Privacy Policy

Last updated: June 11, 2026

1. Who We Are

Zapelite is a B2B communication and workflow automation platform for the WhatsApp Business API, developed and operated by Elitestack Tecnologies LLC, a company registered in the United Arab Emirates. Zapelite connects the WhatsApp Business API, CRM systems, and internal business tools to help businesses manage customer interactions across industries including logistics, real estate, travel & hospitality, retail, automotive, food & beverage, healthcare, and education.

This policy also covers our Meta Platform application “zapchat” (App ID: 803096449433399), which is the technical integration through which Zapelite connects to the WhatsApp Business Platform, Facebook Pages, and Instagram messaging. zapchat is developed and operated by Elitestack Tecnologies LLC, and all data accessed through it is handled in accordance with this Privacy Policy and the Meta Platform Terms.

For the purposes of applicable data protection laws, Elitestack Tecnologies LLC acts as:

Role	Context
Data Controller	For data we collect directly from you when you visit our website, create an account, or contact us for support.
Data Processor	For data processed on behalf of our business clients (merchants) when they use Zapelite to communicate with their customers via WhatsApp, Facebook Pages, or Instagram.

2. Scope of This Policy

This Privacy Policy applies to all personal data collected through:

The Zapelite website (zapelite.io), the Zapelite platform and dashboard, WhatsApp Business API integrations operated through our platform, Facebook Page and Instagram messaging integrations operated through our Meta application (zapchat), our customer support channels, and any related services we provide.

This policy does not cover third-party websites or services linked from our platform. We recommend reviewing the privacy policies of any third-party services before providing them with personal data.

3. Personal Data We Collect

3.1 Data You Provide Directly

Category	Data	Purpose
Account Registration	Name, email, phone number, company name	Account creation and management
Billing Information	Company name, billing address, tax ID	Subscription management and invoicing
Support Requests	Name, email, description of issue	Responding to inquiries and technical support
WhatsApp Config	Business phone, WABA ID, Meta ID	Connecting your account to our platform
Page / Instagram Config	Facebook Page ID, Instagram professional account ID	Connecting your Page or Instagram account to our platform

3.2 Data Collected Automatically

Category	Data	Purpose
Usage Data	Pages visited, features used, actions	Service improvement and analytics
Device & Browser	IP address, browser type, OS, device	Security and platform optimization
Cookies	Session cookies, preference cookies	Maintaining session and preferences

3.3 Data Processed on Behalf of Our Clients (Service Data)

When businesses use Zapelite to communicate with their customers via WhatsApp, Facebook Pages, or Instagram, we process the following data on their behalf as a Data Processor:

Category	Data Included
Contact Information	End-user phone numbers, WhatsApp display names, Facebook/Instagram usernames and profile names
Message Content	Text messages, media files (images, documents, audio, video)
Interaction Metadata	Message timestamps, delivery status, read receipts
Consent Records	Opt-in and opt-out logs maintained on behalf of the business

4. How We Use Your Data

We process personal data only when we have a valid legal basis to do so.

Purpose	Legal Basis
Platform Maintenance	Performance of contract
Subscription Payments	Performance of contract
Service Communications	Performance of contract
Platform Improvement	Legitimate interest
Security & Anti-Fraud	Legitimate interest
Legal Compliance	Legal obligation

We do not use your personal data for automated decision-making or profiling that produces legal effects concerning you.

5. Payment Information

All credit and debit card details are processed directly by our third-party payment processor. Zapelite does not store, access, or retain full payment card numbers, CVV codes, or other sensitive cardholder data on our servers. We only receive transaction confirmation details necessary for billing and accounting purposes.

6. Data Sharing and Third Parties

We do not sell, rent, or trade your personal data. We may share your data only in limited circumstances:

Recipient	Purpose
Meta / WhatsApp	Message delivery via Business Cloud API. Messages are purged per Meta policy.
Cloud Infrastructure	Secure hosting and storage on industry-leading cloud servers.
Payment Processor	Secure subscription billing. No card numbers shared with us.
Authorities	Only as required by law or court order.

