Privacy Policy
Effective date: 21 July 2026 · Last updated: 9 October 2026
1. Our role with your data
For the purposes of the Digital Personal Data Protection Act, 2023, Zlotworks is the Data Fiduciary for account information provided by businesses that register with us. Zlotworks acts as a Data Processor on behalf of those businesses for the WhatsApp and Instagram conversations, contacts, comments and bookings they process through the platform.
2. Data we collect
We collect only what's needed to provide our services: your phone number and name, the messages you send, booking details, contact records and tags, promotion preferences and delivery activity, and chat history. We do not collect government identity documents, financial account numbers, or precise GPS location.
When a business connects its Instagram professional account to Zlotworks, we collect the account's Instagram ID and username, and an access token which is stored encrypted. For people who send direct messages to the business or comment on its posts, we collect their Instagram-scoped ID, name and username, message and comment text, attachments (such as images, audio or video), and timestamps. We also collect the captions and thumbnail images of the business's own posts solely to display comments in context. For the business's own posts, we also collect post statistics provided by Instagram (views, reach, likes, comments, saves, shares) and the post's type and date. We do not collect personal feeds, followers lists, or content from accounts that have not contacted or commented on the business.
If you connect a number that you keep using in the WhatsApp Business app, we also receive your WhatsApp Business app contacts. If you choose to share your chat history in WhatsApp's screen, WhatsApp may send us up to six months of history. We store only messages from the last 90 days. We also receive copies of the messages you send from the app afterwards, so your team sees the full conversation. Sharing past chats is optional, and choosing not to share them doesn't stop the connection.
Our website enquiry form collects your name, business name, phone number and message so we can respond to your enquiry. We process a short-lived, hashed network identifier to help limit spam. Our website analytics records page views and interaction events such as a Get started click; we do not send enquiry text, phone numbers or names to analytics.
3. How we use your data
We use your data to manage bookings, organise business contacts, deliver consented WhatsApp promotions, support team chat conversations, and generate basic usage statistics.
For Instagram, we use collected data solely to display direct messages and comments in the business's Zlotworks inbox and to deliver replies written by authorized staff. This includes sending direct message replies within Instagram's 24-hour messaging window, sending single private replies to comments, posting public replies to comments, and hiding or deleting comments on the business's own posts when requested by the business. We use post statistics only to show the business how its own posts perform next to their comments in Zlotworks; they are not shared, not sold, not used for advertising, and never collected for other accounts' posts. We do not post content to Instagram feeds, do not message individuals who have not contacted the business first, and do not sell or share Instagram data.
A business can view only its own customer records; data is never shared or compared across different businesses.
4. Legal basis for processing
We process data based on contractual necessity (to fulfil a booking or messaging request), legitimate interests (sending confirmations and updates), and consent where required (marketing messages, which can be stopped at any time by replying STOP).
5. Who we share data with
We share data only with trusted service providers who help us operate: Meta Platforms, Inc. (WhatsApp Business Platform and Instagram Graph API, for messaging and comment delivery), Supabase, Inc. (database hosting), Vercel Inc. / Railway Corp. (infrastructure hosting), and FormSubmit (website enquiry delivery to our email address). Vercel also provides website analytics. We do not sell personal data.
6. Data retention
We retain your data for as long as your account is active, and for up to 24 months after it becomes inactive, unless you request earlier deletion or a longer period is required by law. On a deletion request, we remove your data within 30 days. See Data Deletion for instructions.
When a business disconnects its Instagram account or removes the Zlotworks app in Instagram settings, the stored access token is deleted immediately. Post statistics for the business's own posts are refreshed at most hourly while the Instagram account is connected, are kept with the business's other Instagram records, and are deleted when the business deletes its account or requests deletion. Conversation and comment history is retained for the business until the business deletes its account or requests deletion. Individual customers or commenters who wish to have their Instagram conversation or comment data deleted can contact the business directly or email hello@zlotworks.com.
Chats imported from the WhatsApp Business app are kept until 90 days after each message's original date, then deleted automatically. We don't store imported messages older than 90 days. When WhatsApp notifies us that a message was deleted, we hide it from Chats and retain the hidden record for up to 90 days before automatic deletion. Deleting data from our servers never changes or deletes anything on your phone.
Website enquiry emails we hold are deleted after 12 months, unless you ask for earlier deletion or a longer period is required by law. This enquiry retention period does not change the account-data retention period above.
7. Your rights
You can request access to, correction of, or deletion of your data, and opt out of marketing messages at any time by replying STOP. To exercise any of these rights, email hello@zlotworks.com. We respond within 30 days.
8. Security
We use industry-standard security measures including encrypted connections and access controls to protect your data.
9. Children's privacy
Our services are not directed to children for independent use. A parent or guardian may provide limited information about a minor family member to arrange an appointment.
10. Changes to this policy
We may update this policy as our practices change. The "Last updated" date above reflects the most recent revision.
11. Business details
Zlotworks is a sole proprietorship owned and operated by Jayanth Joseph, registered under Udyam Registration Number UDYAM-KR-11-0108109 in Mangalore, Karnataka, India.
12. Contact us
For privacy-related queries, contact us at the address below.
13. Grievance Officer
We will acknowledge complaints about the handling of personal data within 24 hours and aim to resolve them within 15 days of receipt.