Privacy Policy

1. Introduction

Ziric Media (Pty) Ltd ("Ziric Media", "we", "us", or "our") provides ZiricAI, a multi-tenant AI Business Operating System that helps organizations manage customer communications, CRM data, and automated workflows across channels including WhatsApp, web chat, email, and SMS.

Our platform includes:

• The ZiricAI Company Portal for business customers and their team members
• AI Employees and automated assistants (including Sarah, our platform assistant)
• WhatsApp Business integration via Meta's WhatsApp Cloud API
• Knowledge bases, CRM features, and conversation history tools
• This marketing website and related support channels

When a business customer uses ZiricAI to communicate with its own end users, that business is typically the data controller for its customer data. Ziric Media acts as a data processor on behalf of that business, processing data according to their instructions and our customer agreements.

By using ZiricAI, our website, or connected messaging channels, you acknowledge that you have read and understood this Privacy Policy.

2. Information we collect

Depending on how you interact with ZiricAI, we may collect the following categories of information:

2.1 Account and business information

• Full name, email address, phone number, and job title
• Company or trading name, industry, billing address, and tax identifiers where applicable
• Authentication credentials, session tokens, and multi-factor authentication data
• Subscription plan, payment method metadata, and invoicing records (processed by our payment providers)

2.2 WhatsApp and conversation data

• Message content (text, templates, and structured payloads)
• Sender and recipient phone numbers, WhatsApp IDs, and display names
• Timestamps, delivery and read receipts, message status, and conversation threading metadata
• Media metadata (file type, size, and filename) and references to media stored in our systems or Meta's infrastructure
• Webhook event payloads received from Meta's WhatsApp Business Platform

2.3 Customer and end-user data (processed on behalf of businesses)

When a business uses ZiricAI, we process personal information about that business's customers and contacts, which may include:

• Contact names, phone numbers, email addresses, and profile details
• CRM records, tags, notes, pipeline stages, and assignment history
• Conversation transcripts across connected channels
• Consent records, opt-in/opt-out preferences, and marketing subscription status where configured

The business customer determines what data is collected from its end users and is responsible for providing appropriate privacy notices and obtaining lawful consent.

2.4 Business configuration and integration data

• AI Employee settings, prompts, knowledge base documents, and automation workflows
• Branding, greeting messages, escalation rules, and approved response boundaries
• Integration credentials (such as WhatsApp Business API tokens, webhook secrets, and OAuth tokens), stored using encryption and access controls — credentials are never exposed in client-side code or shared with unauthorized parties

2.5 Usage, analytics, device, and log data

• Feature usage, API call volumes, error logs, and performance metrics
• IP address, browser type, operating system, device identifiers, and referral URLs
• Aggregated and anonymized platform statistics for reliability and product improvement

2.6 Support communications

• Messages, tickets, and feedback you send to our support team or platform assistants

We ask business customers not to upload special-category personal information (such as health, biometric, or children's data) unless they have a lawful basis and appropriate safeguards in place.

3. WhatsApp and Meta data handling

ZiricAI integrates with the WhatsApp Business Platform (including the WhatsApp Cloud API) provided by Meta Platforms, Inc. When WhatsApp is enabled for a business account:

• Messages to and from end users are transmitted through Meta's infrastructure before reaching ZiricAI
• Meta processes message content, phone numbers, and related metadata under its own terms, including the WhatsApp Business Terms of Service, WhatsApp Business Messaging Policy, and Meta Privacy Policy
• We receive inbound messages via verified webhooks and send outbound messages through Meta's API on behalf of the connected business
• We store conversation history in the business's isolated tenant workspace for inbox management, CRM features, and audit purposes

Our role: For WhatsApp conversations handled through ZiricAI, we process message data as a data processor acting on instructions from our business customers. Business customers are responsible for:

• Obtaining valid consent from end users before initiating conversations, especially for marketing or promotional messages
• Complying with Meta's WhatsApp Business Messaging Policy, Commerce Policy, and applicable local laws (including POPIA in South Africa)
• Providing their own privacy notice to end users where required
• Honoring opt-out requests and messaging frequency limits

What we do not do: We do not sell WhatsApp message content or conversation data to third parties. We do not use one customer's WhatsApp data to serve another customer. We do not use WhatsApp message content to train general-purpose AI models for unrelated purposes.

