Start Your Pilot

Privacy notice

What DealZen collects, and what we do with it

Last updated 28 September 2026

This notice is provisional and pending review by legal counsel. DealZen is in pilot. We publish this now so you can see exactly what the system does with data today; the wording will be reviewed by a qualified lawyer and may change.

Who we are

DealZen is built and operated by The Web Doctor, based in Mumbai, India (the “operator”, “we”, “us”). The registered legal-entity name and address, and a named grievance/data-protection contact, are to be confirmed with counsel before launch.

What DealZen does

A business connects the channels it already uses — WhatsApp, Telegram and Gmail. DealZen reads the messages in those channels, uses AI to decide which ones look like a sales lead for that business, and surfaces the ones worth attention. It does not send messages on your behalf without an explicit action.

What data we collect

When a business connects a channel, DealZen ingests the messages that arrive on it. Because those messages come from group chats, threads and inboxes, they can include personal data about people other than the DealZen customer — the third parties who sent or appear in those messages. For each message we may store:

  • the message text or email body;
  • the sender’s handle or display name;
  • the sender’s phone number, where the channel provides it (for example a WhatsApp sender);
  • the group or chat name and the channel it came from;
  • technical metadata such as message and thread identifiers and the time it was received.

We do not ask you for, and DealZen does not collect, financial-account numbers, government identifiers, or passwords. We do not build advertising profiles and we do not sell data.

Why we use it (purpose)

The only purpose is lead detection for the business that connected the channel: identifying, scoring and organising potential sales opportunities so that business can follow up. We use the data for nothing else.

Lawful basis

DealZen is intended to operate under India’s Digital Personal Data Protection Act, 2023 (DPDP). The connecting business is responsible for having a proper basis to share the messages in its connected channels with a processor. The exact lawful-basis wording is to be confirmed with counsel.

Who processes the data

To score messages, DealZen sends message content to third-party AI providers in the United States: currently OpenAI (OpenAI, L.L.C.) and NVIDIA (NVIDIA Corporation, via its hosted model API). This means the content of connected messages is transferred to and processed on servers outside India. We use the provider that is available for a given request and record which one served it. We do not use these providers’ APIs to train their models on your data beyond what is necessary to return a result.

How long we keep it (retention)

Messages that DealZen ingests but does not turn into a lead are retained for no longer than 30 days and are then removed from our active systems. Messages that become part of a lead are kept for as long as the business keeps that lead, and are deleted when the workspace or account is deleted.

When data is deleted from DealZen, encrypted copies may remain in our off-site backups for up to 105 days, after which they are deleted automatically. Backups are used only to restore the service and to test that restoring works.

Your rights

Subject to applicable law, you may ask us to access, correct, or delete personal data we hold about you, and to tell you how it is being used. When a customer deletes a DealZen workspace or account, the messages, senders, leads and channel connections held for it are deleted from our active systems (backups then age out on the schedule above).

To make a request — including a request by a third party whose messages were ingested through a customer’s connected channel — contact us at [TODO: confirm with counsel — privacy contact address]. Where a request concerns messages a business connected, we may need to involve that business, who decides what is collected in its channels.

Security

Data is isolated per workspace and sensitive fields are encrypted at rest. If a personal-data breach occurs, we follow an internal breach-response process; regulator and data-principal notification timelines will follow the DPDP Act as confirmed with counsel.

Changes

We will update this notice as DealZen changes and as counsel reviews it, and will change the “last updated” date above. This is a pilot product and this notice is provisional.

by The Web Doctor · Mumbai, India