This policy explains what personal data Zellwo handles, why, and what your rights are. Zellwo is operated by SmartWay America, Inc., 131 Continental Dr, Suite 305, Newark, DE 19713, United States.
It has two parts, because Zellwo plays two roles:
- Part A covers data we decide about ourselves: visitors to zellwo.com, people who open or use a Zellwo workspace, and people we contact about Zellwo. Here we are the controller.
- Part B covers data that businesses using Zellwo ("merchants") collect about their own customers through Zellwo. Here the merchant is the controller and we are its processor.
Questions about this policy and requests about your data: [email protected]. If you are in the EU, the EEA, the UK or Switzerland, you may also write to [email protected]. Security issues: [email protected].
Part A. When Zellwo is the controller
A1. Who this part covers
- visitors to zellwo.com and its demo pages;
- people who create a workspace, and the staff members they invite;
- people who contact us through our own chat, by email or by booking a call;
- people at businesses we think could use Zellwo, whom we research and contact.
A2. What we collect
Account data. When you create a workspace: your name, email address, password (stored hashed), company name and website, the address and other company details you enter in settings, and the role and permissions you hold. If you sign in with Google or Microsoft, we use only the verified email address they give us.
Billing data. When billing starts: the billing contact, invoices and payment status. Card details will be handled by a payment provider, not stored by us; we will name the provider on the trust page before we use it.
Usage and logs. What you do in the dashboard, the API and the MCP server: the actions taken, when, by whom, from which IP address and browser. Server logs and error reports. Logs of AI calls and connector calls made by your workspace, with their cost.
Our own support and sales conversations. If you chat with us on zellwo.com, email us or book a call, we keep the conversation. Our own website runs Zellwo itself, so the chat collects what Part B describes for a merchant's site.
Prospect data. We look for businesses that could use Zellwo and research them from public sources: company websites, public registers, professional profiles and news. For a person at such a business we record their name, role, employer and business contact details, in their professional capacity only. We may then email them about Zellwo. Every such email carries an unsubscribe link.
A3. Cookies and similar storage on zellwo.com
zellwo.com uses no third-party analytics, advertising pixels or social plug-ins. It stores and reads the following:
- a session cookie that keeps you signed in to the dashboard;
- a cookie and a local-storage entry holding a random identifier for one year, so our chat recognises a returning browser and shows the earlier conversation;
- an identifier we derive on our server from connection details (your IP address and browser headers), used for the same purpose when the cookie is missing;
- advertising cookies and click identifiers that other platforms (such as Google, Meta, Microsoft, TikTok, LinkedIn, Pinterest, Reddit or Snap) may already have placed in your browser or appended to the address you arrived on. We read them to see which campaign brought you; we do not set them and we do not send anything back to those platforms;
- the pages you view on zellwo.com, the page you came from, your browser, device type and operating system, your time zone and your country, which we derive from your IP address using a database on our own servers.
You can delete these cookies in your browser at any time. The chat will then treat you as a new visitor.
A4. Why we use the data and on what legal basis
| Purpose | Data | Legal basis (where one is required) |
|---|---|---|
| Running your workspace and providing the service | Account, usage, billing | Performance of our contract with you |
| Security, abuse prevention, debugging | Usage and logs, connection details | Legitimate interest in keeping Zellwo safe and working |
| Answering you and keeping a record of our conversations | Support and sales conversations | Performance of a contract, or legitimate interest before one exists |
| Recognising a returning visitor to our chat; seeing which campaign brought a visitor | Identifiers and attribution data in A3 | Legitimate interest in a working chat and in measuring our marketing; consent where your law requires it for storage on your device |
| Contacting businesses about Zellwo | Prospect data | Legitimate interest in business-to-business marketing; you can object at any time |
| Invoicing, accounting, tax | Billing | Legal obligation |
| Telling you about changes to the service or these terms | Account email | Performance of a contract; legal obligation |
| Product news to account holders | Account email | Legitimate interest; every email has an unsubscribe link |
We do not sell personal data, we do not share it for cross-context behavioural advertising, and we do not make automated decisions about you that have legal or similarly significant effects.
A5. Who receives the data
- Our subprocessors: the hosting, email, SMS, AI and other providers listed with their roles and countries on the trust page. AI inference runs on OpenAI under a zero-retention agreement.
- Professional advisers: lawyers, accountants and auditors, under confidentiality.
- Authorities: where the law requires it or to protect our rights, after checking that the request is valid.
- A buyer of our business, if Zellwo is sold or merged, under this policy.
Our staff can access workspaces to provide support and investigate abuse; that access is logged.
A6. International transfers
Zellwo's application and database are hosted in Frankfurt, Germany. Some subprocessors are in the United States, and our own staff in the United States can access data for support and operations. For transfers out of the EU, the EEA, the UK and Switzerland we rely on the European Commission's Standard Contractual Clauses, on the UK Addendum to those clauses, and, where a provider is certified, on the EU-US Data Privacy Framework and its UK and Swiss extensions. You can ask for a copy of the clauses at [email protected].
