Privacy Policy

Zentra is the trade name of Jhonatan David Ortega Castro, an individual holding Colombian citizenship ID 1.005.946.087, domiciled in Candelaria, Valle del Cauca, Colombia. Zentra is the controller of the data of the companies and people who use the Zeni platform (zeni.webzentra.com): the account owner, its users and its billing details.

Privacy and Security Officer: Jhonatan Ortega, [email protected].

When a business connects its channels (WhatsApp, Instagram, Messenger or web chat), the messages of its customers go through Zeni. For that data the business is the controller and Zentra acts as processor (Colombian Law 1581 of 2012, articles 3 and 25): we process it only to provide the service the business contracted, following its instructions.

If you wrote to a business that uses Zeni and want to access, correct or delete your data, you can ask the business or ask us at zeni.webzentra.com/arco. If the request reaches us, we pass it to the business and help it answer.

Sensitive data. Some businesses, such as clinics, receive health data or other sensitive data by chat (Law 1581, articles 5 and 6). The business must obtain each person’s explicit consent before processing it. If the business turns on the AI assistant, that content reaches the AI provider unmasked (section 7).

• Identification and contact details of platform users: name, ID number, email, phone.
• Company data: name, industry.
• Conversations of each business’s customers, as processor (section 2): the name or username they write with, phone number, messages, and the images, audio and documents they send.
• Technical data: IP address, device fingerprint, access logs.
• Payments: transaction reference. We never store card numbers.
• Consent: date, time and IP address from which it was given.

• Provide the Zeni service: manage the business’s conversations, AI assistant, automations and channels.
• Verify identity and authenticate access.
• Process payments and manage the subscription.
• Send service communications (activation, billing, changes).
• Send Zentra’s commercial information, news and offers by WhatsApp, email or other means. You can object at any time by replying BAJA or at zeni.webzentra.com/arco.
• Improve the service with aggregated statistics.
• Meet legal obligations and answer data subject requests.

Zentra does not use conversations to train AI models, and does not sell or share them for commercial purposes. The AI providers (section 6) apply their own terms to what they receive, and those terms may allow them to use it to improve their services.

• Consent (Law 1581 of 2012, article 9), given when creating the account or requesting the demo.
• Performance of the contract with the business.
• Legal obligations (accounting, tax and data protection).
• Security of the platform and fraud prevention.

For its customers’ conversations, obtaining each person’s consent is the business’s duty as controller.

Data is stored on a virtual private server (VPS) rented by Zentra in Atlanta, United States. To provide the service we use these providers, some of them outside Colombia:

• RackNerd (United States): virtual private server (VPS) rented by Zentra, which runs Zeni, the message inbox and the databases. Receives all service data.
• Meta Platforms (United States): WhatsApp Business, Instagram, Messenger and the Conversions API. Receives the messages of those channels and, if the business measures its ads, the phone number turned into a SHA-256 hash and the ad id.
• DeepSeek (China): AI model that drafts the assistant’s replies. Receives the conversation text with identifiers masked (emails, phone numbers, ID numbers, cards, accounts, addresses and usernames); names and the message content do reach it.
• Google (Gemini) (United States): backup AI model, reading of images, audio and documents, voicemail transcription, and knowledge base and catalog search. Receives the conversation text with identifiers masked when it stands in for the main model; the customer’s message, unmasked, to search the knowledge base and catalog; and, in full, the images, audio and documents customers send and voicemail recordings, when the business turns on the assistant or voicemail.
• Cloudflare (United States (global network)): DNS, protection and the encrypted connection between the browser and Zeni. Receives data in transit.
• Zentra mail server (Hetzner) (Germany): sending and receiving webzentra.com email: sign-in, invitations, team notices, answers to data requests and the contact mailbox of this notice. Receives the recipient’s email and name and the content of those emails.
• Wompi (Colombia): subscription payment gateway in Colombia. Receives the name, email, phone number and amount. You type the card number directly into the gateway: Zentra never sees or stores it.
• dLocal Go (Uruguay): subscription payment gateway outside Colombia. Receives the amount, country, payment reference and company name. You type your payment details directly into the gateway.

