Privacy Policy

Our role depends on whose data it is:

• Business account data (your registration, KYC, billing, and dashboard activity) and Diner data we collect directly from Diners to run Zroton itself (WhatsApp login, bookings, payments, Zro Coins, referrals) — ZROTON AUTOMATIONS Pvt Ltd decides why and how this is used and is responsible for it.
• Customer/contact lists and conversation data a Business uploads or generates through its own WhatsApp number (for example, imported contact lists and the Business's AI-assisted chats with its own customers) — the Business decides why and how this is used; ZROTON AUTOMATIONS Pvt Ltd processes it on the Business's behalf and on its instructions. The Business is responsible for having a lawful basis and consent to message those contacts.

From Businesses and their team members:

• Account information — name, email address, phone number, and Firebase-authenticated identity (including Google sign-in).
• Business information — business name, category, timezone, WhatsApp Business Account details, phone numbers connected via Meta Embedded Signup, quality/rating and verification data returned by Meta, and restaurant profile details (address, map location, cuisine, hours, menu, seating, policies and similar facts you enter).
• Verification (KYC) information — owner name, phone and email; PAN number and document; FSSAI number and document; and, if you choose to accept bill payments through Zroton, bank account holder name, account number, IFSC, and bank name. Documents are stored privately and are visible only to authorized Zroton personnel for verification; bank account numbers are encrypted at rest.
• Billing information — plan and subscription details, invoices, and GSTIN (if supplied). Card and bank details used to pay us are handled directly by Razorpay and are not stored on our servers.
• Offers and operations data — discount offers, slot capacity, operating windows, and booking, bill, and settlement records for reservations made at your restaurant.
• Customer/contact data you upload or sync — names, phone numbers, custom attributes, and message history for the contacts you manage.
• Campaign and messaging data — message templates, campaign configuration, delivery/read receipts, and inbound replies received via the WhatsApp Business Platform.
• AI configuration — prompts, answers, and instructions you provide to set up AI replies, and AI usage metrics.
• Usage and log data — IP address, browser/device type, pages visited, push-notification subscription details, and actions taken within the dashboard.
• Communications — information you provide when contacting support or using the contact form.

From Diners:

• WhatsApp phone number and the content of messages you exchange with the Zroton Concierge or a Business's WhatsApp number, including inbound text, button taps, and location you choose to share.
• Login information — when you log in on our website, we send a confirmation message to your WhatsApp number; we record the request, your confirmation, and a session. A session token is kept in a secure cookie on your browser (hashed on our servers) for up to 400 days of activity.
• Booking and payment information — restaurant, date, dining window, party details, booking deposit, the bill amount you enter, discounts applied, Zro Coins used or earned, and Razorpay order and payment identifiers and status. Card, UPI, and bank details are processed by Razorpay and are not stored by us.
• Zro Coins and referral information — your coin balance and expiry, and the referral relationship between you and the person who referred you (identified by phone number), including rewards earned.
• Approximate location — if you allow your browser to share location, we use it to detect your city; we store the city only, not precise coordinates.
• Preferences you share with the Concierge — such as cuisine, budget, group size, and area — used to give you recommendations.
• Website activity — an anonymous visitor identifier (cookie) used to measure which restaurants and offers are shown, clicked, booked, and visited, and to avoid double-counting repeat views.
• Device and push-notification information if you enable notifications.

We use the information we collect to:

• Provide, operate, and maintain the Service, including sending and receiving WhatsApp messages via the Meta WhatsApp Business Platform.
• Create and manage bookings, collect booking deposits and bill payments, apply offers, discounts and Zro Coins, and generate confirmations and receipts.
• Calculate and settle amounts due to Businesses, including our commission and fees, and keep accounting, reconciliation, and dispute records.
• List verified restaurants on our website and Concierge, show you restaurants, offers, ratings, and reviews, and make personalized recommendations.
• Generate AI-assisted replies, recommendations, and booking handling using third-party AI model providers, as described in Section 6.
• Verify Businesses (KYC), prevent fraud, abuse, and policy violations, and protect the integrity of payments, referrals, and rewards.
• Process subscription payments, manage add-ons, and issue invoices via Razorpay.
• Send transactional and account-related messages, emails (via Brevo), and push notifications — such as booking confirmations, payment receipts, and verification decisions.
• Measure and improve the Service, including aggregated offer-performance analytics shown to Businesses.
• Comply with applicable legal, tax, and regulatory obligations.

When a Business uploads or imports contact lists (via CSV, Excel, or otherwise) for use in its campaigns, the Business acts as the controller of that data and ZROTON AUTOMATIONS Pvt Ltd processes it solely as a service provider on the Business's behalf and in accordance with its instructions.