A7. How long we keep it
| Data | Kept |
|---|---|
| Account data and workspace content | Until the workspace is closed; closing deletes it at once |
| Backups | Encrypted, kept 30 days; deleted data leaves backups within 30 days |
| Logs of AI calls and connector calls | 30 days |
| Server and access logs | 30 days |
| Support and sales conversations | While the relationship lasts and 24 months after our last exchange |
| Prospect data | Until you object, or 12 months after our last contact with you |
| Invoices and accounting records | As long as tax and accounting law requires |
A8. Your rights
Whatever law applies to you, you can write to [email protected] to ask what we hold about you, to correct it, to delete it, or to stop us contacting you. We answer within 30 days, or sooner where your law requires. We may ask you to confirm your identity. We never treat you worse for exercising a right.
EU, EEA, UK and Switzerland. Under the GDPR, the UK GDPR and Swiss law you may access, rectify, erase and receive a portable copy of your data, restrict or object to processing, including objecting at any time to direct marketing, and withdraw consent where processing rests on it. You may complain to a supervisory authority, in particular the one where you live or work. Our EU and UK privacy contact is [email protected].
United States. Where a state privacy law such as the California Consumer Privacy Act gives you rights, you may know what personal information we collect and why, access it, correct it, delete it, and receive a copy. We do not sell or share personal information and do not use it for targeted advertising, so there is nothing to opt out of; we also do not use sensitive personal information beyond what the service needs. You may appeal a decision on your request by replying to it, and an authorised agent may act for you with proof of authority.
Canada. Under PIPEDA and provincial laws you may access and correct your personal information and withdraw consent. You may complain to the Office of the Privacy Commissioner of Canada.
Brazil. Under the LGPD you may confirm processing, access, correct, anonymise, block or delete your data, request portability, know with whom it is shared and revoke consent. [email protected] is our contact for LGPD requests. You may complain to the ANPD.
Australia. Under the Privacy Act and the Australian Privacy Principles you may access and correct your personal information. Your data may be disclosed to recipients in Germany and the United States as described in A6. You may complain to us first and then to the OAIC.
A9. Children
Zellwo is a business service and is not directed at anyone under 16. We do not knowingly collect personal data from children. If you believe a child has given us data, write to [email protected] and we will delete it.
Part B. When Zellwo processes data for a merchant
This part is for you if you chatted, emailed or texted with a business that uses Zellwo, visited its website, or received a message from it through Zellwo. That business is the controller: it decides what is collected and why. We process the data on its instructions, under the Data Processing Addendum.
B1. What a merchant collects through Zellwo
Conversations. Your chat messages, emails and text messages to the merchant, the merchant's replies, attachments you send, and the name, email address and phone number you give. Email also brings technical headers; SMS brings your phone number.
Your visit to the merchant's site, when the merchant has placed the Zellwo chat widget on it: the pages you view, the page you came from, campaign and click identifiers in the address, advertising cookies already placed in your browser by other platforms (read for attribution, not set by us), your browser, device type, operating system and time zone, and your country derived from your IP address. The widget stores a random identifier in a cookie and in local storage for one year so the merchant's chat recognises your browser, and our server derives an identifier from connection details (IP address and browser headers) for the same purpose. The merchant is responsible for any consent banner its law requires for this storage and for loading the widget only after that consent.
Events the merchant sends. Merchants can send Zellwo facts from their own systems: orders, purchases, bookings, sign-ups, account status, and any other property they choose. Zellwo derives purchase statistics from them.
Email tracking. Emails the merchant sends through Zellwo contain a small image and tracked links, so the merchant can see whether a message was opened and which links were clicked.
AI processing. The merchant's AI agent reads conversations and may draft or send answers, look up orders in systems the merchant has connected, and summarise what is in an attachment. Inference runs on OpenAI under a zero-retention agreement; neither we nor OpenAI train models on it.
Web research. At the merchant's request, Zellwo looks up public information about a company and, for a person, about their professional role only, and writes a short profile for the merchant.
Marketing. The merchant may send you campaign emails, newsletters, follow-ups and text messages through Zellwo. Every campaign email has an unsubscribe link and every marketing text accepts STOP. We honour your opt-out for the merchant; it cannot override it.
B2. Your rights and whom to ask
Your rights, under whichever law applies to you, are the ones described in A8. Please send requests to the merchant, who controls your data and can delete your record and everything attached to it from its dashboard. If you write to us instead, we will tell the merchant and help it answer; we do not change or delete merchant data without its instruction unless the law requires us to.
B3. Where it is processed and how long it is kept
Merchant data is hosted in Frankfurt, Germany, with the transfers described in A6. The merchant decides how long to keep your data: until it deletes your record, purges records by age, or closes its workspace, which deletes everything at once. Backups are encrypted and kept 30 days. Logs of AI calls and connector calls are kept 30 days.
B4. Security
Data travels over TLS. Credentials the merchant connects (mailboxes, SMS accounts, API keys) are encrypted at rest. Each staff member of the merchant sees only what their permissions allow, and access by our own staff is logged. Report a vulnerability to [email protected]; we answer within two working days.
Changes to this policy
We may update this policy. The effective date at the top tells you when it last changed. For a material change we notify workspace owners by email or in the dashboard at least 30 days before it takes effect.
Contact
SmartWay America, Inc., 131 Continental Dr, Suite 305, Newark, DE 19713, United States. [email protected] for legal and privacy matters; [email protected] for people in the EU, the EEA, the UK and Switzerland; [email protected] for security reports.