Privacy Policy

Zotlyx ("we", "us", or "our") operates the AI omnichannel chat platform accessible at zotlyx.com and related applications, APIs, and services (collectively, the "Service"). This Privacy Policy explains how we collect, use, disclose, and safeguard your information when you visit our website, create an account, or use the Service.

By accessing or using the Service, you acknowledge that you have read, understood, and agreed to the practices described in this Privacy Policy. If you do not agree with our policies and practices, please do not use the Service. This policy may be updated from time to time and material changes will be reflected by revising the effective date above.

We collect information you provide directly when you create or manage a Zotlyx account. This includes your full name, business or organization name, work email address, phone number, billing address, payment card details, country of residence, connected messaging channels (WhatsApp Business, Facebook, Instagram, Telegram), and any profile preferences you configure.

We automatically collect certain usage and device information whenever you interact with the Service. This includes your IP address, browser type and version, device identifiers, operating system, referring URLs, pages visited, time spent on features, error logs, and performance metrics. This information helps us maintain service quality, diagnose technical reliability, improve features, and keep the platform secure.

When you connect third-party communication channels, we receive authentication tokens and limited account metadata needed to send and receive messages on your behalf through those channels. You can revoke channel access at any time through your account settings or directly through the relevant third-party provider.

We use personal information to deliver, operate, and maintain the Service. This includes authenticating accounts, processing payments and subscriptions, connecting your communication channels, sending and receiving messages through integrated platforms, syncing team inboxes, storing conversations, and rendering dashboard and processing AI auto-reply features and workflows you configure.

We use information to improve and personalize the Service experience, including training AI models for reply suggestions, processing knowledge base matching, auto-reply accuracy, lead qualification logic, and automated follow-up sequences configured by your teams improve platform performance, reliability, and usability.

We use contact information to send important transactional and administrative communications such as service notices, product updates, billing alerts, security announcements, legal disclosures, and responses to customer support requests. Where required by law or with your explicit consent we may also send promotional emails about new features, educational content, or special offers. You can opt out of marketing communications at any time.

We use aggregated, de-identified, or non-personal information for internal analytics, usage trend analysis, reporting, capacity planning, product research, feature roadmap development, service optimization, and commercial measurement of marketing attribution and campaign performance.

If you are located in the European Economic Area (EEA), United Kingdom, or other regions with similar data protection laws, we process your personal information only where we have a valid legal basis. These bases include: (a) performance of a contract between you and Zotlyx for provision of the Service, (b) compliance with a legal or regulatory obligation, (c) our legitimate interests where they do not override your rights and freedoms, and (d) your explicit consent where required by applicable law.

Where we rely on consent as the legal basis for processing, you have the right to withdraw that consent at any time without affecting the lawfulness of processing carried out before withdrawal. To withdraw consent, please contact us using the details provided at the end of this policy.

We do not sell, rent, or trade your personal information to third parties for their commercial marketing purposes. Your trust is important to us, and we are committed to protecting the confidentiality of your information.

We may share limited information with trusted third-party service providers who perform services on our behalf under contract. These include Cloudflare for infrastructure hosting and edge computing, payment processors for subscription billing, email delivery services for transactional communications, and customer support tooling. All such providers are obligated by contract to implement appropriate security measures and to process personal information only as instructed by us.

Analytics and Optimization Tools (Google Analytics, Meta Pixel, Microsoft Clarity): We utilize industry-standard analytics and conversion tracking tools on our public website to measure site traffic and optimize user experience: (a) Google Analytics (Google LLC) collects aggregated web traffic and interaction statistics; (b) Meta Pixel (Meta Platforms, Inc.) measures advertising conversion events and helps deliver relevant campaigns on Facebook and Instagram in accordance with Meta Business Tools Terms; and (c) Microsoft Clarity (Microsoft Corporation) captures anonymized user navigation patterns, scroll depth, heatmaps, and session replays to improve site usability, enhance security, and prevent fraudulent activity in accordance with the Microsoft Privacy Statement.

