Privacy policy

We are the controller of the data about our customers: the people and businesses who sign up for Zovama and their team members.

Our customers add the Zovama chat widget to their own websites. For the data of their website visitors (chat messages, visitor details), the customer is the controller and we act as their processor: we process that data only to provide the Service, under the customer's instructions and our data processing terms. If you chatted with a business through a Zovama widget, please contact that business first about your data; we will help them answer your request.

• Account details: name, email address, password (stored only as a secure hash), optional two-factor authentication, and your Google account email and name if you sign in with Google.
• Workspace details: company or workspace name, websites you add, team members you invite, settings, canned replies and the content you add to the knowledge base.
• Billing details: plan, invoices and payment status. Card and PayPal details are entered directly with Stripe or PayPal; we never see or store full card numbers.
• Usage and technical data: sign-in times, IP address, browser type, AI usage (number of AI replies) and logs we need to run, secure and support the Service.
• Communications: emails and messages you send to our support.

When a visitor uses a Zovama chat widget on a customer's website, we process the following on the customer's behalf:

• An anonymous visitor ID stored in the visitor's browser (localStorage, not a cookie).
• Chat messages, files sent in the chat, and the name and email address if the visitor or the website provides them.
• IP address (the customer can choose to store it masked), and the approximate location derived from it (country, region, city, internet provider). Location is looked up on our own servers using an offline database; the IP address is not sent to a third party for this.
• Browser, operating system, device type, language, time zone and screen size.
• How the visitor arrived (referrer and campaign parameters), the landing page and, if the customer enables it, the pages viewed during the visit.
• Whether the visitor accepted the website's pre-chat consent text, if the customer uses one.

Customers decide how long this data is kept (from 30 days to unlimited), whether IP addresses are masked and whether page views are recorded. Expired data is deleted automatically every day.

When a customer turns on the AI assistant, we read the customer's website pages and documents and turn them into a searchable knowledge base. This step runs entirely on our own servers.

To write a reply, we send the visitor's recent messages and the most relevant excerpts of the customer's knowledge base to a third-party AI model provider (such as DeepSeek, OpenAI or Anthropic), which generates the answer. The same happens when an agent uses "AI suggest" or tests the assistant in the panel. The AI model provider may process this data outside the UK and the EU (see section 7).

We do not use chat content to train AI models, and we do not sell personal data. Customers can turn the AI assistant off at any time; chats are then handled only by their team.

• To provide the Service you signed up for, including billing and support (performance of a contract).
• To keep the Service secure, prevent abuse and fraud, and improve the product (our legitimate interests).
• To send service emails, such as security notices, missed chat alerts, credit warnings and invoices (contract and legitimate interests).
• To send product news or marketing, only if you agree to it; you can unsubscribe at any time (consent).
• To meet tax, accounting and other legal obligations (legal obligation).

We use the following service providers to run Zovama. They may only use the data to provide their service to us.

Customers can request the current list of our sub-processors at [email protected]. We will inform customers before adding or replacing a sub-processor that processes their visitors' data.

We may also disclose data if required by law, or as part of a merger or acquisition, in which case this policy will continue to apply.

Our servers are in the European Union. Some of the providers above process data outside the UK and the EU. Where personal data is transferred outside the UK or the EU, we rely on adequacy decisions where available or on standard contractual clauses and additional safeguards. You can ask us for more information about these safeguards.

• Account and workspace data: while your account is active. After you close your account, we delete it within 30 days, except what we must keep by law.
• Invoices and billing records: as long as tax and accounting laws require (usually 6 years in the UK).
• Website visitor data: according to the retention period the customer sets, or until the customer deletes it.
• Server logs: up to 90 days.

We use encryption in transit (HTTPS), hashed passwords, optional two-factor authentication, access controls and audit logs for staff access. No system is perfectly secure, but we work to protect your data and will notify you and the authorities of a personal data breach where the law requires it.

Depending on where you live (for example under UK GDPR or EU GDPR), you may have the right to access, correct, delete or export your data, to object to or restrict certain processing, and to withdraw consent. To use these rights, email us at [email protected]. To close your Zovama account and delete its data, write to us from your account's email address. We may ask you to confirm your identity, and we reply within one month. If your data was collected through a customer's website, we will forward your request to that customer.

You can also complain to a data protection authority. In the UK this is the Information Commissioner's Office (ico.org.uk).

Zovama is a service for businesses. It is not meant for children, and we do not knowingly collect data from anyone under 16 as a customer.

We may update this policy. If the changes are significant, we will let customers know by email or in the panel before they take effect.