Privacy Policy

1. Who we are

ZestForAI ("we", "us") is an AI business operating system built and operated from Hyderabad, India. We provide AI-powered WhatsApp assistants, social media posting, content generation, CRM, and a public Social Posting API to businesses ("customers").

Contact: [email protected]

2. Data we collect

Account data: name, email, phone number, business name, and billing details you provide when signing up or purchasing a service.

Connected accounts: when you connect a social media account (Instagram, Facebook, LinkedIn, YouTube, Telegram, Reddit, Bluesky), we store the access credentials needed to post on your behalf — only after you explicitly authorise each platform.

Service content: messages, posts, documents, and media you create or receive through the platform (for example WhatsApp conversations handled by your AI assistant).

Usage data: API request counts, feature usage, and technical logs used for quotas, billing, and reliability.

3. How we use your data

To provide the services you bought: replying to your customers on WhatsApp, publishing social posts you request, generating content, and delivering purchased documents.

To enforce plan limits, prevent abuse, and bill correctly.

We do NOT sell your data. We do NOT use your private content to train AI models.

4. Google user data (YouTube)

If you connect a YouTube channel, we request the youtube.upload scope solely to upload videos you explicitly ask us to publish, plus your email address to identify your account. We store only a refresh token; we never read your YouTube history, comments, or analytics beyond what you ask us to manage.

ZestForAI's use and transfer of information received from Google APIs adheres to the Google API Services User Data Policy, including the Limited Use requirements.

5. Meta, LinkedIn, and other platforms

When you connect Facebook/Instagram Pages, LinkedIn, Reddit, Telegram, or Bluesky, we store the minimum credentials each platform issues (page tokens, OAuth refresh tokens, channel IDs, or app passwords) and use them only to publish the content you request and read engagement metrics on those posts.

You can disconnect any platform at any time; we then stop using and delete the stored credential.

6. Payments

Payments are processed by Razorpay (India) and Stripe (international). We never see or store your full card number, CVV, or UPI PIN — only the last 4 digits, payment reference, and amount for receipts and GST invoices.

7. Data retention & deletion

We keep your data while your account or subscription is active. Voice recordings are deleted after 90 days. You can request deletion of your data at any time by emailing us; we will remove personal data and keep only anonymised, aggregate records required for tax and accounting law.

8. Security

Data is stored on self-hosted servers with encrypted credentials at rest for sensitive tokens, role-based access, audit logging, and database row-level security isolating every customer's data from every other customer.

9. Changes

We may update this policy as the product evolves. Material changes will be announced on this page with a new effective date.