Privacy Policy

ZenCru LLC • Effective Date: June 30, 2026

This Privacy Policy explains how ZenCru LLC ("ZenCru," "we," "us," or "our"), a California limited liability company, collects, uses, shares, and protects information in connection with the ZenCru platform, website, and related services (the "Service"). By using the Service, you agree to this Policy.

Two groups of people are described in this Policy. "Clients" are our paying customers --- the businesses that subscribe to ZenCru, connect their own social media accounts, and use the dashboard. "End Customers" are a Client's own customers or prospective customers --- people who comment on or send messages to a Client's connected Instagram or Facebook account. End Customers never create a ZenCru account, never use the ZenCru interface, and have no direct relationship with ZenCru; ZenCru processes their information only because they interacted with a Client's business page, and only on that Client's behalf.

1. Who We Are

ZenCru provides an AI-powered social media automation platform for trade and service contractors. With respect to Client account data, ZenCru is the data controller. With respect to End Customer comments and messages, ZenCru acts as a service provider/processor on behalf of the Client whose account received them. We can be reached at privacy@getzencru.com.

2. What ZenCru Does Not Do

Because clarity matters, we want to state plainly what the Service does not do:

• ZenCru never sends SMS text messages to End Customers, under any circumstances.
• ZenCru never initiates contact with an End Customer. ZenCru only responds after an End Customer comments on or messages a Client's account first.
• ZenCru does not sell or rent Client or End Customer personal information, and does not share it with third parties for their own marketing.
• ZenCru does not use Client or End Customer data to train foundation AI models; data sent to our AI provider is used only to process that specific message or content.

3. Information We Collect

3.1 Information Clients Provide

• Account and contact information: name, email address, phone number, business name, trade or industry, and login credentials.
• Billing information: billing contact details and subscription plan. Card details are processed directly by our payment processor; we do not store full card numbers.
• Content: photographs and images of work, captions, business descriptions, services, and pricing the Client submits.
• Connected-account information: access tokens and account identifiers (such as the Client's Instagram Business Account ID) needed to publish content and manage comments and messages on the Client's behalf.

3.2 Information We Process About End Customers

When an End Customer interacts with a Client's connected Instagram or Facebook account, ZenCru processes, on the Client's behalf:

• Comment and message content: the text of comments left on the Client's posts and direct messages sent to the Client's account.
• Sender information as exposed by the platform: the commenter's or sender's platform username or platform-scoped user identifier.
• Lead details the End Customer chooses to provide: for example, the service requested, location, timeframe, and contact information shared in response to qualifying questions.

3.3 Information Collected Automatically

• Usage, device, and log data: actions taken in the Service, features used, timestamps, IP address, browser type, and device identifiers.
• Cookies and similar technologies: used to keep Clients logged in, remember preferences, and understand how the Service is used. You can control cookies through your browser settings.

4. Meta Platform Data (Instagram and Facebook)

This section describes specifically how ZenCru collects and uses data obtained through Meta's platforms, in connection with the permissions ZenCru requests (such as instagram_business_basic, instagram_business_manage_messages, and instagram_business_manage_comments, and the corresponding Facebook Page permissions). It applies identically to Instagram and Facebook.

4.1 What we collect and why

With the Client's authorization, ZenCru receives comments left on the Client's posts and direct messages sent to the Client's account, together with the sender information the platform exposes, and the Client's own business account identifier (used internally to route each message to the correct Client's dashboard). ZenCru uses this information solely to: generate an appropriate response on the Client's behalf; capture and score sales leads for the Client; and detect complaints so they can be routed to the Client for personal handling.

4.2 How automated responses work

Incoming messages are processed by our AI provider (Anthropic's Claude) to classify each message into a category such as buying-signal, compliment, complaint, or spam. ZenCru sends an automated reply only for buying-signal and compliment categories, using fixed or template language. ZenCru never sends automated promises about pricing, services, or availability that the Client has not configured, and ZenCru never auto-replies to a message identified as a complaint --- complaints are paused and surfaced to the Client to handle personally. ZenCru only ever responds to a message an End Customer sent first; it never initiates contact.

4.3 Who can see it

Captured lead data and message content are visible to the Client whose account received them, in that Client's own dashboard. The Service is multi-tenant and isolated: Clients cannot see one another's leads or messages. ZenCru's systems process this data programmatically, and ZenCru does not, as a matter of routine practice, have staff manually read Client or End Customer messages.

4.4 TikTok and Google Business Profile are posting-only

ZenCru posts content to TikTok on a Client's behalf; ZenCru does not collect or process comments or messages on TikTok, and no lead capture occurs through TikTok. If and when Google Business Profile posting becomes available, it will be posting-only in the same way. The comment- and message-handling described in this section applies only to Instagram and Facebook.

4.5 Disconnecting and revoking access

A Client may disconnect Instagram or Facebook from ZenCru at any time using the in-app disconnect control, which immediately halts all ZenCru API activity on that account. A Client may also revoke ZenCru's access directly through their own Meta Business Suite settings, independently of ZenCru. Disconnecting stops further processing; data already collected is retained according to Section 7 unless the Client separately requests deletion.

