1. Introduction
ZenFlowPro Ltd ("ZenFlowPro", "we", "us", or "our") is a provider of AI-powered chatbot solutions delivered as a software-as-a-service (SaaS) platform. Our services include intelligent virtual assistants, Microsoft 365 integrations, conversation analytics, and workflow automation tools for businesses.
This Privacy Policy explains how we collect, use, store, share, and protect personal data when you:
- Visit our website at zenflowpro.com
- Use our AI chatbot widget or standalone application
- Subscribe to or administer a ZenFlowPro service plan
- Interact with our platform via API or Microsoft 365 integrations
- Communicate with us by email or other means
We are committed to protecting your privacy and complying with the UK General Data Protection Regulation (UK GDPR), the Data Protection Act 2018, and — where applicable — the EU General Data Protection Regulation (EU GDPR).
Please read this policy carefully. By using our services, you acknowledge that you have read and understood it. If you have questions, please contact us at privacy@zfp.cz.
2. Data Controller
The data controller responsible for your personal data is:
- Company: ZenFlowPro Ltd
- Company Number: SC879068
- Registered in: Scotland
- Registered Office: 5 South Charlotte Street, Edinburgh, EH2 4AN
- Email: privacy@zfp.cz
Where we process personal data on behalf of our business clients (e.g., conversation logs generated by end users of a client's chatbot), the client acts as the data controller and ZenFlowPro acts as a data processor. In such cases, processing is governed by our Data Processing Agreement (DPA).
3. What Data We Collect
| Category | Data Elements | Source |
|---|---|---|
| Account Data | Company name, contact name, email address, billing address, VAT number, ICO number (Czech clients) | You (at sign-up) |
| Service Data | Conversation logs, chat messages, uploaded documents and files processed within the chatbot | You and your end users |
| Usage Data | Number of credits used, API call counts, feature usage metrics, timestamps of interactions | Automated collection |
| Technical Data | IP addresses, browser type and version, device type, operating system, screen resolution (widget context) | Automated collection |
| Payment Data | Transaction references, invoice records. Card numbers and payment credentials are processed directly by Stripe — we never store or have access to full card numbers. | Stripe |
| Microsoft 365 Data | Calendar events, email metadata and content, OneDrive/SharePoint files — only when you explicitly grant OAuth consent for each scope | Microsoft Graph API (with your consent) |
4. Why We Collect Data (Legal Bases)
Under UK GDPR and EU GDPR, we must have a lawful basis for each processing activity. The table below sets out our purposes and the corresponding legal bases:
| Purpose | Data Categories | Legal Basis |
|---|---|---|
| Providing and managing your account | Account Data, Service Data | Contract performance (Art. 6(1)(b)) |
| Delivering AI chatbot responses | Service Data (chat interactions) | Contract performance (Art. 6(1)(b)) |
| Billing and invoicing | Account Data, Payment Data | Contract performance (Art. 6(1)(b)) and Legal obligation (Art. 6(1)(c)) |
| Service improvement and analytics | Usage Data, Technical Data | Legitimate interest (Art. 6(1)(f)) — improving our platform |
| Technical support and troubleshooting | Technical Data, Service Data | Legitimate interest (Art. 6(1)(f)) — ensuring service reliability |
| Microsoft 365 integration | Microsoft 365 Data | Consent (Art. 6(1)(a)) — explicit OAuth consent |
| Marketing communications | Account Data (email) | Consent (Art. 6(1)(a)) — opt-in only |
| Security monitoring and fraud prevention | Technical Data | Legitimate interest (Art. 6(1)(f)) — protecting the service |
Where we rely on legitimate interest, we have conducted a balancing test to ensure our interests do not override your fundamental rights and freedoms. You may request details of these assessments at any time.
5. AI Processing Disclosure
Our service uses third-party artificial intelligence providers to deliver core functionality. When you interact with our chatbot, you are communicating with an AI-powered system, not a human. It is important that you understand how your data is processed by these systems.
