This text explains which personal data the ZIRVEN platform processes and why, which cookies it uses and which third-party services it works with. It is based on how the product actually works today; legal assessments are marked in square brackets.
Who we are
ZIRVEN is a software platform that gives service businesses appointments, customer records, a cashier, reports, a business web page and WhatsApp messaging tools.
[Legal review: legal name, address and registration details of the operating company, and the data controller’s contact details.]
What this policy covers
This policy covers:
- ZIRVEN’s own pages (home, packages, access request, these legal texts);
- the dashboard used by business owners and their teams;
- each business’s public page and online booking flow;
- the customer portal a business can switch on;
- the WhatsApp Business and AI features a business can connect.
Two different relationships
Two kinds of people use ZIRVEN: the businesses on the platform (and their teams), and the customers of those businesses.
A business’s customer records are kept in that business’s account and are visible only to that business’s authorised users. Platform administrators cannot see a business’s customer records from the platform screens.
[Legal review: controller / processor roles between the businesses and ZIRVEN, and a matching agreement.]
What data we process
The product stores:
- Account data: e-mail address, name, a one-way hash of the password (the password itself is never stored), language preference, an optional profile picture and sign-in times.
- Business data: business name, address, phone, opening hours, services, team members’ names, phone numbers, e-mail addresses and photos, and web page texts and pictures.
- Businesses’ customer data: name, phone, optional e-mail, appointments, payment and sales records, notes, and marketing permission with its source.
- Online booking: the name, phone and optional e-mail a visitor enters, and optional marketing permission.
- WhatsApp: when a business connects its WhatsApp Business number, the messages customers send to that number, the replies and their delivery status.
- Security records: failed sign-ins, permission denials and important operations; these may include the IP address and browser details.
Access requests
When you send the access request form, we store the business name, industry, your name, e-mail address, optional phone and message, your preferred language and the version of this notice. No IP address or browser details are kept with it.
These details are visible only to ZIRVEN platform administrators, to review your request and contact you. The form sends you no automatic e-mail or message. Requests are kept until a platform administrator deletes them.
[Legal review: retention period and the address for deletion requests.]
Why we process data
Data is processed to:
- provide appointments, calendar, customer, cashier and report features;
- run the WhatsApp and AI features a business switches on;
- protect accounts and prevent abuse (rate limits, security and audit records);
- review access requests.
Legal bases
[Legal review: the legal basis for each purpose, and where explicit consent is required.]
AI features
The AI receptionist and the dashboard assistant are off by default and run only when a business switches them on.
When they are on, the relevant message and the business records needed to answer it (for example services, opening hours, free times, and the writing customer’s own appointments) are sent to OpenAI’s API to produce a reply.
[Legal review: data processing terms with OpenAI and international transfers.]
Third-party services
ZIRVEN works with:
- Meta Platforms — WhatsApp Business Platform (Cloud API), only for businesses that connect a WhatsApp number.
- OpenAI — only for businesses that switch on AI features.
- A server hosting and file storage provider. [Legal review: names and locations of the providers.]
Retention
Dashboard sessions end after an idle and an absolute time limit; customer portal sessions end within seven days at most. One-time sign-in links expire shortly after they are issued.
[Legal review: retention periods for account, business, customer, message and security records.]
Security
Each business’s data is kept separate and checked on the server for every request; roles and permissions are enforced on the server. Passwords are stored as one-way hashes, WhatsApp access tokens are encrypted and never sent to a browser. Connections use HTTPS; uploaded pictures are re-encoded and their metadata removed.
No system is entirely without risk; the process followed after a security incident is subject to [Legal review].
Your rights
If you are a customer of a business, send requests about your records at that business to the business first.
A known limitation: the dashboard has no way yet to delete a customer record. Deletion requests are therefore handled through the contact route below.
[Legal review: the rights under the applicable law and how to exercise them.]
Data deletion requests
If you have messaged a business’s WhatsApp line or booked with a business and want your records deleted, you can send your request to that business and to the address below. Say which business and which phone number the request is about.
[Legal review: e-mail address for deletion requests and the response time.]
Changes
When this text changes, the date at the top of the page changes.
Contact
[Legal review: e-mail and postal address for privacy questions.]