7. Meta Platform Data

Through our Meta Platform application (zapchat, App ID: 803096449433399), we may receive and process Platform Data from Meta, including:

• Facebook Pages: the list of Pages a connected user manages, Page metadata, Page conversation and message content, and Page engagement information (via permissions such as pages_show_list, pages_manage_metadata, pages_messaging, and pages_read_engagement).
• Instagram: basic professional account information and Instagram direct message conversations (via permissions such as instagram_basic and instagram_manage_messages).
• WhatsApp Business Platform: business account configuration and message data (via whatsapp_business_management and whatsapp_business_messaging).

We process Meta Platform Data solely to provide messaging and workflow automation services to the business that connected the relevant account. Specifically, we do not:

• sell, license, or rent Platform Data to any third party;
• use Platform Data for advertising, audience building, or any purpose unrelated to providing our service;
• use Platform Data to train artificial intelligence or machine learning models, except where a business has explicitly enabled an AI feature for its own customer conversations (see Section 9);
• transfer Platform Data to third parties except sub-processors necessary to deliver the service (e.g., cloud hosting), under contractual confidentiality and security obligations.

Platform Data is retained only while the connected business maintains an active Zapelite account and the relevant Meta asset (Page, Instagram account, or WhatsApp Business Account) remains connected. Disconnecting an asset, closing an account, or submitting a deletion request (see Section 13) results in deletion of the associated Platform Data within 30 days. We maintain administrative, technical, and physical safeguards consistent with the Meta Platform Terms and Developer Policies, and we will report any security incident involving Platform Data to Meta and affected businesses as required.

8. Google OAuth & API Integration

Where Zapelite integrates with Google services (such as Google Sheets), we request only the minimum permissions necessary. We adhere strictly to the Google API Services User Data Policy.

9. AI Features and Data Processing

Zapelite may offer optional AI-powered features. If enabled, your data is processed only after explicit opt-in. We do not use your message content — including any Meta Platform Data — to train external AI models.

10. Data Retention

Category	Retention Period
Account Data	Duration of account + 90 days
Message Content (incl. Meta Platform Data)	Deleted upon account closure, asset disconnection, or request
Billing Records	Up to 5 years (UAE Law)
Server Logs	Up to 12 months

11. Data Security

We implement industry-standard encryption (TLS/SSL), role-based access controls, and regular security assessments. While we take every precaution, no method of electronic storage is 100% secure.

12. International Data Transfers

Zapelite operates from the UAE. Your data may be processed in jurisdictions where our partners operate. We ensure appropriate safeguards, such as Standard Contractual Clauses, are in place.

13. Your Rights and Data Deletion

Depending on your location (GDPR, CCPA, UAE PDPL), you have rights to access, rectification, erasure, restriction of processing, data portability, and objection.

Data Deletion. Businesses and end users may request deletion of their personal data, including all Meta Platform Data, at any time by either:

• using our dedicated data deletion portal (see Data Deletion Instructions), or
• emailing privacy@zapelite.io with the subject line “Data Deletion Request.”

We will confirm receipt and complete deletion within 30 days. In addition, disconnecting your Facebook Page, Instagram account, or WhatsApp Business Account from Zapelite, or closing your Zapelite account, automatically triggers deletion of the associated data in line with Section 10.

14. Cookies and Tracking

We use Essential Cookies for platform stability and Preference Cookies for your settings. We do not use advertising tracking cookies.

15. Children’s Privacy

Zapelite is a B2B platform not directed at individuals under 18. We do not knowingly collect data from children.

16. Do Not Track Signals

Our platform does not respond to “Do Not Track” browser signals at this time, as no universal standard currently exists.

17. Changes to This Policy

We may update this policy periodically. Significant changes will be notified via email or dashboard alert 30 days prior to taking effect.

18. Contact Us