qzenchat Privacy Policy

Effective date: October 28, 2026
Operator: QUANTERON LLC
Website: https://www.qzenchat.com
Privacy and deletion requests: privacy@qzenchat.com

1. Who we are and what this policy covers

QUANTERON LLC ("Quanteron," "qzenchat," "we," "us," or "our") provides qzenchat, a business platform for customer messaging, AI-assisted support, conversational commerce, appointment operations, and logistics coordination.

Our mailing address is:

QUANTERON LLC
1209 Mountain Road Pl NE, Ste R
Albuquerque, NM 87110
United States

This policy explains how we handle personal information through qzenchat's website, application, connected messaging channels, booking and webchat experiences, and support communications. It applies only to features actually enabled for your workspace. A feature described here is not a promise that it is available in every plan, country, or beta release.

The initial service is intended for adult business users serving the Bangladesh market. Our operator is in the United States, and service providers may process information in other countries.

Business information and merchant-controlled information

We determine the purposes and means of processing information used to operate our own business, such as merchant account administration, security, service communications, and legal compliance. Where applicable privacy laws use these terms, we act as a controller for that processing.

When a merchant uses qzenchat to manage its customers' messages, contacts, orders, bookings, or uploaded knowledge, the merchant generally determines the purposes of that processing. We generally act as its processor or service provider, subject to its lawful instructions and our applicable agreement.

If you are a merchant's customer, the merchant's privacy notice also applies to its handling of your information. Contact the merchant for questions about its purchases, services, marketing, or retention decisions. You may always contact us directly about information held in qzenchat; we will help route and resolve the request without requiring you to create an account.

Meta, Google, Microsoft, couriers, and other independently operated services may also process information under their own notices. Our policy does not replace those notices.

2. Information we collect

We collect information you provide, information generated through use of the service, and information received from integrations authorized by a merchant or other authorized user.

Category	Examples	Source and purpose
Account and workspace information	Name, work email, business name, role, invitations, workspace preferences, authentication and session records	Users and workspace administrators; account access and administration
Customer and conversation information	Names, phone numbers, email addresses, channel identifiers, messages, attachments where supported, timestamps, delivery status, tags, assignments, consent and opt-out records	Customers, merchants, and connected channels; inbox, support, messaging, and customer operations
Commerce and fulfillment information	Products, order items, quantities, order history, recipient name, phone number, delivery address, delivery instructions, consignment and tracking references	Merchants, customers, and couriers; orders and fulfillment
Appointment information	Customer contact details, service, provider or resource, requested and confirmed times, booking status, reminders, and scheduling preferences	Merchants, customers, and connected calendars; booking and availability management
Knowledge and automation information	Uploaded documents, authorized website content, extracted text, searchable chunks, embeddings, published business instructions, and AI input and output	Merchants and service processing; business knowledge retrieval and automation
Integration information	Connected account, Page, business and channel identifiers; account display information; permissions; access and refresh tokens; calendar identifiers and synchronization references	Authorized third-party services; connecting and operating requested features
Technical and security information	IP address, browser and device information, request times, session identifiers, error information, service usage counts, security events, and access records	Website and application use; delivery, reliability, security, and abuse prevention
Support and privacy correspondence	Contact details, request description, relevant identifiers, verification outcome, correspondence, and resolution	People contacting us; assistance, rights requests, and accountability
Commercial administration, when applicable	Plan, invoice, billing address, tax details, payment status, transaction or refund references	Business customers and payment providers; administering paid services

We do not ask you to send full payment-card numbers, card security codes, account passwords, social-platform passwords, or authentication tokens through messages or support forms. If a payment feature is available, the designated payment provider handles payment credentials through its payment flow; qzenchat's ordinary messages and knowledge uploads are not payment-credential collection tools.

Sensitive information

The service is not designed for clinical records, medical diagnosis or treatment, government identity documents, biometric identification, full financial-account credentials, or other highly sensitive regulated records. Do not upload or request that information unless a separately agreed service expressly supports it and all required safeguards are in place.

An appointment service name or conversation may nevertheless reveal sensitive information. Merchants must minimize such details, use neutral booking labels where appropriate, and avoid sending sensitive content to AI or messaging providers.