We may disclose information if required to do so by law, regulation, legal process, governmental request, or court order. We may also disclose information to protect the rights, property, safety, or integrity of Zotlyx, our customers, our employees, or the public, including in connection with fraud prevention, credit risk reduction, security incident response, or legal defense, contractual enforcement, or the investigation or prosecution of suspected illegal activity.

When you connect third-party integrations such as WhatsApp Business API, Facebook Messenger, Instagram, Telegram, Website widget, or custom webhooks, related account credentials, message data, and conversation content may be processed and shared with those third parties in accordance with the permissions, scopes, and settings you explicitly approve when connecting the integration.

The Service is operated globally using cloud infrastructure operated by Cloudflare and other service providers. Information we collect may be stored, processed, and transferred between countries and jurisdictions worldwide, including countries that may have data protection laws different from your country of residence.

Where we transfer personal information originating from the EEA, United Kingdom, or Switzerland, we implement appropriate safeguards such as Standard Contractual Clauses (SCCs) approved by the European Commission and equivalent authorities, or rely on adequacy decisions where applicable. If you would like further information about the specific safeguards we use, please contact us.

We retain personal information only for as long as reasonably necessary to fulfil the purposes described in this Privacy Policy, to satisfy any legal, accounting, tax, or reporting obligations, to resolve disputes, and to enforce our agreements. The specific retention period depends on the type of information and the purposes for which it was collected.

Account registration and profile information is retained for the duration of your active account plus a reasonable period thereafter following account closure or deletion unless a longer retention period is required or permitted by law. Billing and transaction records are retained for the period required by applicable tax and accounting regulations. Message and conversation data is retained in line with your account plan settings and applicable legal requirements.

Following the end of the applicable retention period, we securely delete, destroy, anonymize, or irreversibly pseudonymize personal information in accordance with our data destruction and records management policies and procedures, consistent with applicable legal and operational constraints.

We implement appropriate administrative, technical, organizational, and physical safeguards designed to protect the confidentiality, integrity, availability, and resilience of personal information against unauthorized or unlawful processing, accidental loss, destruction, damage, or disclosure. These include encryption in transit (TLS 1.2+), encryption at rest, least-privilege access controls, regular vulnerability assessments, security audits, and internal incident response procedures.

While we take reasonable efforts to protect personal information in our custody and control, no method of electronic storage, network transmission, or security control is completely secure or infallible. You provide information at your own risk, and we cannot guarantee absolute security. In the event of a personal data breach that is likely to result in a high risk to your rights and freedoms, we will notify you and the applicable supervisory authority as required by applicable law without undue delay.

Depending on your jurisdiction and subject to applicable law, you may have one or more of the following rights regarding your personal information: (a) the right to request access to personal information we hold about you, (b) the right to request rectification of inaccurate or incomplete personal information, (c) the right to request erasure of your personal information where legally permitted, (d) the right to request restriction of processing under specific circumstances, (e) the right to data portability in a structured, commonly used, machine-readable format, (f) the right to object to processing based on legitimate interests or for direct marketing purposes, and (g) where processing is based on consent, the right to withdraw consent.

If you wish to exercise any of these rights, please submit your request by contacting us at privacy@zotlyx.com. We will review, verify, and respond to requests within the timeframes required by applicable law. We reserve the right to charge a reasonable fee or refuse requests where permitted by law, including where requests are manifestly unfounded, excessive, repetitive, or would disproportionately impact other individuals.

You can update, correct, or delete certain account information at any time by logging into your Zotlyx account settings. You can also revoke access permissions for connected third-party channels through your integrations dashboard. If you close your account, we may retain certain information as required or permitted by law.

The Service is not directed to, and is not intended for use by, children under the age of 16 (or such higher minimum age as may apply under the laws of your jurisdiction). We do not knowingly collect, solicit, or process personal information from children.