5.1 Anthropic (Claude API) — AI Responses
Conversation messages you send through the chatbot are transmitted to Anthropic's Claude API to generate intelligent responses. Anthropic processes data as a sub-processor under our Data Processing Agreement. Your conversations are not used to train AI models. We do not send your name, email address, or other personally identifiable information to Anthropic unless you voluntarily include such information in your chat messages.
5.2 OpenAI (Whisper) — Audio Transcription
If you use voice input or upload audio files, these are sent to OpenAI's Whisper API for speech-to-text transcription. Audio data is processed in real time and is not retained by OpenAI beyond the duration of the API request. Audio data is not used to train OpenAI's models. OpenAI acts as a sub-processor under our DPA.
5.3 ElevenLabs — Text-to-Speech
Where text-to-speech functionality is enabled, text is sent to ElevenLabs for voice synthesis. ElevenLabs processes this data as a sub-processor under our DPA.
5.4 AI Transparency (EU AI Act)
In compliance with Article 50 of the EU AI Act (Regulation 2024/1689), we ensure that all individuals interacting with our AI chatbot are clearly informed that they are communicating with an artificial intelligence system. Our chatbot widget displays an "AI-powered" indicator. AI-generated content is intended to be identifiable as such and will be labelled in a machine-readable format in accordance with applicable transparency obligations as they come into effect.
7. Data Retention
We retain personal data only for as long as necessary to fulfil the purposes for which it was collected. Specific retention periods are:
| Data Category | Retention Period | Reason |
|---|---|---|
| Account Data | Duration of contract + 6 months | Account management and post-termination queries |
| Conversation Logs | Maximum 90 days (configurable per client) | Service delivery and quality assurance |
| Billing & Invoice Data | 10 years | Legal and tax requirements (UK Companies Act, HMRC) |
| Usage Analytics | 24 months (aggregated) | Service improvement and trend analysis |
| Technical Logs | 30 days | Security monitoring and debugging |
Business clients may configure shorter conversation log retention periods through their admin dashboard. When data reaches the end of its retention period, it is securely deleted or irreversibly anonymised.
9. Your Rights Under GDPR
Under the UK GDPR and EU GDPR, you have the following rights in relation to your personal data:
| Right | Description |
|---|---|
| Right of Access | You can request a copy of the personal data we hold about you (Subject Access Request). We will respond within one calendar month. |
| Right to Rectification | You can ask us to correct inaccurate or incomplete personal data. |
| Right to Erasure | You can request deletion of your personal data where there is no compelling reason for its continued processing ("right to be forgotten"). |
| Right to Restrict Processing | You can request that we limit how we use your data in certain circumstances (e.g., while we verify its accuracy). |
| Right to Data Portability | You can request your data in a structured, commonly used, machine-readable format (e.g., JSON or CSV). |
| Right to Object | You can object to processing based on legitimate interest or direct marketing at any time. |
| Right to Withdraw Consent | Where processing is based on consent (e.g., M365 integration, marketing), you can withdraw consent at any time without affecting the lawfulness of prior processing. |
| Right to Lodge a Complaint | You have the right to complain to a supervisory authority. In the UK, this is the Information Commissioner's Office (ICO) at ico.org.uk. EU residents may contact their local Data Protection Authority. |
To exercise any of these rights, please email privacy@zfp.cz. We will respond to all legitimate requests within one calendar month. In exceptional cases (complex or numerous requests), we may extend this by up to two additional months, and we will notify you if this applies.
We may need to verify your identity before processing your request. We will not charge a fee unless the request is manifestly unfounded or excessive.
10. Data Security
We take the security of your personal data seriously and implement appropriate technical and organisational measures, including:
- Encryption in transit: All data transmitted between your device and our servers is encrypted using TLS 1.2 or higher.
- Encryption at rest: Data stored on our servers is encrypted using AES-256 encryption provided by Microsoft Azure.
- Secrets management: API keys, credentials, and sensitive configuration are stored in Azure Key Vault, not in application code or environment files.
- Access controls: Access to personal data is restricted to authorised personnel on a need-to-know basis, using role-based access controls (RBAC).
- Audit logging: All administrative actions and data access events are logged for accountability and incident investigation.
- Regular security reviews: We conduct periodic reviews of our security posture, infrastructure configuration, and access policies.