3. Why we use information

We use information to:

Create and secure accounts, authenticate users, and administer workspace membership.
Connect authorized business channels and receive, organize, and send permitted messages.
Manage customer support, customer records, orders, appointments, reminders, and fulfillment.
Retrieve business knowledge and generate AI-assisted responses or execute authorized business workflows.
Synchronize authorized calendar availability and appointment events.
Operate, troubleshoot, measure, and improve service functionality using appropriately minimized data.
Process service charges and maintain commercial records when paid services are offered.
Provide support and send necessary verification, security, billing, and service notices.
Prevent fraud, spam, unauthorized access, and other abuse.
Respond to privacy requests, meet legal obligations, and establish or defend legal claims.
Send our own optional marketing communications where permitted and with consent where required.

We do not sell personal information, rent customer contact lists, or share personal information for cross-context behavioral advertising. We do not use private customer conversations or connected-platform information to build unrelated advertising profiles.

Operational analysis and service improvement do not authorize unrestricted reuse of message content, knowledge documents, or third-party platform data. Provider-specific restrictions and the AI commitments below continue to apply.

4. Meta, Facebook, Instagram, Messenger, and WhatsApp

When a merchant connects a supported Meta account or business asset, we process only the information made available through the permissions and features authorized for that connection. Depending on the integration, this may include:

Business, Page, Instagram professional-account, WhatsApp Business Account, and phone-number identifiers and display information.
Access credentials and permission records needed to maintain the authorized connection.
Customer identifiers, profile information supplied by the platform, messages, supported media, timestamps, and delivery or interaction events.
Business messaging configuration and template information where the feature is enabled.

We use this information to provide the connected inbox, permitted messaging, customer support, merchant-authorized order and booking workflows, and related service operations. We do not obtain access to a person's entire private Facebook or Instagram account merely because a merchant connects a business asset.

We do not sell Meta Platform Data, use it for surveillance, or repurpose it for unrelated profiling. Providers that process it for us must be restricted to the permitted service purpose. AI processing of Meta-derived content is permitted only where the relevant Meta and product-specific terms, permissions, and provider arrangements allow it.

Disconnecting a channel or removing qzenchat's permissions stops the authorized connection, subject to technical propagation. Disconnection is not the same as a complete deletion request. Historical records require appropriate deletion handling; we do not retain Platform Data simply because it was collected before revocation. We delete Platform Data promptly when required by Meta, a valid user or merchant request, loss of a permitted purpose, account closure, or applicable law.

To request deletion, email privacy@qzenchat.com or follow our Data Deletion Policy. You do not need an active qzenchat account or continued access to the connected Meta account to contact us.

5. Google and other calendar connections

If Google Calendar synchronization is enabled and you choose to connect it, qzenchat requests authorization to identify the connected Google account and access calendar events for the supported scheduling feature.

The Google connection requests openid, email, and https://www.googleapis.com/auth/calendar.events. The calendar-events permission can authorize broader event access than the busy-time information qzenchat needs to retain. Our feature uses event identifiers, start and end times, cancellation and availability indicators, synchronization tokens, and relevant event metadata to import busy periods, avoid conflicts, and manage appointment events created by qzenchat. We do not use this connection to read Gmail.

When exporting an appointment, qzenchat sends scheduling information such as the service label, appointment identifier, and start and end times to the connected calendar. Calendar sharing settings can make exported labels visible to other people; use non-sensitive service labels and review those settings.

qzenchat's use and transfer of information received from Google APIs will adhere to the Google API Services User Data Policy, including the Limited Use requirements.

In particular:

We use Google user data only to provide or improve the appropriate, prominently disclosed user-facing features.
We do not use it for advertising, data brokerage, creditworthiness or lending decisions, or surveillance.
We do not use Google Workspace API data to develop, improve, or train generalized AI or machine-learning models. The calendar integration is not a source for the conversational AI or knowledge-retrieval pipeline.
We transfer Google user data only as permitted by the applicable policy, including for the authorized feature with consent, security, legal compliance, or a business transfer with the explicit prior consent required by that policy.
Human access is limited to the policy's permitted exceptions, such as your affirmative agreement to view specific data, necessary security investigation, legal requirements, or permitted aggregated internal operations.

You can revoke access through Google Account connections. Revocation stops future authorized access but does not automatically erase all previously stored records. Contact privacy@qzenchat.com to request deletion of those records.

Microsoft calendar and authorized iCalendar connections, where enabled, similarly process the account or feed details, availability, event references, and appointment information needed for the requested synchronization. A private iCalendar feed URL can function as an access credential; do not share it publicly.

6. AI, knowledge retrieval, and automated assistance

When AI features are enabled, relevant customer messages, recent conversation context, merchant instructions, retrieved knowledge excerpts, and necessary business information may be transmitted to an AI provider to generate a response or support an authorized action. Uploaded knowledge may also be sent to an embedding provider to create searchable mathematical representations.

