Privacy policy

Who we are

Zana (meetzana.com, “Zana”, “we”) is an assistant that helps businesses answer customers, sell products and book appointments on Instagram, Facebook Messenger, WhatsApp, TikTok and their own Zana page. The company details and the contact address are at the end of this page.

For the accounts of businesses and their team members we are the data controller. For the messages and customer data a business handles through Zana we act on behalf of that business, as its processor: the business decides why the data is used, and we follow its instructions.

What data we collect

• Account data: your name, email address, phone number if you add it, and your role in the business.
• Business data: business name, type, language, currency, time zone, products, prices, stock, services, opening hours, policies and the documents you upload.
• Connected channel data: account and page identifiers, messages and comments customers send to the business, their display names, profile pictures and attachments (images, voice notes, files), and the posts you choose to import. Access tokens are stored encrypted.
• Orders and bookings: what customers ordered or booked, delivery or contact details they give, and the status of each order or appointment.
• Device data: the push notification token of your phone, the app version and the platform (iOS or Android).
• Technical data: limited security and operations logs (time, request path, status, error codes). We do not log passwords, tokens, message text or addresses.

We collect this data from you, from your team, from the channels you connect (Meta and TikTok send it to us when customers write to you) and from your customers when they order or book.

How we use it and on what basis

• To provide the service under our contract with the business: showing messages, writing replies, keeping the catalog, orders and bookings, and sending notifications.
• To keep accounts secure and prevent abuse and fraud, based on our legitimate interest.
• To meet legal obligations, such as accounting records and requests from authorities.
• To send service emails: sign-in codes, invitations, deletion receipts and important changes. We do not send marketing without your consent.

We do not sell personal data, we do not use customer messages for advertising, and we do not build advertising profiles.

How the AI assistant uses data

Zana uses AI models to understand messages, voice notes and pictures and to write replies. Prices, stock, policies and order status always come from the business’s own data; the assistant does not invent them. When it is unsure, it hands the conversation to a person in the business.

Only the data needed for a reply is sent to the AI provider. We do not use business or customer data to train AI models, and we choose AI providers whose business terms do not allow them to train their models on the data we send.

Zana does not make decisions with legal or similarly significant effects about anyone. The business can pause the assistant or take over any conversation at any time.

Who we share it with

We share data only with providers that help us run Zana, only as far as needed, and under contracts that require confidentiality and security:

• Hosting and storage: a server in the European Union, and Cloudflare for the website, file storage and network security.
• AI models: Google Gemini, reached through OpenRouter, to understand messages and write replies.
• Email: Resend, to deliver sign-in codes and service emails.
• Push notifications: Expo, Apple and Google, to deliver notifications to your phone.
• Connected platforms: Meta (Instagram, Messenger, WhatsApp) and TikTok, only to receive messages and to send the replies the business, or the assistant on its behalf, sends.

We may also disclose data when the law requires it, or to protect the rights and safety of people and of Zana. If Zana is reorganized or sold, data moves only under the same protections and we will tell you first.

Data from Meta and TikTok

Data we receive through the Instagram, Facebook, WhatsApp and TikTok platforms is used only to provide Zana to the business that connected the account, in line with the Meta Platform Terms and TikTok’s developer terms. We do not sell it, use it for advertising, or share it with data brokers.

When a business disconnects a channel or deletes its account, we stop receiving data from that channel and delete the data we got from it as described on the Data deletion page.

International transfers

Our main servers are in the European Union. Some providers (for example AI, email and push notifications) may process data in other countries, including the United States. When they do, we rely on safeguards recognized under Albanian and EU law, such as the European Commission’s standard contractual clauses or an adequacy decision.

How long we keep it

• Account and business data: while the account is active. After a deletion request we delete it within 30 days.
• Messages, customers, orders and bookings: as long as the business keeps its account, or until the business deletes them.
• Order and payment records the law requires us to keep: only for the period required by tax and accounting law.
• Security and operations logs: only as long as needed to keep the service secure and to fix problems.
• Backups: overwritten on a rolling schedule; deleted data disappears from backups when they expire.

How we protect it

Connections are encrypted (HTTPS). Channel access tokens are encrypted in the database. Each business’s data is isolated at the database level, so one business cannot see another’s. Sign-in uses one-time email codes instead of passwords, and access inside our team is limited to what each task needs. No system is perfectly secure; if a breach affects your data, we will tell you and the authorities as the law requires.

Your rights

Under Albania’s Law No. 124/2024 on personal data protection and, where it applies, the EU GDPR, you can:

• ask for a copy of your data (access) and receive it in a portable format;
• correct inaccurate data;
• ask us to delete your data;
• restrict or object to some processing;
• withdraw consent where processing relies on it;
• complain to the Commissioner for the Right to Information and Personal Data Protection (idp.al) or your local data protection authority.

Write to the contact address below; we answer within one month. We may ask you to confirm your identity first. If you are a customer of a business that uses Zana, you can also contact that business directly; we will forward your request to it and help it respond.

Children

Zana accounts are for businesses and adults aged 18 or over. Zana is not directed at children, and we do not knowingly collect children’s data. If you believe a child has given us data, contact us and we will delete it.

Cookies

The website uses only the cookies needed to keep you signed in and to protect forms. We do not use advertising or tracking cookies.

Changes to this policy

We will update this page when our practices change and show the date of the latest version at the top. For important changes we will tell you by email or in the app before they take effect.