Privacy Statement

This Privacy Statement explains how Bkody Software ("Zinevu", "we", "our" or "us"), registered with the Dutch Chamber of Commerce under KVK number 71881832, collects, uses, shares and protects personal data when you use our website at zinevu.com and our SaaS platform (together the "Services"). We act as data controller for personal data processed under this statement.

If you have questions, contact us at [email protected].

1. Personal data we collect

We collect personal data in the following categories:

Data you provide directly

• Account data — name, email address, phone number, company name and password when you register for or use the Zinevu platform.
• Contact and enquiry data — any information you submit via our contact forms, support requests or email correspondence.
• Billing data — company name, billing address and VAT number. Payment card details are processed directly by our payment processor (Stripe) and are never stored by us.
• Content data — product catalogues, pricing rules, customer records and other data you upload or create within the platform.

Data collected automatically

• Usage data — pages visited, features used, session duration, clicks and interactions within the platform.
• Device and technical data — IP address, browser type, operating system, screen resolution and referring URL.
• Cookie data — see our Cookie Policy for full details.

Data about your customers (processor role)

When you use Zinevu to manage your own customers' data (leads, signed quotes, contact details), you act as data controller and we act as data processor. Our Data Processing Agreement governs this processing.

2. Legal basis for processing

3. Google Analytics

We use Google Analytics 4 to understand how visitors use our website. Google Analytics collects data such as pages viewed, session duration and approximate geographic location via anonymised IP addresses. This data is processed by Google LLC on servers in the United States under the EU–US Data Privacy Framework.

Google Analytics 4 anonymises IP addresses by default. We do not use Google Analytics to build individual user profiles or serve personalised advertising. You can opt out of Google Analytics tracking by installing the Google Analytics Opt-out Browser Add-on or by adjusting your cookie preferences via our cookie banner.

4. WhatsApp Business (Meta)

Zinevu lets a business that uses our platform (a "dealer") connect its own WhatsApp Business account, so it can receive and answer its customers' WhatsApp messages alongside the rest of a lead. The connection runs through Meta's official WhatsApp Business Platform (Cloud API). This section explains what we receive from Meta, what we do with it and how it is removed. It applies only to dealers who choose to connect WhatsApp.

How the connection works

The dealer connects through Meta's own sign-up window (Embedded Signup) and grants Zinevu two permissions: whatsapp_business_management and whatsapp_business_messaging. The WhatsApp Business account, the phone number and the contract with Meta remain the dealer's own; Meta bills the dealer directly for messaging. We never receive the dealer's Facebook password, and we do not request or read their Facebook profile, friends, Pages, ad accounts or any other Meta data beyond the WhatsApp Business account they select.

Data we receive from Meta

• Account details — the WhatsApp Business account ID, business ID and phone number ID, the display phone number, the verified business name, the quality rating, the messaging limit and the approval status of message templates.
• Access credentials — the access token Meta issues for the connection. It is stored encrypted, is never shown in our interface or API responses, and is used only to call the WhatsApp Business Platform on the dealer's behalf.
• Messages from the dealer's customers — the sender's WhatsApp phone number and profile name, the message content (text, and any photos, documents, audio, video, locations, contacts, reactions or button replies the customer sends) and, where the conversation started from a Click-to-WhatsApp advert, the advert reference Meta attaches.
• Delivery information — whether a message the dealer sent was delivered, read or failed.

How we use it

Solely to provide the WhatsApp feature to the dealer: to show incoming messages on the matching lead (or in the inbox when no lead matches), to send the messages and approved templates the dealer writes, and to show their delivery status. We send messages only on the dealer's instruction. We do not sell this data, do not use it for advertising or profiling, and do not use message content to train artificial-intelligence models.

Roles

For the content of these conversations the dealer is the data controller and Zinevu processes it as the dealer's processor under our Data Processing Agreement. Meta processes WhatsApp messages under the WhatsApp Business terms the dealer accepts with Meta; because the dealer contracts with Meta directly, Meta is not a sub-processor of Zinevu. The dealer is responsible for having a lawful basis, and the opt-in that the WhatsApp Business Policy requires, before messaging its customers. Meta may process data outside the European Economic Area; see Meta's terms linked below.

Retention and deletion

• A dealer can disconnect WhatsApp at any time in the portal settings under WhatsApp. Disconnecting ends our subscription to the number and permanently deletes the stored access token and account details straight away; no further messages reach Zinevu after that. The dealer can also revoke Zinevu's access from its business settings at Meta.
• Messages already received stay part of the dealer's customer records for as long as the account exists. After the subscription ends they are, at the dealer's choice, made available for export or deleted within 30 days, as set out in clause 11 of our Data Processing Agreement.
• To request deletion of data we received through the WhatsApp integration, email [email protected]. If you are a customer who messaged a dealer on WhatsApp, you can also contact that dealer directly as the controller of your conversation; we will help the dealer handle your request within 30 days.

Our use of data received from Meta complies with the Meta Platform Terms. Meta's own processing is described in the WhatsApp Business Terms of Service and the WhatsApp Business Policy.

5. Facebook and Instagram lead ads (Meta)

A dealer can connect its own Facebook Pages to Zinevu, so that the enquiries people leave in the dealer's lead forms on Facebook and Instagram arrive as leads in the platform. This section explains what we receive from Meta for that, what we do with it and how it is removed. It applies only to dealers who connect a Page.

How the connection works

The dealer connects in the portal settings with “Connect with Facebook”: in a window run by Meta, the dealer signs in to Facebook and chooses which Pages to share with Zinevu. Meta then grants Zinevu's app the permissions leads_retrieval, pages_show_list, pages_read_engagement, pages_manage_metadata and pages_manage_ads (and business_management for Pages owned by a business portfolio); Meta requires these to read a Page's leads. Meta also lists ads_management and ads_read as prerequisites for leads_retrieval; if Meta grants them to our app, Zinevu does not use them to read, create or change adverts, ad accounts or advertising results. Our server reads back from Meta which Pages were shared, stores a Page access token for each Page encrypted, never shows it in our interface or API responses, and subscribes each Page to our app's lead notifications. Dealers who connected earlier by entering a Page access token with the leads_retrieval permission – issued for Zinevu's Meta app or for a Meta app of their own, in which case they also entered that app's ID and secret – keep that connection; that token and app secret are stored encrypted in the same way. We ask Meta which permissions a token carries and when it expires, so the dealer can see whether the connection works. The access is used only to read the Page's lead forms and the leads submitted through them, and to switch the lead notifications on and off: we do not publish on the Page, read its posts, messages or followers, or manage its adverts.

Data we receive from Meta

• Form answers — whatever the dealer's lead form asks, typically name, email address, phone number, postcode or address, and answers about the product the person is interested in.
• References — the ID and submission time of the lead, the form it was submitted through, and the advert, ad set and campaign it came from.
• Page and form details — the Page's ID and name and the names of its lead forms, so the dealer can check the connection and set up the import.

How we use it

New leads reach us as a notification from Meta whose signature we verify before reading it, and by periodically asking Meta for leads we have not received yet. We store each lead with the answers as Meta sent them, link it to an existing customer of the same dealer when the email address matches, and turn it into a lead the dealer can review, price and follow up in the platform. We use this data only to provide that service to the dealer. We do not sell it, do not use it for advertising or profiling, do not send it back to Meta, and do not use it to train artificial-intelligence models.

Roles

For these leads the dealer is the data controller and Zinevu processes them as the dealer's processor under our Data Processing Agreement. Meta collects the form answers under its own terms and the Meta Privacy Policy. Meta also requires every lead form to link to the advertiser's own privacy policy; the dealer is responsible for that notice and for the lawful basis of its own follow-up.

Retention and deletion

• A dealer can disconnect a Page at any time in the portal settings. We then unsubscribe the Page from our app's lead notifications and delete the stored Page access token; no further lead data is retrieved from that Page. A connection made with an entered token is ended by removing the token (and, if used, its own app's credentials), which deletes the stored values in the same way. The dealer can also remove Zinevu's access in its Facebook or business settings at Meta, which ends our access as well.
• Leads already received stay part of the dealer's customer records for as long as the account exists. After the subscription ends they are, at the dealer's choice, made available for export or deleted within 30 days, as set out in clause 11 of the Data Processing Agreement.
• To request deletion of data received through a lead form, email [email protected]. If you filled in a dealer's lead form, you can also contact that dealer directly as the controller of your data; we will help the dealer handle your request within 30 days.

Our use of data received from Meta complies with the Meta Platform Terms.

6. AI assistant (OpenAI)

Dealers can switch on an AI assistant in the platform that answers on their behalf in the chat on their website and over WhatsApp. The assistant asks the questions from that dealer own request form, with the options that dealer has enabled, and records the conversation as a request. The feature ships switched off; the dealer turns it on themselves.

The assistant says what it is. Every conversation opens with a line stating that you are speaking to a digital assistant. That cannot be switched off and follows from Article 50 of the EU Artificial Intelligence Act. You can ask for a person at any point; the assistant then fetches one and says nothing further in that conversation.

What is sent to OpenAI. To compose a reply we send OpenAI, per turn: the messages in that one conversation, including any personal data you type into it (such as name, e-mail address, telephone number, address and the answers to the questions), the company information the dealer has put in their own library for this purpose (such as price lists and lead times), and the questions and options of that dealer form. Other requests, other customers and the database itself are never sent.

What OpenAI does with it. OpenAI acts as a sub-processor. The data is processed through OpenAI business API and is not used to train models. OpenAI retains inputs and outputs for at most 30 days for abuse monitoring and deletes them afterwards. Processing takes place on servers in the United States, under the European Commission Standard Contractual Clauses. See the OpenAI privacy policy.

No automated decision-making. The assistant makes no decision with legal effect or similarly significant effect within the meaning of Article 22 GDPR. It answers questions and records a request; what happens to that request afterwards — a quotation, an appointment, a price — is the dealer decision.

The conversation itself stays in the platform and falls under the retention periods in section 8. The dealer is the controller for this data; we act as processor under the data processing agreement with that dealer.

7. How we share personal data

We do not sell personal data. We share data only with the following categories of recipients and only to the extent necessary:

• Hosting and infrastructure — Hetzner Online GmbH (servers and databases, in data centres in the European Union) and Cloudflare, Inc. (content delivery and protection against attacks).
• Email delivery — Resend (Plus Five Five, Inc.), which sends email from our platform, including offers and notifications for dealers that do not use their own mail server. Email is sent from the European Union (Ireland); Resend also processes data in the United States, under standard contractual clauses and the EU–US Data Privacy Framework.
• Analytics — Google LLC (Google Analytics 4), under standard contractual clauses and the EU–US Data Privacy Framework.
• Payment processing — Stripe Inc., which acts as an independent data controller for payment card data.
• Messaging — Meta (WhatsApp Business Platform), only when a dealer connects its own WhatsApp Business account; messages the dealer sends are delivered through Meta. See section 4.
• Customer support — support tooling used by our team to respond to tickets.
• Legal and regulatory — where we are required to disclose data by law, court order or competent authority.

Where we transfer personal data outside the EEA, we rely on adequacy decisions, standard contractual clauses or other appropriate safeguards under GDPR Chapter V.

Requests from public authorities (government and law enforcement)

If a public authority asks us for personal data, we check that the request has a valid legal basis, challenge requests we consider unlawful, disclose only the minimum data necessary and keep a record of each request, our response and the legal reasoning. Where we process the data on behalf of a dealer, we inform that dealer, unless the law prohibits it.

8. Data retention

• Account data — retained for the duration of your subscription plus 30 days after termination, then deleted or anonymised.
• Billing and invoice records — retained for 7 years to comply with Dutch tax law.
• Support correspondence — retained for 2 years after the ticket is closed.
• Analytics data — retained for 14 months in Google Analytics, then automatically deleted.
• WhatsApp messages and attachments — kept as part of the dealer's customer records for as long as the account exists; after termination, made available for export or deleted within 30 days at the dealer's choice (clause 11 of the Data Processing Agreement). The access token is deleted immediately when the dealer disconnects WhatsApp.
• Leads from Facebook and Instagram lead ads — kept as part of the dealer's customer records for as long as the account exists; after termination, made available for export or deleted within 30 days at the dealer's choice (clause 11 of the Data Processing Agreement). The Page access token and app secret are deleted as soon as the dealer removes them.
• Cookie consent records — retained for 1 year.

9. Your rights under GDPR

If you are in the European Economic Area, you have the following rights regarding your personal data:

• Right of access — obtain a copy of the personal data we hold about you.
• Right to rectification — correct inaccurate or incomplete data.
• Right to erasure — request deletion of your data where there is no overriding legal basis for retention.
• Right to restriction — limit how we process your data in certain circumstances.
• Right to data portability — receive your data in a structured, machine-readable format.
• Right to object — object to processing based on legitimate interests, including direct marketing.
• Right to withdraw consent — where processing is based on consent, you may withdraw it at any time without affecting the lawfulness of prior processing.

To exercise any of these rights, email [email protected]. We will respond within 30 days. You also have the right to lodge a complaint with the Dutch Data Protection Authority (Autoriteit Persoonsgegevens) at autoriteitpersoonsgegevens.nl.

10. Security

We implement appropriate technical and organisational measures to protect personal data against unauthorised access, disclosure, alteration or destruction. These include encryption of data in transit (TLS 1.2+) and at rest, access controls, and regular security assessments. See our Security page for more detail.

11. Children

The Services are directed at businesses and are not intended for use by individuals under the age of 16. We do not knowingly collect personal data from children.

12. Changes to this statement

We may update this Privacy Statement from time to time. We will notify registered users by email and update the "Last updated" date above. Continued use of the Services after the effective date constitutes acceptance of the revised statement.

13. Contact

Bkody Software (trading as Zinevu)
KVK: 71881832
Email: [email protected]
Phone: +31 85 401 31 68