If a business turns on its own integrations (WooCommerce, Shopify, Wompi, ePayco, Cal.com, 99envíos, Kommo, Zentra ERP and the business’s own webhooks (for example n8n, Make or Zapier)), those services receive only what that business configures.

Previous copy. Until October 16, 2026 Zeni ran on a Zentra server in Germany (Hetzner). A copy of the data from before that date remains there: it is not used to provide the service and will be deleted no later than November 30, 2026.

This involves international data transfers to the United States, Germany, China and Uruguay. We use only the providers the service needs and limit what they receive (section 7).

If the business turns on the AI assistant, the conversation text is sent to the AI model that drafts the reply. Before sending it we mask identifiers: emails, phone numbers, ID numbers, cards, bank accounts, addresses and usernames. They are replaced with placeholders and restored only in the reply the customer receives.

What is not masked:

• People’s names and the message content, because the model cannot answer without them.
• The customer’s message used to search the business’s knowledge base and catalog.
• The images, audio and documents customers send, and voicemail recordings: they are sent in full so they can be read or transcribed.

The business can turn the AI assistant off on any channel.

• Business account: while the service is used and up to 5 years after cancellation, for accounting and tax obligations.
• Conversations: while the business uses the service. Today they are not deleted automatically on cancellation: they are deleted when the business or the data subject asks at zeni.webzentra.com/arco.
• Activity logs and IP addresses: 24 months; then deleted automatically.
• Encrypted backups: 14 days on the server and up to 30 days in the off-server copy, in Colombia; then deleted.
• Data subject requests: 5 years after they are answered.

Under Colombian Law 1581 of 2012 and Decree 1377 of 2013, you can access, update, correct and ask us to delete your data, withdraw your consent and object to its use.

Send your request at zeni.webzentra.com/arco or to [email protected]. Queries are answered within 10 business days (article 14) and claims within 15 business days (article 15).

• Encrypted connections over HTTPS.
• AES-256-GCM encryption of channel tokens, integration credentials and call recordings.
• Role-based access: each person sees only what their role allows, and each business only its own data.
• Servers behind a default-deny firewall; databases are not reachable from the internet.
• Daily backups encrypted with GPG and stored off the server, in Colombia.
• Two-factor authentication for Zentra’s internal admin panel.
• Identifiers masked before the conversation is sent to the model that drafts replies (section 7).

• zeni_session (essential): business panel session. Expires in 30 days.
• zeni_member (essential): team session in the CRM. Expires 12 hours after signing in.
• admin_token (essential): Zentra’s admin panel session. Expires in 8 hours.
• zeni_locale (preference): chosen language. Lasts 1 year.
• zeni_locale_sugerido (preference): language suggested by country. Lasts 6 hours.
• zeni_crm_tema and zeni_crm_marca (preference): CRM theme and visual brand. Last 1 year.

We do not use third-party advertising cookies. Essential cookies cannot be turned off without breaking the service; preference cookies only remember your choices.

Zeni is for people over 18 acting for a company or business. We do not knowingly collect data from minors. If you know a minor gave us data without authorization, write to us and we will delete it.

If we make a material change, we will announce it by email or in the platform at least 15 days in advance.

Last updated: October 27, 2026. We corrected where the servers and email are, named every provider with its country and what it receives, explained what is and is not masked before AI, and Zeni’s role as processor.

If you believe the processing of your data breaks Colombian law, you can file a complaint with the Superintendencia de Industria y Comercio (SIC):

• Website: www.sic.gov.co
• Toll-free line (Colombia): 01 8000 910 165
• Address: Carrera 13 No. 27-00, Bogotá D.C.