Privacy Policy
Version 2026-10-10 · Last updated 10 October 2026
This Privacy Policy explains how ZaLink LLC ("ZaLink", "we") handles personal data in connection with ZaLink AI and the zalinkai.com website. It is written for the businesses that use ZaLink, their team members, visitors to our website, and people who message a business that uses ZaLink.
1. Who is responsible for your data
- ZaLink is responsible (the controller) for the data of our own customers' accounts and team members, billing, our website and enquiries made to us.
- The business you message is responsible (the controller) for conversations between that business and its customers on WhatsApp, and for its contacts, appointments, orders and knowledge base. ZaLink processes that data on the business's behalf, under its instructions and our Data Processing Addendum. If you messaged a business, its own privacy notice applies, and requests about your data should go to that business first.
Contact: support@zalink.ai. ZaLink LLC, [registered address — to be confirmed].
2. Data we collect as controller
| Data | Where it comes from | What we use it for |
|---|---|---|
| Account: name, email address, password (stored only in hashed form by our sign-in service), role and workspace | You, at sign-up or when invited | Creating and securing your account, letting you use ZaLink, service messages such as verification codes |
| Business details: company name, business type, country, language, support phone and email, AI settings | You | Running your workspace. Some of these details are used by the AI agent in replies to your customers. |
| Billing: plan, subscription status and dates, billing email, payment requests; with online payment, the customer and subscription identifiers used by our payment processing service provider | You, our payment processing service provider | Charging for and managing your subscription, accounting. ZaLink does not receive or store complete payment-card details. |
| Sign-in and security data: sign-in times, and the IP address and browser of active sessions (kept by our sign-in service); a log of important account and settings changes | Your use of ZaLink | Security, preventing misuse, investigating problems |
| Website enquiries: name, company, email, WhatsApp number, website, industry, expected message volume and your message | Forms on zalinkai.com | Replying to your enquiry and following up about ZaLink |
| Emails you send us | You | Answering you |
We do not use advertising or analytics tracking on our website or app. See our Cookies & Local Storage notice.
3. Data we process for businesses
To provide ZaLink, we process on behalf of each business:
- its customers' WhatsApp numbers and profile names, and contact details the business adds or imports (such as email, company, notes and marketing preferences);
- the content of WhatsApp conversations: text, voice notes (and their transcripts), images, documents and other media, and information from advertisements that started a conversation;
- appointments, orders, sales opportunities, escalations and campaign recipients;
- the knowledge base the business uploads, including documents and website content;
- the AI agent's results for each message, such as the detected topic, the reply and an internal note for staff.
Conversations can include sensitive information that customers choose to share, such as health details when they message a clinic. ZaLink does not ask for it, but it cannot prevent customers from sending it.
4. How the AI works with personal data
- To generate an AI-assisted reply, ZaLink AI uses specialised AI processing services provided by third-party AI processing service providers. It sends them the customer's latest message and up to 40 earlier messages of the same conversation, relevant parts of the business's knowledge base, and the business details needed for the reply. Voice notes and images are sent to these services so they can be understood. The customer's phone number and name are not sent as separate fields, but the AI sees them if they appear in the messages. Information from an advertisement or campaign that started the conversation is also included.
- The AI is also used to read and index the business's knowledge base, and, where switched on, to understand booking and order requests.
- Depending on the business's settings, replies are sent automatically or kept for staff to review. Cases the AI should not handle are passed to the business's staff, and customers can ask to speak to a person.
- ZaLink does not use conversations or other workspace data to train AI models.
- How our AI processing service providers may use the data they receive: [AI provider terms under which the provider acts as a processor and does not use the data to improve its own models — to be confirmed].
5. Why we are allowed to use the data
We use personal data where it is needed to perform our contract with you or to take steps you asked for before entering into one; where we must do so to comply with the law (for example tax and accounting rules); and with your consent where the law requires consent. Where we process data for a business, that business is responsible for having a lawful basis for it.
7. Where data is processed
ZaLink platform infrastructure, including our database and stored files, is hosted by a cloud infrastructure provider in Singapore. AI processing, WhatsApp messaging and payment processing are carried out by our service providers on their own infrastructure, which may be in other countries, including the United States. This means personal data, including data about people in the UAE, is transferred outside the UAE.
For these transfers we rely on contractual data-protection terms with our providers, which we are putting in place with each of them. Businesses using ZaLink should tell their customers that their messages are processed by service providers outside the UAE.
8. How long we keep data
| Data | How long |
|---|---|
| Account and workspace data, conversations, contacts, files and other business data | For as long as the workspace exists. Cancelling a subscription does not delete it. It is deleted when the workspace is deleted, or earlier where the business deletes it in the app. |
| The AI's processing record for each message | The full technical AI output is cleared after 14 days. The reply, the detected topic, the note for staff and processing diagnostics stay with the conversation. |
| Log of important account and settings changes | 90 days |
| Website enquiries | [retention period for website enquiries — to be confirmed] |
| Billing and payment records | [retention period required for tax and accounting records — to be confirmed] |
| Sign-in session data | Managed by our sign-in service while a session is active |
| Copies in our providers' backups and system logs | Until they expire on the providers' schedules |
9. How we protect data
Each business's data is kept separate with access rules enforced in the database, so a business can only see its own data. Team members get access according to their role. Stored files are private: customer media is opened only through links that expire after one hour, and knowledge-base files only by signed-in members of the workspace. Connections to ZaLink are encrypted, and our cloud infrastructure provider encrypts stored data. Messages arriving from the WhatsApp platform are checked to confirm they genuinely come from it. Credentials for connected point-of-sale systems are kept in a dedicated secrets vault.
No system is completely secure, and we keep improving our safeguards. If a security incident affects personal data, we will act quickly to contain it and will inform affected businesses and, where the law requires, the authorities.
10. Your rights
Under the UAE Personal Data Protection Law you can ask for information about how your data is processed, and for access to, a copy of, correction of or deletion of your data. You can also ask us to restrict processing, object to processing for direct marketing, and object to decisions made only by automated processing that significantly affect you.
To make a request, follow the steps on our Data Requests & Deletion page or write to support@zalink.ai. If your data is in a business's conversations, we will pass your request to that business. You may also complain to the UAE Data Office.
11. Marketing from ZaLink
We do not currently send marketing emails. If we start, we will only do so where the law allows it, and every message will let you opt out easily. Accepting our Terms never means agreeing to receive marketing.
12. Children
ZaLink is a business service and is not meant for anyone under 18. Businesses should not use it to contact children for marketing.
13. Changes
We will update this policy when our processing changes, and change the date at the top. If a change is significant, we will tell workspace owners before it applies.