categories of information:

• Account and business information — the email address used to create your account, and business details you provide during onboarding: business name, industry, company size, country, and the free-text business description used to give the AI context.
• Connected channel data — when you connect Gmail or WhatsApp, we process the messages and contacts needed to provide the service (for example, to classify a message and draft a suggested reply). You control which channels you connect.
• Usage and technical data — logs, timestamps, and diagnostic information generated as you use the platform, used to operate and secure the service.

• To provide the core service: classifying incoming messages and drafting suggested replies.
• To synchronize your connected channels and deliver messages you approve.
• To operate, maintain, secure, and improve the platform.
• To communicate with you about your account and the service.
• To comply with legal obligations.

We do not sell your personal data, and we do not use the content of your messages for advertising.

For the on-device (Local AI) tier, ZNAT uses a zero-knowledge design. The access tokens that authorize access to your Gmail or WhatsApp accounts are held by the agent running on your own machine. Our backend stores only encrypted material and routing metadata — it never holds a usable, plaintext provider token, and message content processed locally is not persisted on our servers in plaintext.

This zero-knowledge boundary is a core part of how we minimize the data we could access on your behalf.

For the cloud tier, ZNAT operates fully server-side: message content is encrypted at rest with per-business encryption keys managed by ZNAT, and our systems decrypt it in a controlled, audited way to provide the service (displaying conversations in your dashboard and generating AI-assisted drafts). The cloud tier is not zero-knowledge; the zero-knowledge design described above applies to the Local AI tier only.

We share information only as needed to run the service:

• Meta Platforms (WhatsApp Business Platform) and Google (Gmail API) — when you connect these channels, data is exchanged with them to send and receive messages, subject to their own terms and privacy policies.
• AI model providers — on the cloud tier, the message content needed to classify a message or draft a suggested reply is processed by our AI model provider in the European Union, under data-processing obligations. On the Local AI tier, inference runs on your own machine and message content is not sent to an external AI provider.
• Infrastructure and processing providers — hosting and supporting services that operate the platform under confidentiality obligations.
• Payment processors — to handle billing, where applicable.
• Legal and safety — where required by law or to protect rights, safety, and the integrity of the service.

We retain personal data for as long as your account is active or as needed to provide the service, comply with legal obligations, resolve disputes, and enforce our agreements. When you disconnect a channel or close your account, we delete or de-identify the associated data within a reasonable period, except where retention is legally required.

We apply administrative, technical, and physical safeguards designed to protect your information, including encryption of sensitive credentials, encryption of message content at rest with per-business keys and audited decryption on the cloud tier, and the zero-knowledge handling described above on the Local AI tier. No method of transmission or storage is completely secure, but we work to protect your data and to respond promptly to any incident.

Under the LFPDPPP you have the rights of Access, Rectification, Cancellation, and Opposition (ARCO) with respect to your personal data, as well as the right to revoke any consent you have given.

To exercise these rights, contact us at privacy@znat.app. We will respond within the timeframes required by applicable law.

Some of our providers may process data outside your country of residence. Where that occurs, we take steps to ensure your information continues to be protected consistent with this policy and applicable law.

ZNAT is a business tool and is not directed to individuals under the age of 18. We do not knowingly collect personal data from children.

We may update this Privacy Policy from time to time. When we do, we will revise the "Last updated" date above and, where appropriate, notify you through the service.

If you have questions about this policy or how we handle your data, contact us at privacy@znat.app.