4. How messages are processed

When an end user sends a WhatsApp message to a business connected through ZiricAI, the following processing flow applies:

1. Receipt via webhook — Meta delivers the message event to our secure servers. We verify webhook signatures and associate the message with the correct business tenant.
2. Routing and storage — The message is stored in the business's tenant-isolated workspace and displayed in the unified inbox for authorized team members.
3. AI-assisted response — If AI Employees or automated workflows are enabled, relevant conversation context and configured knowledge base content may be sent to AI model providers (such as OpenAI) to generate a suggested or automated reply. Responses are governed by the business's configured instructions, escalation rules, and approved boundaries.
4. Human review — Team members may review, edit, approve, or override AI-generated responses. Ziric Media personnel may also access message data when necessary for customer support, security investigations, or quality assurance, subject to access controls and confidentiality obligations.
5. Outbound delivery — Approved replies are sent back through Meta's WhatsApp Cloud API to the end user's phone number.

Each business account operates in a logically separated tenant environment. Data from one business is not accessible to other businesses on the platform except where explicitly authorized (for example, shared workspace features configured by the customer).

5. How we use your information

We use collected information to:

• Provide, operate, maintain, and improve the ZiricAI platform and Ziric Media Bot services
• Authenticate users, enforce role-based access controls, and protect account security
• Route, store, search, and display customer conversations in the unified inbox and CRM
• Generate AI-assisted replies, summaries, classifications, and workflow automations
• Process billing, send service notices, and respond to support requests
• Monitor platform security, detect abuse, and maintain reliability
• Comply with legal obligations, respond to lawful requests, and enforce our terms

We do not sell personal information. We do not use your data for third-party advertising profiles.

6. Third-party services

ZiricAI relies on trusted third-party service providers to deliver the platform. These providers process data only as necessary to perform their services and are subject to contractual confidentiality and security obligations. Key subprocessors include:

• Meta (WhatsApp Business Platform) — message delivery, webhook events, and WhatsApp Business account management. See Meta's privacy policies linked in Section 3.
• OpenAI and similar AI providers — natural language processing and automated response generation when AI features are enabled. Data sent to AI providers is limited to the context required for the requested operation.
• Cloud hosting providers (including Railway) — application hosting, compute, and infrastructure services for our production environment.
• Google Firebase / Firestore — authentication, database, and storage services where configured for customer workspaces.
• Email and payment providers — transactional email delivery and subscription billing.

Each third-party provider maintains its own privacy policy governing how it handles data. We encourage you to review those policies. We select providers with appropriate security practices and limit the data shared to what is necessary for the integration.

7. How we share information

We share personal information only in the following circumstances:

• Service providers and subprocessors — as described in Section 6, under data processing agreements where applicable
• Integration partners — such as Meta/WhatsApp, when a business connects those services
• Within your organization — team members and roles authorized by the business account administrator
• Legal requirements — when required by applicable law, regulation, court order, or governmental request, or to protect the rights, safety, and security of Ziric Media, our customers, or others
• Business transfers — in connection with a merger, acquisition, reorganization, or sale of assets, with notice where required by law

We do not share WhatsApp message content with third parties for their independent marketing or advertising purposes.

8. Data retention

We retain personal information for as long as necessary to provide the ZiricAI service and fulfill the purposes described in this policy, including:

• Active accounts — data is retained while the business account remains active and the service is in use
• Conversation logs — retained to support inbox history, CRM features, and compliance requirements. Business administrators may configure retention schedules within their workspace. Unless otherwise configured, conversation history is retained for 24 months from the date of the message, after which it may be archived or deleted
• Account termination — upon account closure or deletion request, we delete or anonymize customer data within a reasonable period (typically within 90 days), except where retention is required for legal, billing, dispute resolution, or security purposes
• Legal holds — we may retain data longer when required by law, regulatory obligation, or active legal proceedings

Business customers may submit deletion requests for specific records or entire workspaces through the Company Portal or by contacting us. End users seeking deletion of data held on behalf of a business should contact that business directly; we will assist the business as their processor where appropriate.

