Privacy Policy

1. Who we are

Zymbler is operated by Amraw Labs, based in New Delhi, India. For any privacy-related questions, contact support@zymbler.com.

2. Information we collect

2.1 Information you provide

• Account data: name, work email, organisation name, phone number, and password (hashed).
• Billing data: billing address and tax identifiers. Card details are handled by our payment processor (Stripe / Razorpay) and never stored by us.
• Content you submit: lead data you import, conversations you create or receive, and configuration of your AI agents and flows.
• Communications: emails, support tickets, and survey responses.

2.2 Information collected automatically

• Device and browser metadata (IP, user agent, OS).
• Usage events (pages visited, features used, errors).
• Cookies — see our Cookie Policy.

2.3 Information from third parties

• Channel providers (WhatsApp Business, Meta, Google, etc.) when you connect them to your workspace.
• Identity providers (Google, Microsoft) when you use SSO.

3. How we use your information

• To provide, secure, and improve the Service.
• To authenticate users, prevent fraud, and respond to abuse.
• To process payments, send invoices, and meet legal/tax obligations.
• To send essential service communications and, with consent, marketing.
• To train and tune AI models only on data you explicitly opt in to share for that purpose. Customer data is never used to train shared models without consent.

4. Legal bases (for users in the EEA / UK)

• Contract — to deliver the Service you signed up for.
• Legitimate interests — to keep the Service safe and improve it.
• Consent — for marketing communications and non-essential cookies.
• Legal obligation — to retain records as required by law.

5. Sharing your information

We don't sell your data. We share it only in these cases:

• Service providers who help us operate (hosting on AWS, email delivery, AI model providers that process conversation content to generate your agent's replies, bot protection on sign-up (Cloudflare), billing, analytics). Each is bound by data processing terms.
• Channel providers you connect, to deliver messages you authorise.
• Legal requests when we're legally required, after reviewing each request for validity.
• Business transfers — in the unlikely event of a merger or acquisition, with notice to you.

5.1 Data from Meta integrations

When you connect a Meta asset (Facebook Page, Instagram Business account, WhatsApp Business Account) to Zymbler, you authorise us to access and process data from that asset on your behalf — including messages, lead-form submissions, conversation metadata, and limited profile information about the people who contact you. We process this data solely to operate the Zymbler service for you and never use it to operate the service for any other Zymbler customer. Workspaces are strictly isolated.

You remain the controller of the data your business receives via Meta channels; Zymbler is the processor. To stop sharing, remove Zymbler from Facebook's Business Integrations — see our Data Deletion page for the full process, including how to delete data we already received.

6. International transfers

We host data in the region you choose (currently EU — Frankfurt, or India — Mumbai). Where data crosses borders, we rely on Standard Contractual Clauses or equivalent safeguards.

7. Data retention

We retain account and conversation data for as long as your workspace is active, plus 30 days after deletion to support recovery, then we permanently delete it from primary systems. Backups roll off within 90 days.

When someone messages your business on WhatsApp with a photo, voice note, video or document, we keep a copy so your team can see it in the inbox. We delete these files about 6 months after they arrive, even while your workspace is active.

8. Your rights

Depending on where you live, you have the right to:

• Access, correct, or delete your personal data.
• Object to or restrict processing.
• Port your data in a machine-readable format.
• Withdraw consent at any time.
• Lodge a complaint with your data protection authority.

To exercise these rights, email support@zymbler.com. To request deletion specifically, see our Data Deletion page for the full process, including how to delete data received via Meta integrations.

9. Security

We use TLS 1.2+ in transit, AES-256 encryption at rest, principle-of-least-privilege access controls, and regular internal security reviews. No system is 100% secure; if we ever experience a breach affecting your data, we'll notify you and the relevant authorities as required by law.

10. Children

Zymbler is not directed to children under 16. We do not knowingly collect personal data from children.

11. Changes to this policy

We'll post material changes here and, where significant, notify you in-product or by email. The "Effective" date above reflects the latest version.

12. Contact

Questions, requests, or complaints — email support@zymbler.com or write to Amraw Labs, New Delhi, India.