Data processing

This note describes how Zanii processes personal data on your behalf. It is available as a signed data processing agreement on request, and required if you are subject to the UAE PDPL, the GDPR or Saudi PDPL.

Contact identifiers and message content, for the sole purpose of delivering and receiving WhatsApp messages you instruct us to send, and of showing you what happened. Nothing is used for our own analytics, for training models, or for any purpose you have not instructed.

Meta Platforms processes every WhatsApp message — that is unavoidable on this channel. Our hosting provider and, if you enable the AI assistant, the model provider you choose. If you bring your own model API key, that provider bills you directly and we hold no key of yours. We will tell you before adding a sub-processor.

Access tokens are held in a secrets manager rather than the application database. Every tenant's data is scoped at the query layer and tested for cross-tenant leakage. Console sessions use httpOnly cookies, so a token cannot be read by injected script. Passwords use argon2id.

You can export your contacts and message history at any time, including after you cancel. We delete what remains 30 days after termination, except the accounting records UAE law requires us to keep for five years.