Where your data lives
For business owners, IT and data-protection officers · last updated September 2026
The Zaags Assistant touches four systems you own (your CRM (Salesforce, HubSpot or WooCommerce), WhatsApp, your mailbox, your website) and adds one you control: a storage place for the conversations. This page lists every piece of data, which system holds it, for how long, and how you remove it. Colour code: You = held in an account you own · Zaags = held on Zaags servers · Provider = held by your CRM, Meta or Google under their own terms.
1The journey of one message
1 · Customer writeson WhatsApp, by email, or in the website widgetProvider
2 · Delivered to ZaagsMeta's API, your mailbox, or the widget hands the message to Zaags over an encrypted connectionZaags
3 · Who is this?Zaags looks the sender up in your CRM, live, nothing copiedYou
4 · Answer composedMessage + matching Knowledge articles are sent to the AI model to write the replyZaags
5 · Reply sentback through WhatsApp / your mailbox / the widgetProvider
6 · Archivedthe closed conversation is written to your Drive or Supabase (and to your CRM if a human was involved); Zaags' working copy is deleted after 7 daysYou
2The complete data map
| Data | Held by | Where exactly | How long | How you remove it |
|---|---|---|---|---|
| Your passwords (your CRM or store, Facebook/Meta, Google) | Nobody at Zaags | You sign in on the provider's own page; Zaags only ever receives a token | , | , |
| Salesforce app key & secret, access tokens | Zaags | Encrypted vault on Zaags servers (key kept outside the database); never logged, never shown to the browser | Until you disconnect or revoke | Zaags → Disconnect · or Salesforce Setup → Connected Apps OAuth Usage → Revoke · or deactivate the integration user |
| HubSpot access token (OAuth or private-app token) | Zaags | Encrypted vault on Zaags servers; never logged, never shown to the browser | Until you disconnect or revoke | Zaags → Disconnect · or HubSpot → Settings → Integrations → Connected apps (or delete the private app) |
| WooCommerce REST API key & secret (Read only) | Zaags | Encrypted vault on Zaags servers; never logged, never shown to the browser | Until you disconnect or revoke | Zaags → Disconnect · or WooCommerce → Settings → Advanced → REST API → Revoke |
| WhatsApp business token, number ids | Zaags | Same encrypted vault | Until you disconnect or revoke | Zaags → Disconnect · or Meta Business Settings → WhatsApp accounts → remove Zaags |
| Mailbox app password, server settings | Zaags | Same encrypted vault | Until you disconnect | Zaags → Disconnect · or delete the app password at your provider |
| Telegram / Slack | No credential | Telegram: a link to a chat with Zaags' own bot. Slack/Teams: a webhook address you pasted | Until unlinked | Unlink in Zaags; delete the webhook in Slack/Teams |
| Google Drive / Supabase connection (your archive) | Zaags | Token / service key in the encrypted vault; the files and rows are in your account | Until you disconnect | Google Account → Security → third-party access · or rotate the Supabase key |
| Messages of an open conversation (text, media, who said what) | Zaags | Working database on Zaags servers, needed to answer at 3 a.m. and to keep threads straight | While open, then 7 days after close (90 days if you connected no archive) | Automatic deletion; or Zaags → Conversations → Delete (also removes the archive copy Zaags wrote) |
| Conversation archive | You | Your Google Drive (Zaags Assistant/, one file per closed conversation) or your Supabase project (one row per message) | As long as you keep it | Delete the file / rows, it is your storage |
| Escalated conversations (a human was needed) | You | Your CRM: in Salesforce the Case Zaags opened (transcript + later messages as Case Comments); in HubSpot a ticket with notes. With WooCommerce (read-only) nothing is written to your store, the conversation stays in your Zaags archive | Per your CRM's retention · WooCommerce: as the archive | In your CRM, as any case/ticket · WooCommerce: delete the conversation in Zaags |
| Alert packets (conversation + CRM snapshot + drafted reply) | You | Delivered into your own email, Telegram, Slack/Teams; the reply-page copy lives with the open conversation on Zaags | Your inbox: yours · Zaags: 7 days after close | Delete the message in your inbox; Zaags copy expires |
| Your CRM records (contacts, cases/tickets/orders, deals/opportunities…) | You | Read live from your CRM for each answer or alert, never copied to a Zaags database | Not stored beyond the alert packet | , |
| Knowledge articles (published only) | Zaags | Text cache so answers are fast | Refreshed daily; deleted when you disconnect | Disconnect your CRM (Knowledge sync is a Salesforce feature) |
| Log of what Zaags wrote to your CRM (Salesforce: Case / Comment / Lead / Task · HubSpot: ticket / note / contact / task · WooCommerce: nothing, read-only; each with the payload and the CRM's answer) | Zaags | Audit table, visible to you in the Activity tab, exportable | 13 months | Kept as your audit trail; export any time |
| Usage counters (conversations per period, alerts sent) | Zaags | Billing meters, numbers only, no message content | Account lifetime + legal retention of invoices | Close the account (invoices are retained as the law requires) |
| Your Zaags account (name, email, picture, invoices) | Zaags | Account database | Account lifetime + legal retention of invoices | Close the account |
| Messages in transit at Meta / Google / your mail host | Provider | WhatsApp Cloud API, Gmail/IMAP servers, your CRM or store (Salesforce, HubSpot, WooCommerce), under their own terms and your contracts with them | Per provider | Per provider |
3The AI step, specifically
- To write a reply, Zaags sends the customer's message, the relevant part of the conversation and the matching Knowledge passages to an AI model through Zaags' own gateway. Customer records fetched from your CRM or store are included only as far as needed for that answer (for example the status of the customer's own case, ticket or order).
- The text is processed by the model providers behind our gateway only to generate the reply. We select providers whose business API terms state that customer content is not used to train their models, and we keep the current list in our Privacy Policy; Zaags itself never trains anything on your data. Clients who need the text to stay entirely on Zaags-controlled infrastructure can ask for the assistant to run on our Full Privacy model instead (additional fees apply, upon request).
- The first reply of every conversation states that it comes from an AI assistant of your business, as EU law requires.
4What Zaags never does
- Copies your CRM or store database, or keeps customer records after the answer or alert that needed them.
- Reads any mailbox, WhatsApp number or CRM record type other than the ones you connected and allowed.
- Updates or deletes anything in your CRM, at most it creates a case, a comment, a lead and a task (on Salesforce: Case / Case Comment / Lead / Task; on HubSpot: ticket / note / contact / task; on WooCommerce it writes nothing, it is read-only), and only when you enabled each.
- Starts WhatsApp conversations, sends marketing, or shares data between Zaags customers.
- Uses your data for advertising, profiling or training.
5Roles, agreements, requests
- Controller / processor. You are the controller of your customers' data; Zaags (RUDLU Unipessoal Lda, Lisbon, Portugal) is your processor and acts only on your configuration. Our Privacy Policy and Terms include the processing terms; a signed data-processing agreement is available on request.
- Sub-processors: our hosting provider, the AI model providers behind the gateway, and only because you connected them, your CRM or store (Salesforce, HubSpot or WooCommerce), Meta (WhatsApp), Google, Supabase, Telegram, Slack/Microsoft. The current list is in the Privacy Policy.
- A customer asks you to delete their data. Zaags → Conversations → search their number or email → Delete: removes the working copy and the archive entries Zaags wrote; you delete the CRM case or ticket (none exists with WooCommerce) and any alert emails yourself, as with any customer request.
- Export. Your archive is already in your own Drive/Supabase; the write log exports as CSV from the Activity tab.
Questions for our DPO? contact [at] zaags.app.