Privacy Policy

Last Updated: June 26, 2026  |  Effective Date: June 26, 2026

This Privacy Policy applies to Zollak, an AI-powered social media management platform developed, owned and operated by Bahadur Contech Services Private Limited (CIN: U72900WB2022PTC257778), and describes how we collect, store, process, and protect the personal information you provide when using the Zollak platform (zollak.com and app.zollak.com).

By registering for or using Zollak, you consent to the practices described in this Policy. If you do not agree, please discontinue use of the platform immediately.

1. Information We Collect

  • Account & Identity Data: Full name, business email address, and account password (stored using secure cryptographic hashing — never in plaintext).
  • Billing & Subscription Data: Subscription plan tier, billing country, billing currency, and GSTIN (if applicable). Payment card details are never stored on our servers — all transactions are processed by Razorpay Software Private Limited (PCI-DSS Level 1 compliant).
  • Social Media OAuth Tokens: Access tokens, refresh tokens, page IDs, and API credentials for your connected social networks (Facebook, Instagram, LinkedIn, X/Twitter, Threads, YouTube, Pinterest, Telegram, Bluesky, Mastodon). Stored using secure, premium encryption keys.
  • Brand & Content Data: Brand name, niche/industry, target audience, scheduling preferences, post history, and brand voice parameters you configure.
  • WhatsApp Verification Data: Your WhatsApp-registered phone number used solely to route content approval messages.
  • Usage & Technical Data: IP address, browser type, device type, operating system, and action timestamps — used for security monitoring and platform stability only.

2. How We Use Your Information

  • To authenticate and maintain your secure session on the platform.
  • To publish scheduled social media posts to your connected accounts on your behalf.
  • To send WhatsApp approval requests and delivery notifications through our verification pipeline.
  • To generate and personalise AI-written content using your brand context and platform preferences.
  • To process subscription payments and manage billing cycles through Razorpay.
  • To send transactional emails (account verification, password resets, trial expiry warnings, billing receipts).
  • To analyse anonymised, aggregated platform usage patterns for product improvement.
  • To comply with legal obligations and enforce our Terms of Service.

3. Data Storage and Security

  • Encryption at Rest: All sensitive credentials and social media tokens are encrypted using advanced encryption keys before being written to our secure storage.
  • Encryption in Transit: All communications are encrypted in transit using industry-standard TLS protocols, backed by a firewall and DDoS protection.
  • Data Isolation: Every user account is strictly isolated from others. Our systems ensure that no account can ever view, query, or modify another account's social assets or credentials.
  • Rate Limiting: All connections are protected by traffic rate-limiting to prevent unauthorized access and bot attacks.
  • Automated Backups: Platform databases are backed up daily to encrypted storage and retained for a minimum of 30 days to prevent data loss.

4. Data Sharing and Third Parties

Zollak does not sell, rent, or share your personal data with third parties for advertising or profiling. We share data only as follows:

  • Social Media Platforms: We transmit your content to the specific social network APIs required to execute your publishing instructions.
  • Razorpay Software Pvt. Ltd.: To process subscription payments and manage billing.
  • Cloudflare, Inc.: As our CDN, DNS, WAF, and DDoS protection provider. Cloudflare Turnstile (our CAPTCHA service) processes a device fingerprint to distinguish humans from bots — no personal data is retained by Cloudflare for profiling purposes.
  • AI Inference Infrastructure (Zero Data Training / ZDR): Content generation and analysis requests processed through our AI gateway enforce strict Zero Data Retention (ZDR) policies and privacy headers. Your brand context, drafts, customer data, and uploaded assets are strictly isolated and never used to train, retrain, fine-tune, or improve generalized AI/ML models, nor shared with external model developers for training.
  • Legal Obligations: We may disclose your information if required by law, court order, or a competent regulatory authority in India.

5. Google API Services User Data Policy & Limited Use Disclosure

Zollak provides Google Single Sign-On (OAuth 2.0) authentication and optional YouTube channel management and publishing integrations. Zollak's use and transfer of information received from Google APIs to any other app will adhere to the Google API Services User Data Policy, including the Limited Use requirements.

Google OAuth 2.0 Scopes Requested & User-Facing Purpose:

OAuth Scope User-Facing Purpose & Access Description
openid Used to securely authenticate your identity and maintain your active session on the Zollak platform without storing your Google password.
https://www.googleapis.com/auth/userinfo.email (email) Used solely to verify your primary business email, send critical transaction receipts, and route account security notifications.
https://www.googleapis.com/auth/userinfo.profile (profile) Used strictly to display your name and profile avatar inside your private workspace header and dashboard.
https://www.googleapis.com/auth/youtube.upload Used exclusively when you explicitly connect your YouTube channel to upload, schedule, and publish video files and Shorts that you have drafted, reviewed, and approved.
https://www.googleapis.com/auth/youtube.readonly Used solely to display publishing confirmation status, video link preview, and aggregated view/like counts on your analytics dashboard.
  • Strict Purpose Limitation: We only access, use, and process Google user data to provide and improve user-facing features that are prominent in the Zollak user interface. We do not use Google user data for any other purpose.
  • Zero Artificial Intelligence / Machine Learning Model Training: Zollak guarantees that Google user data, YouTube user content, and private video media are never used to train, retrain, fine-tune, or validate generalized Artificial Intelligence (AI) or Machine Learning (ML) models.
  • Zero Commercial Sale or Data Broker Transfer: We do not sell, rent, monetize, or transfer Google user data or YouTube tokens to third parties, data brokers, advertising platforms, or marketing aggregators under any circumstances.
  • Human Review Safeguards: No human employee or contractor at Zollak reads, accesses, or reviews your private Google account data or video drafts unless you provide explicit written consent to investigate a specific technical support issue, or where required by law.
  • Storage & Encryption Standards: All Google OAuth tokens and refresh keys are stored using cryptographic AES-256 GCM encryption at rest in a private, multi-tenant database protected by PostgreSQL Row-Level Security (RLS). All data in transit is encrypted using TLS 1.3.
  • Data Retention & User Revocation: You can revoke Zollak's access to your Google account at any time via your Google Account Security Permissions or from your Zollak Dashboard under Settings → Connected Channels → Disconnect. Upon disconnection or account deletion, all associated Google OAuth tokens, channel IDs, and credentials are permanently purged from our encrypted storage vaults within 24 hours.

6. Data Retention

We retain your personal data for as long as your account is active and for 90 days after account deletion, after which all data is permanently purged from our systems and backup archives. Anonymised usage analytics may be retained indefinitely.

7. Your Rights

Under the Digital Personal Data Protection (DPDP) Act, 2023 (Government of India) and GDPR, you have the right to access, correct, erase, and port your data; to withdraw consent at any time; and to file a grievance with our Grievance Officer (see Section 9).

8. Children's Privacy

Zollak is not directed to individuals under 18 years of age. If you believe a minor has registered, contact us at privacy@zollak.com and we will promptly delete the account.

9. Grievance & Privacy Officer

  • Organisation: Bahadur Contech Services Pvt. Ltd. (Brand: Zollak)
  • Designated Officer: Grievance & Data Protection Officer
  • Email: privacy@zollak.com
  • Registered Address: Kolkata, West Bengal, India
  • Response Time: Acknowledgement within 48 hours; formal resolution within 15 business days.

10. Governing Law

This Privacy Policy is governed by the laws of India. Disputes shall be subject to the exclusive jurisdiction of the courts of Kolkata, West Bengal, India.