While we strive to protect your data, no method of electronic transmission or storage is 100% secure. If you have reason to believe that your interaction with us is no longer secure, please contact us immediately at privacy@zfp.cz.
11. International Transfers
Some of our sub-processors are located outside the United Kingdom. The specific transfer mechanisms we rely on for each transfer route are set out below.
11.1 UK to Canada (Microsoft Azure)
Our primary hosting infrastructure is located in Microsoft Azure's Canada Central data centre. Canada benefits from a UK adequacy decision under the Personal Information Protection and Electronic Documents Act (PIPEDA) for private-sector commercial activities. Accordingly, transfers of personal data from the UK to Canada are permitted without additional safeguards, and this is our primary transfer mechanism for hosted data.
11.2 UK to United States (AI Providers, Stripe)
Personal data is transferred to the United States for processing by Anthropic (Claude API), OpenAI (Whisper API), Stripe (payment processing), and ElevenLabs (text-to-speech). For these transfers, we rely on the following mechanisms, in order of preference:
- UK-US Data Bridge — the UK extension of the EU-US Data Privacy Framework (DPF). Where a sub-processor is certified under the DPF and has self-certified for the UK Extension, this serves as our primary transfer mechanism.
- UK International Data Transfer Agreement (IDTA) or the UK Addendum to the EU Standard Contractual Clauses, as approved by the UK Information Commissioner under Section 119A of the Data Protection Act 2018 — used as a fallback or supplementary mechanism where a sub-processor is not certified under the DPF.
11.3 EU to UK
For our clients based in the European Union (including the Czech Republic), transfers of personal data from the EU to the UK are covered by the renewed EU adequacy decision adopted by the European Commission on 19 December 2025, which remains valid until 27 December 2031. No additional safeguards such as Standard Contractual Clauses are required for EU-to-UK transfers.
11.4 Transfer Risk Assessments
We conduct and maintain Transfer Risk Assessments (TRAs) for each sub-processor located in a country without an adequacy decision. These assessments evaluate the legal framework of the recipient country, the risk of government access to data, and the effectiveness of the supplementary measures we have in place.
11.5 Supplementary Measures
In addition to the contractual and legal safeguards described above, we implement the following supplementary technical measures for all international transfers:
- Encryption in transit (TLS 1.2+) and at rest (AES-256) for all personal data;
- Data minimisation: only the minimum personal data necessary for the specific processing purpose is transferred to each sub-processor;
- Contractual restrictions: sub-processors are contractually prohibited from accessing personal data for any purpose other than providing the contracted service;
- Zero-retention API configurations where available (e.g., AI API calls do not retain input data beyond the duration of the request).
You may request a copy of the relevant transfer safeguards, including our Transfer Risk Assessments, by contacting us at privacy@zfp.cz.
12. Automated Decision-Making
Under Article 22 of the UK GDPR (as amended by the Data Use and Access Act 2025) and Article 22 of the EU GDPR, individuals have rights relating to solely automated decision-making that produces legal effects or similarly significant effects.
ZenFlowPro's AI chatbot does not make solely automated decisions with legal or similarly significant effects on individuals. The chatbot provides informational responses, answers questions based on the Customer's knowledge base, and assists with routine tasks. It does not make decisions about individuals' legal rights, eligibility for services, credit, employment, or similar matters.
If a Customer configures the chatbot to assist with processes that may involve automated decision-making with significant effects (such as eligibility assessments, complaint triage with binding outcomes, or automated approvals), the Customer, as the Data Controller, is solely responsible for:
- Ensuring a lawful basis for such processing;
- Implementing appropriate safeguards, including the right to human review;
- Providing meaningful information about the logic involved to affected individuals;
- Conducting a Data Protection Impact Assessment (DPIA) where required.
ZenFlowPro will assist Customers in meeting these obligations through its technical capabilities (e.g., conversation logging, human escalation features) but does not assume the responsibilities of the Data Controller in such scenarios.
13. Aggregated and De-Identified Data
ZenFlowPro may create De-Identified Data by anonymising and aggregating information derived from the use of our services. "De-Identified Data" means data that has been modified so that it does not identify, and cannot reasonably be used to identify, any individual or any specific Customer.