The Business is responsible for ensuring it has a lawful basis and, where required, prior opt-in consent to message each contact, and for honoring opt-out requests. We provide tools (contact-level cooldowns, opt-out handling from inbound webhook signals, and status tracking) to help, but the underlying compliance obligation is the sender's.

When you book a table at, pay a bill to, or message a restaurant through Zroton, that restaurant receives the details needed to honor your booking — such as your name and WhatsApp number, party and date details, the booking and its payment status, the bill amount, and the discount applied. The restaurant may then contact you about that booking and use that information for its own purposes under its own privacy practices; ZROTON AUTOMATIONS Pvt Ltd is not responsible for how a restaurant handles information after receiving it. Businesses also see aggregated, non-identifying performance analytics (such as how many views, clicks, bookings, and visits their offers generated).

Diners see restaurant details that Businesses choose to publish, including name, address, location, hours, menus, offers, and Google-sourced ratings and reviews.

We share information only as necessary to operate the Service, with:

• Meta Platforms, Inc. — to send/receive WhatsApp messages, manage WhatsApp Business Accounts, and retrieve phone number quality and template status via the Meta Graph API.
• Razorpay — to process subscription, booking deposit, and bill payments and to generate invoices.
• Third-party AI model providers (currently OpenAI and/or Google, as configured by us) — message text and business context are sent to generate AI replies, recommendations, templates, and prompts. We configure these to return a response and do not authorize them to use this data to train their general models, to the extent permitted by their terms.
• Google (Firebase for authentication and file storage; Google Maps for geocoding, maps, and place ratings and reviews) and Google Cloud for hosting and task scheduling.
• Brevo — to deliver transactional emails on our behalf.
• Pusher and push-notification services — to deliver real-time in-app and web-push notifications.
• Businesses — to the extent described in Section 5.
• Other infrastructure and analytics providers who process data under contract, solely to support the Service.
• Law enforcement, regulators, or courts, where required by law or to protect our rights, users, or the public.
• A successor entity, in the event of a merger, acquisition, or sale of assets, subject to equivalent privacy protections.

We do not sell personal information to third parties.

We retain account, KYC, billing, booking, payment, and settlement records for as long as your account is active and for a reasonable period thereafter to comply with legal, tax, and accounting obligations, resolve disputes (including payment disputes), prevent fraud, and enforce our agreements. Customer/contact data a Business uploads is retained until the Business deletes it or closes its account, after which it is purged within a reasonable period. Zro Coins expire as described in our Terms; expired balances may be retained in records for audit purposes. Login confirmation records and anonymous visitor identifiers are kept only as long as needed for their purpose.

We use industry-standard safeguards — including encrypted connections (TLS), access controls, field-level encryption of sensitive items such as bank account numbers, private (non-public) storage of KYC documents, hashed session tokens, opaque single-use payment links, and HMAC-verified webhooks — to protect information against unauthorized access, alteration, or disclosure. No method of transmission or storage is completely secure, and we cannot guarantee absolute security.

Subject to applicable law, including India's Digital Personal Data Protection Act, 2023, you may request access to, correction of, or deletion of your personal information, or withdraw consent for its processing, by contacting us at the details below. Withdrawing consent or deleting data may limit your ability to use parts of the Service, and we may retain information we are legally required or permitted to keep (for example, payment and tax records). Businesses can update most account and business details directly from their dashboard, and may unsubscribe their business from the platform, which detaches their WhatsApp integration and queues deletion of their local data.

Recipients of WhatsApp messages sent through the Service can opt out at any time by replying "STOP" or through the opt-out mechanisms supported by the WhatsApp Business Platform; opt-outs are honored going forward. Diners can disable push notifications in their browser or device settings and can clear cookies at any time (which will log you out).

We use essential cookies and local storage to maintain your session (for Businesses, via Firebase; for Diners, a secure session cookie), remember preferences such as theme, and cache onboarding state. We also set an anonymous visitor cookie to measure offer performance and avoid double-counting. We do not use third-party advertising cookies.

The Service is intended for adults and is not directed at individuals under 18. We do not knowingly collect personal information from children.

Our service providers (including Meta, Razorpay, Brevo, Google, Pusher, and AI model providers) may process data on servers located outside India. Where this occurs, we rely on those providers' contractual and security safeguards to protect your information.

We may update this Privacy Policy from time to time. Material changes will be notified via email, WhatsApp, or an in-app notice. Continued use of the Service after changes take effect constitutes acceptance of the revised Policy.

For questions about this Privacy Policy, or to exercise your data rights, contact us at admin@zroton.com.

In accordance with the Information Technology Act, 2000 and rules made thereunder, grievances regarding this Policy or the Service may be addressed to our Grievance Officer, Aditya Sadana, ZROTON AUTOMATIONS Pvt Ltd (CIN U62099MP2026PTC085386), at admin@zroton.com. We acknowledge grievances within 48 hours and aim to resolve them within one month.