The provider offered for conversation generation may differ from the embedding provider. Supported conversation-provider options include OpenAI, Google Gemini, Qwen, and DeepSeek; only approved and enabled options are available to a workspace. Knowledge embeddings use OpenAI independently of the selected conversation model. Platform-controlled fallback may route a request to another approved provider when the selected model is unavailable.

We identify the providers available for your workspace before activation. A provider's inclusion in the software does not mean every workspace sends information to it. Contact privacy@qzenchat.com for the current recipient list, relevant processing locations, and handling terms.

We do not use private workspace content to train shared or general-purpose models, and we do not authorize providers to use that content for their own general-model training. This does not mean every provider has zero retention: approved providers may retain limited information for service delivery, security, or legally required purposes under their applicable terms.

We minimize the information sent for each feature. Google calendar data is not used as AI training material or as conversational context. Meta-derived information remains subject to Meta's restrictions even when included in a customer-support workflow.

AI output can be inaccurate or incomplete. Merchants remain responsible for their published instructions, business decisions, customer notices, and appropriate human review. qzenchat is not intended to make decisions producing legal or similarly significant effects about individuals without appropriate human involvement and a separately reviewed lawful arrangement.

7. When information is disclosed

We disclose information only where needed for the purposes described in this policy:

Within the merchant's workspace: Authorized staff can access customer and business information according to their assigned access. Workspace administrators control membership.
Infrastructure and service providers: Providers may host applications and databases, store files, deliver transactional email, support security and diagnostics, or perform approved AI and integration processing under appropriate contractual restrictions.
Messaging and calendar platforms: Information is exchanged to deliver messages and operate connections you authorize.
Couriers: Necessary recipient and order information, including name, phone number, address, and delivery instructions, is shared when a merchant arranges fulfillment.
Payment providers, when enabled: Necessary billing and transaction information is shared to process authorized payments.
Professional advisers and authorities: Limited information may be disclosed for legal, accounting, security, or regulatory purposes, or in response to a valid legal requirement.
Business transfers: Information may be involved in a merger, acquisition, or asset transfer, subject to lawful safeguards, notice, and any consent required by applicable provider policies or law. Google Limited Use restrictions are not overridden by this paragraph.
At your direction: We may disclose information with valid authorization for a stated purpose.

Messaging connections may use native Meta APIs or an approved intermediary such as Zernio or SocialAPI.ai, depending on the connection made available to the workspace. An intermediary may process account-connection information and message data as needed to provide that connection; it is not merely a link to a third-party website. Courier integrations may include Pathao or Steadfast where enabled and selected for fulfillment.

Not every technically supported provider is an active recipient. We maintain an approved provider inventory and can provide information about active recipients through privacy@qzenchat.com. We do not publish or disclose credentials.

8. Hosting, international transfers, and Google Cloud

We may use Google Cloud infrastructure to host and operate qzenchat. Hosting on Google Cloud is distinct from connecting a Google account or using the Gemini API; these activities have different data flows and terms.

Information may be processed in the United States and other countries used by our approved infrastructure, messaging, email, calendar, AI, and fulfillment providers. We do not promise Bangladesh-only storage, a particular Google Cloud region, or that all providers process data in the same location.

Where applicable law requires a transfer mechanism or other safeguards, we use the appropriate contractual and legal measures before making the transfer. Acceptance of this policy alone is not a substitute for a legally required transfer safeguard.

Google Cloud's contractual treatment of customer data is described in its Cloud Data Processing Addendum. Google's Cloud Privacy Notice separately addresses Google's service data. These documents do not certify qzenchat's implementation or replace our responsibilities.

9. Cookies and similar technologies

The application uses cookies or similar storage needed for authentication, session continuity, security, and preferences. Blocking essential cookies may prevent sign-in or normal operation.

This policy does not authorize undisclosed advertising pixels, third-party tracking, session replay, or non-essential analytics. If such tools are introduced, we will identify their purposes and providers, update the relevant disclosures, and obtain consent before activation where required.

Our optional marketing emails include an unsubscribe method. Unsubscribing does not stop necessary account, security, transactional, or legal notices. To stop a merchant's marketing, contact that merchant or use its opt-out instructions; you can also contact us to help route the request.