9. Security

We implement technical and organizational measures designed to protect personal information, including:

• Encryption of data in transit using TLS/HTTPS
• Encryption at rest for sensitive credentials and stored data where supported by our infrastructure
• Multi-tenant isolation between business accounts
• Role-based access controls, authentication requirements, and session management
• Webhook signature verification for Meta/WhatsApp integrations
• Audit logging, monitoring, and incident response procedures
• Restricted access to production systems on a need-to-know basis

No method of transmission or storage is completely secure. We encourage business customers to use strong passwords, limit team access appropriately, and report suspected security incidents to us promptly at privacy@ziricai.com.

10. Cookies and similar technologies

Our marketing website and Company Portal use cookies, local storage, and similar technologies to:

• Keep you signed in to your account
• Remember preferences such as theme, language, and display settings
• Measure site performance, diagnose errors, and understand usage patterns
• Protect against fraud, abuse, and unauthorized access

Marketing website: We may use essential cookies required for site functionality. Where optional analytics or marketing cookies are used, we will request consent where required by applicable law.

Company Portal: Essential cookies and local storage are required for authentication and platform operation. Disabling these may prevent you from using the portal.

You can control cookies through your browser settings. Note that disabling essential cookies may limit functionality.

11. International data transfers

ZiricAI and our subprocessors may process and store data in South Africa and other countries where our infrastructure or service providers operate, including the United States and the European Economic Area. Meta's WhatsApp infrastructure may process data globally in accordance with Meta's policies.

Where personal information is transferred across borders, we apply appropriate safeguards consistent with applicable law, including the Protection of Personal Information Act (POPIA) requirements for cross-border transfers of personal information.

12. Your rights

Depending on your location and applicable law, you may have the following rights regarding your personal information:

• Access — request a copy of the personal information we hold about you
• Correction — request correction of inaccurate or incomplete information
• Deletion — request deletion of your personal information, subject to legal exceptions
• Restriction — request that we limit how we process your information in certain circumstances
• Objection — object to processing based on legitimate interests or for direct marketing
• Portability — request a structured, machine-readable copy of information you provided, where applicable under GDPR or similar laws
• Withdraw consent — where processing is based on consent, withdraw consent at any time without affecting prior lawful processing

12.1 Rights under POPIA (South Africa)

If you are located in South Africa, you have rights under the Protection of Personal Information Act (POPIA), including the right to:

• Be notified when your personal information is collected
• Request access to and correction of your personal information
• Object to processing and request deletion where applicable
• Lodge a complaint with the Information Regulator of South Africa at www.inforegulator.org.za

12.2 How to exercise your rights

Business customers can manage most workspace data directly in the Company Portal. To exercise rights relating to your ZiricAI account or this policy, contact us at privacy@ziricai.com. We will respond within the timeframe required by applicable law (typically within 30 days).

End users who interacted with a business through ZiricAI should generally contact that business first, as the business is typically the data controller for customer conversation data. We will assist that business as their processor where appropriate.

13. Children's privacy

ZiricAI is a business platform not directed at individuals under the age of 16. We do not knowingly collect personal information from children under 16. If you believe a child under 16 has provided us with personal information, please contact us at privacy@ziricai.com and we will take appropriate steps to delete such information.

14. Changes to this policy

We may update this Privacy Policy from time to time to reflect changes in our services, legal requirements, or industry practices. When we make material changes, we will:

• Post the updated policy on this page at /privacy
• Update the "Last updated" date at the top of this page
• Provide additional notice (such as email or in-app notification) where required by law or where changes materially affect how we process personal information

Your continued use of ZiricAI after the effective date of an updated policy constitutes acceptance of the revised terms, except where further consent is required by law.

15. Contact us

For privacy questions, data subject requests, WhatsApp integration inquiries, or security concerns, contact:

• Privacy (primary): privacy@ziricai.com
• Support: support@ziricai.com
• Operator: Ziric Media (Pty) Ltd — ZiricAI / Ziric Media Bot, South Africa

We aim to acknowledge privacy-related requests within 5 business days and resolve them within the timeframes required by applicable law.