Privacy Policy

1. Who we are

ZebChat is operated by Tech Avenue Labs, Hyderabad, India (“we”, “us”). This policy explains what personal data we handle, why, and what rights you have. It covers two groups of people:

• Customers: people with a ZebChat account, such as owners, admins and agents. For their data we are the controller.
• Visitors: people who use the chat widget on a website run by one of our customers. For their data the website owner is the controller and we are a processor acting on the website owner’s instructions under our Data Processing Agreement.

This website (zebchat.com) does not use analytics, advertising or tracking cookies. See the Cookie Policy. The mobile apps send optional crash reports and usage analytics, see Crash reports and usage analytics in the mobile apps.

2. Data about customers

When you use ZebChat as a customer we process:

• Account data: name, email address, a hash of your password (never the password itself), profile photo or avatar, time zone and preferences.
• Organization data: organizations, roles, teams, skills, invitations and an audit log of changes made in your organization.
• Sessions and devices: sign-in sessions with the IP address and device information needed to show and revoke them, and push notification tokens for the apps and browsers where you enable notifications.
• Activity in the Service: messages and notes you write, your agent status and online time (used for routing and reports), and feedback you give on AI replies.
• Billing data: plan, invoices and subscription status. Card and PayPal details are collected and stored by Stripe and PayPal, not by us.
• Communications: messages you send us, for example through the contact form or by email.
• Technical logs: request logs and error reports used to run and secure the Service.

3. Crash reports and usage analytics in the mobile apps

The ZebChat apps for Android and iOS use two Google services, as our processors, to find and fix problems and to learn which features are used. Both are on by default and you can switch each off at any time in the app under Settings → Privacy; the choice is kept on your device and applies at once.

• Firebase Crashlytics (“Send crash reports”): when the app crashes or hits a serious error, it sends the error details and stack trace, the app version, the device model and operating system, and a random Crashlytics installation id. Reports carry your internal ZebChat user id so we can help when you contact support; never your name, email address, messages, visitor data or sign-in tokens.
• Google Analytics for Firebase (“Share usage analytics”): which screens are opened and which features are used (for example that a reply was sent or a chat was assigned, never what was written or to whom), with a random app-instance id, the device model, operating system, app version, language and an approximate location (country, region, city) that Google derives from the IP address. It is not linked to your account. We do not use the advertising id, do not track you across other apps or websites, and do not use this data for advertising or personalized ads.

Legal basis: our legitimate interests in a reliable app and in improving it; you can object at any time with the switches above. Google keeps crash reports for 90 days and analytics event data for at most 14 months (our retention setting), then deletes them. Switching a setting off also deletes reports not sent yet and resets the analytics id. Development builds never send either. See Privacy and Security in Firebase and the Google Privacy Policy.

4. Data about website visitors

On behalf of the website owner, the ZebChat widget can process the following, depending on how the website owner configured it:

• a random visitor key kept in the browser’s local storage, so returning visitors keep their chat (not set in cookie-consent mode until the visitor agrees);
• pages viewed (address, title and referring site), visit times, browser, operating system, device type and campaign (UTM) parameters;
• the IP address and user agent of each visit, and an approximate location (country, region, city) when our network provider supplies one;
• messages and files the visitor sends, form answers, ratings and comments, and any name, email, phone number or customer id the visitor enters or the website passes to ZebChat;
• custom events and tags the website records;
• when the website owner enables the AI assistant, the conversation is sent to the AI provider whose key the website owner added.

Where the website owner turns on consent features, we log each consent decision on the website owner’s behalf, as processor: the decision, its source, the visitor’s region and country (never the IP address) and the time. We keep this log for up to 2 years and delete it together with the visitor. The widget honours Global Privacy Control where the website owner enables it.

Visitors who want to exercise their rights should contact the website they chatted with first. We help website owners answer these requests, including with export and erasure tools.

5. How we use data and legal bases

• To provide the Service (performance of our contract with you): accounts, chat delivery, routing, notifications, reports, billing.
• To keep the Service secure (legitimate interests and legal obligations): rate limits, abuse prevention, audit logs, error monitoring and backups.
• To communicate with you (contract and legitimate interests): service emails such as verification, invitations, alerts, billing notices and important changes. We do not send marketing emails without your consent.
• To improve the Service (legitimate interests): aggregated, non-identifying usage statistics.
• To meet legal obligations: tax, accounting and lawful requests.

6. Sharing and subprocessors

We do not sell personal data. We share it only with service providers that help us run ZebChat (listed on our Subprocessors page), with the AI providers and endpoints a customer chooses to connect, when the law requires it, or as part of a merger or acquisition with appropriate protections.

7. International transfers

Production data is hosted in [Hosting region]. Some providers process data in other countries. Where personal data leaves the European Economic Area, the United Kingdom or Switzerland, we rely on adequacy decisions or the European Commission’s Standard Contractual Clauses and equivalent safeguards.

8. Retention

• Account and organization data: while the account or organization exists. When you delete your account, see what is deleted and what is kept.
• Ended conversations and their files: as long as the organization’s retention setting says (from 30 days to 7 years, or unlimited).
• Visitor tracking data (pageviews and visits): up to 180 days.
• Webhook delivery logs and AI action call logs: 30 days.
• Expired sessions and tokens: removed automatically.
• Billing records: as long as tax and accounting laws require.
• Backups: overwritten on a rolling schedule; deleted data disappears from them within 30 days.

9. Security

We protect data with database-level tenant isolation, hashed passwords and tokens, encrypted secrets, signed links for files and strict access controls. Read more on our Security page.

10. Your rights

Depending on where you live, you may have the right to access, correct, delete or export your personal data, to object to or restrict certain processing, and to withdraw consent. You can update most account data yourself in the dashboard or apps, and you can delete your account yourself at any time: in the app under Settings → Delete account, or in the dashboard under Settings → Profile. See Delete your ZebChat account for the steps and for what is deleted and what is kept. To exercise your other rights, or if you cannot sign in, email [email protected]. We will answer within the time the law requires.

You also have the right to complain to your data protection authority. We would appreciate the chance to address your concern first.

11. Children

ZebChat accounts are not intended for children under 16. Website owners must not use the widget to knowingly collect children’s data without the consent the law requires.

12. Changes to this policy

We may update this policy. We will post the new version here with a new date and, for material changes, notify customers by email or in the dashboard.