10. Retention and deletion

We keep identifiable information only for a documented service, legal, security, or accountability purpose. The following default schedule applies unless a shorter legal or platform deadline, a valid deletion request, or an applicable documented legal exception requires different handling:

Information	Default retention or deletion approach
Active account and workspace records	While needed for the active relationship; reviewed when the account closes or a valid request is received
Messages, contacts, orders, appointments, and knowledge	While needed for the merchant's authorized service purpose; removed when that purpose ends or an applicable deletion request is approved
Primary-system data covered by an approved deletion	Target completion within 30 calendar days of receipt of the request; sooner where required
Disconnected integration credentials	Revoke or invalidate access promptly and remove stored credentials when no longer needed for an authorized connection
Ordinary diagnostic logs	Up to 90 days, unless a specific incident requires restricted preservation
Security and access-audit records	Up to 12 months, unless a documented incident, legal obligation, or claim requires longer
Minimal privacy-request records	Up to 24 months after closure to document the request and outcome, unless applicable law requires another period
Backup copies containing deleted data	Expire through rotation within 90 days after primary-system deletion, unless legally required preservation applies
Financial and legally required business records	For the period required by applicable accounting, tax, or other law, limited to the required fields

The 30-day target is not permission to delay Meta-required prompt deletion or to restart a statutory response clock during verification. We handle requests within the applicable legal and platform time limits and explain any permitted extension.

Backups are not used to continue ordinary processing of deleted information. If a backup is restored, deletion instructions must be reapplied before the restored data returns to ordinary service.

We may retain narrowly necessary information to comply with law, document a request, prevent fraud or unwanted recontact, or establish or defend legal claims, where permitted. We restrict it to that purpose and explain relevant exceptions. For Meta Platform Data, a general preference to keep records is not a legal-retention exception.

See the Data Deletion Policy for request methods, verification, affected systems, and limits.

11. Security and incidents

We use technical and organizational measures appropriate to the data and risks, including access controls, protected connections, credential protection, workspace access boundaries, and operational security procedures. Access to personal information is limited to authorized people with a legitimate need.

No system is completely secure. We do not claim that qzenchat is independently SOC 2 audited, ISO 27001 certified, HIPAA compliant, or certified by Meta or Google unless we separately provide current evidence of that specific claim.

If an incident affects personal information, we investigate, take appropriate containment and remediation steps, and notify affected merchants, people, regulators, and platform providers as required by applicable law and contract. Report suspected security issues to support@qzenchat.com; do not include passwords or live tokens.

12. Your choices and privacy rights

Depending on applicable law and our role, you may have rights to:

Obtain information about our processing and request access to your personal information.
Correct inaccurate information.
Request deletion, restriction, or a portable copy.
Object to certain processing or withdraw consent where consent is the applicable basis.
Opt out of optional marketing and, where applicable, prohibited sale or advertising-sharing activities.
Use an authorized representative, subject to proportionate verification.
Complain to a competent data protection authority or request review of our response.

Email privacy@qzenchat.com with the right you wish to exercise and enough information to locate the records. We accept requests in English or Bangla. You do not have to create an account, pay a routine request fee, or agree to marketing. We will not discriminate against you for exercising a privacy right.

We may verify your identity or authority using the least additional information reasonably needed. Do not send government ID unless we explain why it is necessary and provide a secure method. If we cannot fulfill all or part of a request, we will explain the reason and available review or complaint options, unless prohibited by law.

Our target is acknowledgment within five business days and a substantive response within 30 calendar days of receipt. Applicable law may require a different period or permit an extension; we will follow that rule and provide required notice. Verification does not automatically restart the deadline.

Where applicable law requires a lawful basis, we rely on the relevant basis for the particular processing: contract, legal obligation, consent where required, or legitimate interests subject to the applicable balancing and objection requirements. A merchant must establish its own basis for customer processing. We do not claim that every privacy regime applies to every user or that this policy alone establishes compliance.

13. Children and age restrictions

qzenchat business accounts are for people aged 18 or older who can enter a binding agreement. The service and AI-enabled customer experiences are not intended for children. Merchants must not direct an AI experience to minors or enable use that violates an AI provider's age restrictions.

If you believe a child has provided information through qzenchat, contact privacy@qzenchat.com. We will assess the situation, involve the responsible merchant where appropriate, and take required protective or deletion steps.

14. Changes and contact

We will update the effective date when this policy changes. Material changes will be communicated through an appropriate application or website notice, email, or another lawful method. Where a new use requires consent or renewed platform authorization, we will obtain it before that use; continued use is not a substitute for required consent.

Privacy, rights, and deletion: privacy@qzenchat.com
Support: support@qzenchat.com
Legal notices: legal@qzenchat.com

Related documents: Terms of Service, Data Deletion Policy, and Data Deletion Request Form.