Privacy Policy

1. Who we are

ZOTTA AI LTD is a company registered in England and Wales (company number 17091705), with its registered office at 17B North Common Road, Uxbridge UB8 1PD, United Kingdom. We build and operate Zotta LMS, a loan management platform used by lenders and credit providers, primarily in the Caribbean and other emerging markets.

You can contact us about this policy at info@zotta.ai or by post at the address above.

2. Our role: controller or processor

We act in two different roles depending on whose data is involved.

Whose data	Our role	What that means
Visitors to zotta.ai and people who contact us	Controller	We decide why and how the data is used, and this policy applies in full.
Staff of our clients who hold Zotta platform accounts	Controller	We manage account, authentication and audit data needed to run the service securely.
Borrowers, applicants and customers of our clients	Processor	The lender you deal with is the controller. We process your data only on its documented instructions. Requests about that data should go to the lender first; we will help it respond.

3. Data we collect

3.1 Website visitors

• Contact and demo requests: name, email address, company, and the message you send us.
• Chat assistant: the questions you type into the public assistant on zotta.ai.
• Analytics: we use Plausible, a privacy-focused, cookie-free analytics service that records aggregated page views, referrer and country. It does not build individual profiles.

3.2 Platform users (client staff)

• Name, work email, role and permissions, phone number for one-time passcodes.
• Login events, IP address, device and browser details, and an audit trail of actions taken in the platform.

3.3 Data processed on behalf of our clients

When a lender uses Zotta to run its loan book, we process the data that lender collects from its customers. Depending on the client's configuration this can include:

• Identity and contact details: name, date of birth, national ID or passport details, address, phone number, email.
• Financial and employment information: income, employer, bank statements, credit bureau reports, existing obligations.
• Loan records: applications, decisions, contracts, schedules, payments, arrears and collections activity.
• Communications: the content and metadata of messages exchanged with the lender through the platform, including WhatsApp messages, SMS and email.

4. WhatsApp messaging

Zotta is a technology provider on the WhatsApp Business Platform operated by Meta Platforms, Inc. and its affiliates ("Meta"). Our clients connect their own WhatsApp Business Account to Zotta and use the platform to send and receive WhatsApp messages with their customers, for example loan status updates, payment reminders, one-time passcodes and customer support replies.

• Who is messaging you: messages are sent by, and on behalf of, the lender whose name appears in the WhatsApp conversation. Zotta operates the technology; the lender decides what is sent and to whom.
• Data involved: your WhatsApp phone number, your profile name, business-scoped user identifiers assigned by WhatsApp, message content, delivery and read receipts, and timestamps.
• Consent: lenders are required to obtain your opt-in before sending you WhatsApp messages, in line with Meta's WhatsApp Business Messaging Policy. You can stop receiving messages at any time by replying STOP to the conversation (reply START to resume), by contacting the lender directly, or by blocking the business in WhatsApp. Login codes you request yourself are still delivered.
• Meta's role: message delivery runs through Meta's infrastructure and is subject to the WhatsApp Business Terms and Meta's privacy practices. Message content is encrypted in transit between WhatsApp and our systems.
• Message templates: outbound notifications use templates that Meta reviews and approves before they can be sent.

5. How we use data and the legal bases

Purpose	Legal basis (UK GDPR)
Responding to enquiries and demo requests	Legitimate interests; steps prior to a contract
Providing, securing and supporting the Zotta platform for clients	Performance of a contract; legitimate interests
Processing borrower data for a client	Client's instructions under our data processing agreement; the client holds the legal basis for its own processing
Sending and receiving WhatsApp messages for a client	Client's instructions; the client obtains the customer's opt-in
AI-assisted features (document extraction, scoring support, message drafting)	Client's instructions; legitimate interests in improving service quality
Fraud prevention, security monitoring, audit logging	Legitimate interests; legal obligations
Complying with law, regulators and lawful requests	Legal obligation

We do not sell personal data, and we do not use client or borrower data to train general-purpose AI models.

6. Who we share data with

We share data only as needed to run the service. Our main sub-processors are:

Provider	Purpose	Location
Microsoft Azure	Cloud hosting, databases, storage, AI model hosting (Azure OpenAI)	United States (East US 2)
Meta Platforms (WhatsApp Business Platform)	Delivery of WhatsApp messages	Global, per Meta's terms
Twilio	SMS delivery and legacy WhatsApp message routing	United States
Postmark (ActiveCampaign)	Transactional email delivery	United States
Plausible Analytics	Cookie-free website analytics	European Union
Amazon Web Services	Hosting of the zotta.ai marketing website	United States
Intuit QuickBooks, credit bureaus	Only where a client enables an integration; data flows on that client's instruction	Varies by client

We may also disclose data to professional advisers, to a buyer in a business transfer, or where required by law or a regulator.

7. International transfers

Our clients are largely outside the United Kingdom, and our hosting is in the United States. Where UK or EU personal data is transferred outside those regions, we rely on the UK International Data Transfer Agreement or the EU Standard Contractual Clauses, with supplementary measures where needed.

8. How long we keep data

• Website enquiries and chat: up to 24 months after the last contact.
• Platform user accounts and audit logs: for the life of the client contract, then up to 90 days, except audit records a client asks us to retain for compliance.
• Borrower and messaging data held for a client: for as long as the client instructs. When a client contract ends we return or delete the data within 90 days, unless a law applying to the client requires longer retention.

9. Security

We encrypt data in transit (TLS) and at rest, isolate each client's data in its own tenant, apply role-based access control and multi-factor authentication for staff access, keep audit logs of access to personal data, and review our sub-processors' security certifications. No system is perfectly secure; if we become aware of a personal data breach affecting you or a client, we will notify the affected controller and, where required, the regulator without undue delay.

10. Your rights

Under the UK GDPR and equivalent laws you may have the right to access, correct, delete or restrict the use of your personal data, to object to processing based on legitimate interests, to data portability, and to withdraw consent where consent is the legal basis.

• If your data is held because you visited zotta.ai or hold a Zotta account, email info@zotta.ai. We respond within one month.
• If your data is held because you are a customer of one of our clients, contact that lender. We will support the lender in responding, and if you contact us directly we will pass your request to the lender.
• You can ask us to delete your data by following the steps on our Data Deletion page.

You can also complain to the UK Information Commissioner's Office at ico.org.uk, or to the data protection authority in your country.

11. Children

Our services are designed for businesses and for adults entering into credit agreements. We do not knowingly collect data from anyone under 18.

12. Changes to this policy

We may update this policy from time to time. The effective date at the top shows the current version. Significant changes will be announced to clients through the platform or by email.

13. Contact

ZOTTA AI LTD
17B North Common Road, Uxbridge UB8 1PD, United Kingdom
Email: info@zotta.ai