13.1 How We Create De-Identified Data
We apply appropriate technical measures to ensure that De-Identified Data cannot reasonably be used to identify any individual, including:
- Removal of personal identifiers: All names, email addresses, phone numbers, IP addresses, and other personally identifiable information are stripped before aggregation;
- Minimum group sizes: Aggregated statistics are only produced where the underlying dataset contains a sufficient number of records to prevent identification;
- No re-identification: We will not attempt to re-identify any individual from De-Identified Data, and we contractually prohibit third parties from doing so.
13.2 How We Use De-Identified Data
We may use De-Identified Data for the following purposes:
- Improving and optimising our services and AI models;
- Generating aggregated analytics, benchmarks, and trend reports;
- Conducting research into customer service patterns and best practices;
- Publishing industry insights and benchmark reports that do not identify any individual or Customer.
13.3 Legal Basis
Under Recital 26 of the UK GDPR and EU GDPR, the principles of data protection do not apply to anonymous information — that is, information which does not relate to an identified or identifiable natural person, or to personal data rendered anonymous in such a manner that the data subject is not or no longer identifiable. De-Identified Data, as described in this section, constitutes anonymous information and is therefore outside the scope of data protection legislation.
13.4 Your Rights
Customers may opt out of having their data included in aggregated datasets by providing written notice to privacy@zfp.cz. Upon receipt of such notice, we will exclude the Customer's data from future aggregation within a reasonable timeframe (not exceeding 30 days).
14. Widget Data Collection
The ZenFlowPro chatbot widget is embedded on our Customers' websites and collects data from the Customer's website visitors (end users). This section explains the data collection that occurs through the widget.
14.1 What the Widget Collects
When an end user interacts with the chatbot widget, the following data may be collected:
- Chat messages: The content of messages sent by the end user and the AI-generated responses;
- Technical data: Browser type, device type, and screen dimensions (for widget rendering purposes only);
- Session data: A temporary session identifier to maintain conversation continuity within a single visit;
- Audio data: If the end user uses voice input, audio is captured and transmitted for transcription (not stored locally).
14.2 Pre-Chat Notice
ZenFlowPro provides a configurable pre-chat notice within the widget that informs end users that they are interacting with an AI-powered system and that their messages will be processed. This notice can be customised by the Customer to include a link to the Customer's own privacy policy.
14.3 Customer Responsibilities
The Customer (as Data Controller) is responsible for:
- Ensuring that their website's privacy policy adequately discloses the use of the ZenFlowPro chatbot and the data processing it entails;
- Obtaining any consents required under applicable law for the collection of end user data through the widget;
- Configuring the pre-chat notice and any consent mechanisms provided by ZenFlowPro to meet the requirements of the Customer's jurisdiction.
ZenFlowPro provides template privacy notice text and configurable consent mechanisms within the widget to assist Customers in meeting these obligations.
15. Children
Our services are designed for business use and are not intended for individuals under the age of 16. We do not knowingly collect or process personal data from children under 16.
If we become aware that we have inadvertently collected personal data from a child under 16, we will take prompt steps to delete that data. If you believe a child has provided us with personal data, please contact us at privacy@zfp.cz.
16. Changes to This Policy
We may update this Privacy Policy from time to time to reflect changes in our practices, technologies, legal requirements, or other factors.
When we make material changes, we will:
- Provide at least 30 days' prior notice before the changes take effect.
- Post the updated policy on this page with a revised "Last Updated" date.
- Notify account administrators by email where the changes materially affect their rights.
We encourage you to review this page periodically. The "Last Updated" date at the top of this page indicates when the policy was most recently revised.
17. Contact Us
If you have any questions, concerns, or requests regarding this Privacy Policy or our data practices, please contact us:
- Email: privacy@zfp.cz
- Company: ZenFlowPro Ltd
- Company Number: SC879068
- Registered in: Scotland
- Registered Office: 5 South Charlotte Street, Edinburgh, EH2 4AN
We aim to respond to all privacy-related enquiries within 5 business days.
Website: ico.org.uk
Helpline: 0303 123 1113