Privacy Policy

01Who we are

Zerda Engage is operated by Zerda Digital ("Zerda", "we", "us", or "our"), a digital marketing agency headquartered in Montréal, Canada. Zerda is responsible for the personal information handled through this service as described below.

02Scope & our role

Zerda Engage is a customer-engagement and messaging platform built on the WhatsApp Business Platform (WhatsApp Cloud API). It lets businesses communicate with their customers over WhatsApp — including notifications, support conversations, and automated replies.

Our role under privacy law depends on whose data we handle:

• For our business customers' platform accounts (the companies that use Zerda Engage), we act as the controller of their account and usage data.
• For end users who message a business through Zerda Engage, we generally act as a processor (service provider) on behalf of that business, which is the controller of the conversation. Where you have questions about how a specific business uses your messages, please contact that business directly.

This policy also covers visitors to zerda.digital.

03Information we collect

From people who message a business through Zerda Engage

• WhatsApp phone number and WhatsApp profile name.
• Message content you send or receive, including text, images, documents, audio, and other media.
• Message metadata, such as timestamps and delivery, read, and failure statuses.
• Opt-in and consent records showing that you agreed to receive messages from a business.

From businesses that use the platform

• Account details — name, work email, company name, and phone number of authorized users.
• Billing information needed to manage your subscription, where applicable.
• Authentication and configuration data, including access tokens used to connect your WhatsApp Business Account.
• Usage data — how you interact with the platform, features used, and activity logs.

Collected automatically

• Technical and log data, such as IP address, browser type, device information, and pages viewed.
• Cookies and similar technologies on our website, used to keep you signed in and to understand site usage.

04How we use information

We use personal information to:

• Deliver, operate, and maintain the messaging service between businesses and their customers.
• Route, send, and display WhatsApp conversations, including automated and template messages.
• Authenticate users and secure accounts.
• Provide support, troubleshoot issues, and improve the platform.
• Process billing and manage subscriptions.
• Detect, prevent, and address fraud, abuse, and security incidents.
• Comply with legal obligations and enforce our terms.

Where the GDPR applies, our legal bases are: performance of a contract; your consent (for example, opting in to receive messages); our legitimate interests in operating and securing the service; and compliance with legal obligations. Under Canadian and Québec law, we rely on your consent and the other grounds permitted by applicable legislation.

05WhatsApp & Meta

Zerda Engage operates through the WhatsApp Business Platform provided by Meta Platforms, Inc. When you exchange messages, that content is also processed by WhatsApp and Meta in line with their own terms and privacy policy. We do not control how Meta processes data on its own platform.

We require businesses using Zerda Engage to obtain a valid opt-in before messaging customers and to comply with the WhatsApp Business Messaging Policy and Meta's commerce and platform policies. We do not use WhatsApp message content for advertising, and we do not sell it.

06How we share information

We share personal information only as needed to run the service:

• With Meta / WhatsApp, to transmit and deliver your messages.
• With the business you are messaging, when you contact a company that uses Zerda Engage.
• With service providers (sub-processors) who host our infrastructure, store data, or provide supporting tools, under contracts that require them to protect your information.
• For legal reasons, where required by law, regulation, legal process, or to protect rights, safety, and security.
• In a business transfer, such as a merger or acquisition, subject to this policy.

We do not sell your personal information.

07International transfers

Zerda operates between Canada and Tunisia and serves clients in North America, Europe, the Middle East, and the Gulf. Your information may be processed in countries other than your own, including by Meta and our service providers. Where personal data is transferred across borders, we take steps required by applicable law to protect it, such as contractual safeguards and standard contractual clauses where relevant.

08Data retention

We keep personal information only as long as needed for the purposes described in this policy, to provide the service to our business customers, and to meet legal, accounting, or reporting requirements. Conversation data is retained according to the instructions of the business you contacted. When information is no longer needed, we delete or anonymize it. You can ask us to delete your data as described in Section 11.

09Security

We use technical and organizational measures designed to protect personal information against loss, misuse, and unauthorized access — including access controls, encryption in transit, and restricted handling of authentication tokens. No method of transmission or storage is completely secure, but we work to safeguard your information and to address incidents promptly.

10Your privacy rights

Depending on where you live, you have rights over your personal information. Under Québec's Law 25, Canada's PIPEDA, and the EU/UK GDPR, these may include:

To exercise any right, email privacy@zerda.digital. We will respond within the timeframes required by law. You also have the right to complain to a regulator — in Québec, the Commission d'accès à l'information (CAI); in Canada, the Office of the Privacy Commissioner (OPC); or your local data protection authority in the EU/UK.

11Deleting your data

You can request deletion of your personal information at any time. Full instructions, including what we delete and how long it takes, are on our dedicated page:

12Children

Zerda Engage is a business service and is not directed to children. We do not knowingly collect personal information from children under the age of 16. If you believe a child has provided us with personal information, contact us and we will take appropriate steps to delete it.

13Changes to this policy

We may update this policy from time to time. When we do, we will revise the "Last updated" date above and, where appropriate, provide additional notice. Your continued use of Zerda Engage after an update means you accept the revised policy.

14Contact us

For any question about this policy or your personal information, reach our privacy contact: