We do not sell customer conversations or contact lists.
Security and WhatsApp data
Your conversations. Clear access.
Understand what Zenkoo stores, who can access it, and how your team stays in control. Connected conversations support your sales workspace. Customer replies go out only when a teammate presses Send.
What we access
Zenkoo uses data to operate your sales workspace, not to sell it.
When you connect a WhatsApp number, Zenkoo needs enough information to display conversations, organize leads, assign owners, schedule follow-ups, send the replies your reps press Send on inside the 24-hour window, and report on pipeline health.
WhatsApp conversations
To show the inbox, organize leads, and keep sales context visible to your team.
Contacts and conversation metadata
To identify leads, unread status, timestamps, pipeline stage, ownership, and follow-up state.
Sales notes, labels, stages, and follow-ups
To turn conversations into a working sales pipeline.
Replies you send
Sent only when a rep presses Send, inside the 24-hour customer window, through the official WhatsApp Business Platform. Zenkoo never sends automatic replies, broadcasts, or campaigns.
Account and login data
To create accounts, authenticate users, manage teams, and keep sessions secure.
Clear commitments
What we do not do with WhatsApp data
We do not use WhatsApp message content for advertising.
We do not expose media files publicly without authentication.
We do not ask for more access than the product needs to operate.
We do not send unsolicited or automated messages. A text reply goes out only when a rep presses Send, inside the 24-hour window, on the official API.
Security safeguards
How Zenkoo protects the website, app, and stored data
These are product and infrastructure safeguards in place today. We describe them plainly and avoid claiming certifications or guarantees that are not currently part of the product.
HTTPS and secure sessions
Zenkoo is served over HTTPS in production. Browser sessions use HttpOnly cookies, Secure cookies on HTTPS, SameSite protections, token rotation, expiry, and server-side revocation.
Restricted account access
Every protected request checks that the signed-in user can access the relevant WhatsApp account before conversations, files, or team data are returned.
Password and login protection
Passwords are hashed with bcrypt. Login, signup, password reset, email verification, team, admin, and upload endpoints are rate-limited to reduce abuse.
Safer file and media handling
WhatsApp media is served through authenticated routes, not public guessing URLs. Uploads are size-limited, extension-checked, stored under account-specific paths, and served with defensive headers.
Security headers and origin checks
The API uses security headers, a content security policy, a CORS allowlist, and server-side Origin/Referer checks for state-changing browser requests.
Limited retention controls
Zenkoo supports retention settings for message and media history. Media history downloads can be limited, and disconnected or deleted accounts can have associated stored data removed.
Transparency
No security system is magic.
Zenkoo uses reasonable technical and organizational safeguards, but no internet service can promise 100% security. If a customer has deeper requirements, we can review their data questions and document expected handling before onboarding.
GDPR readiness
Resources for EU and privacy-conscious customers
These documents help customers review data processing before connecting WhatsApp. They are practical operational resources, not a substitute for each customer’s own legal review.
Data Processing AddendumProcessor terms, security measures, transfers, deletion, and customer responsibilities.SubprocessorsInfrastructure, authentication, transactional email, and optional analytics services used to run Zenkoo.Privacy request workflowHow access, export, correction, deletion, and analytics consent requests are handled.
Customer FAQ
Answers for common WhatsApp data questions
Can Zenkoo read my WhatsApp chats?
Zenkoo processes the messages from WhatsApp numbers you connect so the product can show the inbox, organize leads, power follow-ups, and support team workflows. Access is limited to authorized users in your organization and operational support needs.
Does Zenkoo send messages from my number?
Only when a rep presses Send. Replies go out inside the 24-hour customer window through the official WhatsApp Business Platform via our provider, WazVox. There are no automatic replies, broadcasts, or campaigns. WhatsApp Business app availability depends on connection eligibility.
Is my data encrypted?
Data is encrypted in transit over HTTPS in production. Sensitive OAuth tokens are encrypted at rest when stored. We avoid claiming blanket at-rest encryption for every stored field unless your deployment is configured that way.
Who inside my company can see conversations?
Zenkoo is built around team visibility for company WhatsApp numbers. Owners and managers can see connected company accounts, while salespeople are scoped to the accounts assigned to them.
What happens if I disconnect WhatsApp or stop using Zenkoo?
You can disconnect a number or request deletion of stored account data. Retention settings also control how much message and media history Zenkoo keeps.
Is Zenkoo officially provided by WhatsApp or Meta?
No. Zenkoo is not a WhatsApp or Meta product. It connects the WhatsApp Business numbers you authorize through the official WhatsApp Business Platform via our provider, WazVox. Customers remain responsible for following WhatsApp, Meta, privacy, and consent rules.
Need to review data handling before onboarding?
Send us the questions your team or customer has. We will answer them directly before you connect WhatsApp.