Privacy policy

Who we are

[LEGAL ENTITY NAME], a business based in Dubai, United Arab Emirates. Trade licence: [TRADE LICENCE NUMBER]. Registered address: [REGISTERED ADDRESS]. Contact for anything in this page: hello@zoromarketing.com.

Scope

This policy covers this website, the sign-up and Control Center, and the AI agents we run for our clients. It is written to follow the UAE Federal Decree-Law No. 45 of 2021 on personal data protection (PDPL) and to be ready for the GDPR. When we run an AI agent for a client, the client decides why the data is used and we act on their instructions; for our own website, accounts and marketing we decide.

What we collect

• Contact and demo forms, and the newsletter box: name, email, business name, industry, the plan you are interested in, your message and preferred call time, and which form you used.
• Accounts: name, email, business name and a password (stored only as a salted hash by our authentication provider). Staff accounts also have a role.
• Control Center: your business profile and brand voice, the tools you switch on and their settings, leads, support tickets and messages, and integration status. Secret keys are stored encrypted and are never shown back in the browser.
• AI Support Agent: the questions asked and the answers given (kept in your activity log, cut to 500 and 1,000 characters), plus usage counts, token counts and cost per client.
• Technical data: a one-way hash of your IP address on the contact forms, used only to limit spam; server logs; email delivery status (to address, type, delivered or bounced).
• Website Conversions: if you connect Google Analytics, the read-only reports we download (see Google user data below). Where your chat widget starts a chat we also keep which campaign link the visitor arrived by (the four utm_ values in the link and the page path, never the full web address).
• Consent records: the version of the Terms, Privacy Policy and cookie choice you accepted, and when.

Why we use it, and our legal basis

• To answer your enquiry and take steps you ask for before a contract (contract / legitimate interest).
• To provide the service you signed up for, including running AI agents and sending notifications about your account (contract).
• To keep the service secure and prevent abuse (legitimate interest).
• To send marketing you asked for, such as the newsletter (consent). You can unsubscribe at any time.
• To meet legal and accounting duties (legal obligation).

Who processes it for us

• Supabase: database, sign-in and encrypted key storage.
• Lovable: application hosting and the Lovable AI gateway.
• OpenRouter and the Lovable AI gateway: AI model providers. The text of a question, your business knowledge and instructions are sent to generate a reply. We do not send passwords or secret keys.
• Mailgun: sending and delivering email.
• Google: if you connect Google Analytics we read your reports through Google's APIs (see Google user data below).
• Stripe: planned for payments. It is not active yet; this policy will be updated before it is.
• Google Fonts: the site loads fonts from Google, which sees your IP address and browser details when a page loads.
• These providers may process data outside the UAE. Where required we rely on contracts and safeguards that give equivalent protection.

Google user data (Website Conversions)

• [FOR LEGAL REVIEW] If you connect Google Analytics, we ask Google for read-only access to your Analytics reports (the analytics.readonly permission) and for your email address, so we can show which Google account is connected. We never ask to change anything in your Google account.
• What we read: event counts per day (for example leads and purchases), campaign names, traffic sources and mediums, and purchase revenue, for the Google Analytics property you choose.
• What we store: the refresh token Google gives us, kept encrypted in our secret vault; the Google account email, the property and Measurement ID you chose; and the report numbers we download. We never see or store your Google password.
• How we use it: only to show you your own funnel and campaign results in your dashboard. We do not sell it or share it with anyone else, we do not use it for advertising, and we do not use it to train general AI models. Our staff do not read it, except to give you support you asked for, to keep the service secure, or when the law requires.
• Disconnect and delete: in Website Conversions, Setup, choose Disconnect Google. We revoke our access with Google and delete the saved sign-in straight away; tick the box to delete the downloaded numbers too. You can also remove our access at any time at myaccount.google.com/permissions. Deleting your account removes everything.
• youragency's use and transfer to any other app of information received from Google APIs will adhere to the Google API Services User Data Policy, including the Limited Use requirements.

Sharing

We do not sell personal data. We share it with the providers above, with professional advisers, and with authorities when the law requires it.

How long we keep it

Enquiries and consent records are kept while needed to handle your request and for [RETENTION PERIOD] afterwards. Client account data is kept while the account is active and deleted when the account is closed or on request. Email delivery logs are kept for [RETENTION PERIOD].

Your rights

You can ask us to give you a copy of your data, correct it, delete it, restrict or object to its use, move it, or withdraw consent at any time. We can export or delete a client's data on request. Email us at the address above; we aim to answer within 30 days. You may also complain to the UAE Data Office or, if you are in the EU or UK, to your local data protection authority.

Cookies

See the cookie policy. Only essential cookies are used until you choose otherwise.

Children

The service is for businesses and is not aimed at children.

AI agents

Chats with our agents are answered by AI and say so. Answers can be wrong; do not rely on them for legal, medical or financial decisions. If the website running the chat widget already uses Google Analytics or Tag Manager, the widget tells it when a chat starts and when a visitor leaves contact details (events chat_started and generate_lead, no personal details); it never loads Google code of its own.

Changes

When this page changes in substance its version changes and we will ask you to accept it again where the law requires.