5. How We Use Information

We use information to: provide, operate, maintain, and improve the Service; process Client Content through AI to generate captions and content; publish content to connected platforms; classify and respond to comments and messages and capture leads as described above; process subscriptions and payments; communicate with Clients about their account, support, and (where permitted) updates; secure the Service and prevent fraud and abuse; and comply with legal obligations and enforce our Terms.

6. SMS Communications to Clients

ZenCru's only SMS use case is an optional transactional notification to a Client --- never to an End Customer. A Client who opts in may receive a text alert when a new qualified lead arrives. This is the sole purpose for which ZenCru sends SMS; ZenCru does not send marketing text messages. Clients who opt in can opt out at any time by replying STOP to any such message or by changing their notification settings, and ZenCru does not share Client mobile numbers or SMS opt-in consent with third parties for their own marketing. SMS notifications require carrier registration (A2P 10DLC), which ZenCru is in the process of completing; until that registration is approved, equivalent notifications are delivered by email to the Client's registered email address. Message frequency varies based on lead activity in your account. Message and data rates may apply. Reply HELP for help or STOP to cancel at any time.

7. How We Share Information

7.1 Service Providers (Sub-processors)

We use trusted third parties to operate the Service, including providers for AI classification and content generation, cloud hosting and file storage, database and backend infrastructure, social media publishing, customer-relationship and messaging automation, payment processing, and communications. These providers may access personal information only to perform services for us and are bound by confidentiality and data-protection obligations. Message content processed for classification is sent to our AI provider as a processor for that purpose only, not as a recipient for its own marketing. A current list of sub-processors is available on request at privacy@getzencru.com.

7.2 Connected Platforms

When a Client publishes content or responds to messages, we transmit the relevant content to the platforms the Client has connected, at the Client's direction. Those platforms handle information under their own privacy policies.

7.3 Legal and Protection; Business Transfers

We may disclose information if required by law or legal process, or where we believe disclosure is necessary to protect the rights, property, or safety of ZenCru, our users, or others, or to investigate fraud or security issues. If ZenCru is involved in a merger, acquisition, financing, or sale of assets, information may be transferred as part of that transaction, subject to this Policy.

8. Data Retention

We retain Client account information and Client Content for as long as the account is active and as needed to provide the Service. Lead and message data captured through Instagram or Facebook is retained for up to twenty-four (24) months after the last activity on that lead, or until the Client deletes it through the dashboard, or until the Client closes their account --- whichever occurs first --- after which it is deleted within thirty (30) days. We may retain limited information longer where required for legal, accounting, security, or dispute-resolution purposes.

9. Security

We use reasonable administrative, technical, and organizational measures designed to protect personal information, including access controls and multi-tenant data isolation between Client accounts. However, no method of transmission or storage is completely secure, and we cannot guarantee absolute security. Clients are responsible for keeping their login credentials confidential.

10. Data Breach Notification

ZenCru relies on third-party infrastructure providers to store and process data on our behalf. As the business that collects this information, ZenCru remains responsible for notifying affected individuals of a qualifying security incident, whether the incident occurs in our own systems or in a provider's systems. If we become aware of a breach of security that compromises the personal information we control, we will investigate promptly and notify affected Clients, and where applicable affected individuals and regulators, without unreasonable delay and as required by applicable law, including California Civil Code section 1798.82. Notice will describe, to the extent known, the nature of the incident, the types of information involved, and the steps individuals can take.

11. Your Privacy Rights

11.1 California Residents (CCPA/CPRA)

If you are a California resident, you have the right to know what personal information we collect and how we use and share it, to request access to and deletion of your personal information, to correct inaccurate information, and not to be discriminated against for exercising these rights. We do not sell or share personal information for cross-context behavioral advertising as those terms are defined under California law. To exercise these rights, contact us at privacy@getzencru.com; we will verify your request before responding and respond within the time required by law, and you may use an authorized agent. End Customers who wish to exercise rights regarding data processed through a Client's account may contact us, and we will assist the relevant Client in responding as required by law.

11.2 Other Rights

Depending on your location, you may have additional rights regarding your personal information, such as access, correction, deletion, and objection. We will honor applicable rights as required by law. To make a request, contact us at the address below.

12. Health Information

The Service is intended for trade, service, and non-medical wellness businesses and is not designed to collect or process protected health information (PHI) as defined under HIPAA. Clients represent that they are not HIPAA-covered entities and do not use the Service to transmit PHI. ZenCru does not act as a HIPAA Business Associate unless separately agreed in writing. If you believe PHI has been transmitted through the Service, contact us at privacy@getzencru.com so we can address it.

13. Children's Privacy

The Service is intended for businesses and is not directed to children under 18. We do not knowingly collect personal information from children. If you believe a child has provided us personal information, contact us and we will take appropriate steps to delete it.

14. Third-Party Links and International Users

The Service may link to or integrate with third-party websites and services we do not control, and this Policy does not apply to them. The Service is operated from the United States, and information we collect is processed and stored in the United States. If you access the Service from outside the United States, you understand that your information will be transferred to and processed in the United States, where data-protection laws may differ from those in your location.

15. Changes to This Policy

We may update this Privacy Policy from time to time. If we make material changes, we will provide notice through the Service or by email and update the Effective Date above. Your continued use of the Service after changes take effect constitutes acceptance of the updated Policy.

16. Contact Us

ZenCru LLC Privacy: privacy@getzencru.com General: legal@getzencru.com Website: https://getzencru.com