If you are a parent or guardian and you believe that a child under the applicable age has provided us with personal information, please contact us immediately at privacy@zotlyx.com. If we become aware that we have collected personal information from a child in violation of applicable law, we will take steps to promptly delete that information from our systems.

The Service may contain links to, or integrations with, third-party websites, applications, platforms, services, or APIs operated by companies other than Zotlyx, including connected messaging channels, payment providers, and embedded analytics. This Privacy Policy applies only to information processed by Zotlyx as controller or processor. We exercise no control over, and assume no responsibility for, the privacy practices, content, data practices, terms, policies, security, or accuracy of any third-party websites, services, or integrations.

Before connecting any third-party integration or clicking any external links, you review and understand the privacy policy and terms of service of the relevant third party. Any information you provide to, or that is collected by, such third parties is governed by that third party's own policies, and not by this Privacy Policy.

When you connect Meta products (including Facebook Login, Facebook Messenger, Instagram Direct, or WhatsApp Business Platform) to Zotlyx, we process Meta Platform Data in strict adherence to Meta's Platform Terms and Developer Policies.

Data Collected from Meta APIs: Depending on the permissions you grant, we may receive your Facebook user ID, name, email address, connected Facebook Page IDs, WhatsApp Business Account ID, phone numbers, and incoming message content/attachments from your customers.

Purpose of Use: We use Meta Platform Data solely to display, organize, and synchronize conversations in your unified Zotlyx inbox, and to execute automated AI replies or workflows that you have explicitly configured. We do not use Meta Platform Data for any secondary purpose.

Meta Data Protection Standards: We do NOT sell, license, rent, or trade Meta Platform Data to any third party. We do NOT transfer Meta Platform Data to data brokers, ad networks, or credit agencies. We do NOT use Meta Platform Data to serve targeted third-party advertising or conduct user profiling/surveillance.

Data Deletion: You can disconnect your Meta accounts at any time from your Zotlyx settings or Facebook App Settings. To request complete deletion of all Meta Platform Data stored on our servers, please follow our step-by-step instructions at zotlyx.com/data-deletion or email privacy@zotlyx.com. All associated Meta data will be purged within 30 days.

If you are a California resident, the California Consumer Privacy Act ("CCPA") and the California Privacy Rights Act ("CPRA") may grant you specific rights regarding your personal information. These include the right to: (a) request disclosure of the categories and specific pieces of personal information we collect, use, disclose, and sell; (b) request deletion of your personal information; (c) opt out of the "sale" or "sharing" of your personal information (as those terms are defined under applicable California law); and (d) not be discriminated against for exercising your privacy rights.

Zotlyx does not sell your personal information in exchange for monetary consideration. To the extent we share information for purposes that may constitute a "sale" or "sharing" under California law, you may opt out by emailing privacy@zotlyx.com. We will verify your identity in connection with any rights requests as required by the CCPA/CPRA using commercially reasonable verification procedures.

We may revise, modify, amend, or update this Privacy Policy from time to time in our sole discretion to reflect changes to our practices, legal requirements, regulatory guidance, or service operations. The most current version will always be posted on this page with an updated effective date.

When we make material changes that, we may also notify you by means of a prominent notice on our website or within the Service dashboard, by sending an email to the address associated with your account, or by other reasonable means prior to the change becoming effective. Your continued use of the Service following the effective date of any revised Privacy Policy constitutes your acceptance of the changes.

If you have any questions, comments, concerns, or complaints about this Privacy Policy, our data practices, or if you wish to exercise any of your rights under applicable law, please contact our Data Protection and Privacy Team by email at privacy@zotlyx.com, by phone at +880 1601-603036, or by postal mail at Zotlyx, Sagorpara, Bottola Rajshahi, Rajshahi 6100, Bangladesh.

We will investigate and respond to inquiries and complaints as promptly as reasonably possible, in line with applicable data protection laws. If you are not satisfied with our response, you may have the right to lodge a complaint with your local data protection supervisory authority.