Privacy Policy

For the data of merchants who create a Zahrex account ("Merchants") and of visitors to our website, WEBTRIX SARL AU is the data controller.

When a Merchant connects their own Facebook Page, Instagram account or WhatsApp Business number, Zahrex processes the messages and comments of that Merchant's customers on the Merchant's behalf, to provide the Merchant's inbox. For that customer data the Merchant is the controller and Zahrex acts as their processor. Customers who want to exercise their rights may contact the Merchant directly or write to us at privacy@zahrex.com and we will help.

We collect only what is needed to run the features you use:

• Account data: your name, email address and login credentials, managed by our authentication provider. We never receive or store your password in plain text.
• Organization and team data: business name, country, currency, team members you invite, their roles and permissions.
• Business content you create or upload: products, orders, leads, landing pages, ad creatives, templates, files and settings.
• Billing data: subscription plan, credit balance and payment history. Card details are handled by our payment provider and never stored by Zahrex.
• Technical data: server logs containing IP address, browser user agent and request time, used for security and troubleshooting.
• Data from Meta platforms (Facebook, Instagram, WhatsApp, Meta Ads), only when you connect them. See section 3.

When you click "Connect" and log in with Facebook, you choose which Pages, Instagram accounts, WhatsApp numbers and ad accounts to share with Zahrex. With your permission we receive and store:

• About you (the person who connects): your Facebook app-scoped user ID and the IDs and names of the businesses you manage. Your Facebook name is read to confirm the connection but is not stored. We do not request or use your Facebook email address.
• About your business assets: the IDs, names and profile picture links of the Facebook Pages and Instagram professional accounts you select; your WhatsApp Business account ID, phone number ID, display phone number and verified name; your ad account IDs, names, currency, status and pixel IDs.
• Access tokens issued by Meta, so Zahrex can act on the assets you selected. Tokens are encrypted at rest and never shown to anyone.
• Messages and comments sent to your Pages, Instagram account and WhatsApp number: the sender's platform-scoped ID (PSID, Instagram-scoped ID, or WhatsApp phone number), the sender's name and profile picture link as provided by Meta, the message or comment text, links to attachments hosted by Meta, the post the comment belongs to, timestamps and delivery status.
• Replies that you and your team send from the Zahrex inbox.
• Advertising data: the campaigns, ad sets and ads you create or manage through Zahrex (their Meta IDs, settings, budgets and delivery status), performance metrics (such as impressions, reach, clicks and spend), and the optimization suggestions Zahrex derives from them.
• Conversion events: when you enable conversion tracking, Zahrex sends purchase and lead events to Meta's Conversions API on your behalf. Your customer's email address and phone number are hashed (SHA-256) before they are sent, and Zahrex does not store them. We keep only the event name, pixel ID, value and currency.

• To provide the service: show your customers' messages and comments in one inbox, let your team reply (publicly, or privately to a commenter), run the auto-reply rules you configure, manage your ads and campaigns, and build your stores and landing pages.
• To operate your account: authentication, team permissions, billing and customer support.
• To keep Zahrex secure and reliable: detect abuse, debug errors and prevent fraud.
• To communicate with you about your account, security and changes to the service.

• We do not sell, rent or license Meta Platform Data or your customers' data to anyone.
• We do not use it for advertising, profiling, or building audiences, and we do not share it with data brokers.
• Your customers' messages and comments are never sent to artificial-intelligence providers, and we do not use them to train AI models.
• We use it only to provide the features you enabled, for your own business, and in line with the Meta Platform Terms and Developer Policies.

We share data only with service providers that process it on our behalf under contract, and only what each one needs:

• Integrations you turn on: when you connect a store, payment provider or delivery company (for example Shopify, YouCan, WooCommerce, Stripe or a delivery carrier), we exchange with that service the data needed for the integration you chose.
• Within your organization: data is visible to members of your organization according to the roles and per-account access you assign.
• Legal requirements: we disclose data to authorities only when required by applicable law and after verifying the request. Where allowed, we inform the affected Merchant.
• Business transfer: if WEBTRIX SARL AU is involved in a merger or acquisition, data may be transferred under the same protections described here.

• All traffic is encrypted in transit with HTTPS/TLS.
• Meta access tokens and other third-party credentials are encrypted at rest.
• Access inside Zahrex is limited by organization membership, roles and per-Page access settings. Only owners and admins can connect or disconnect Meta accounts.
• Webhooks received from Meta are verified with Meta's cryptographic signature before they are processed.
• Our databases are not exposed to the public internet, and staff access is limited to what is needed to operate and support the service.

You can delete your data at any time. Full instructions are on our Data Deletion page: https://www.zahrex.com/data-deletion

• In Zahrex: go to Apps, open Meta and click Disconnect, or delete a single conversation from the inbox, or delete your organization from its settings.
• From Facebook: go to Settings & privacy > Settings > Apps and websites, remove Zahrex, and choose to send a deletion request. Meta notifies us, we delete your data, and you receive a confirmation code with a link to check the status.
• By email: write to privacy@zahrex.com from the email address of your Zahrex account. We answer within 30 days.

Under Moroccan Law No. 09-08 on the protection of individuals with regard to the processing of personal data, and other laws that may apply to you (such as the EU GDPR), you have the right to access, rectify, delete and object to the processing of your personal data. To exercise these rights, contact privacy@zahrex.com. We may ask you to confirm your identity.

You also have the right to lodge a complaint with the Moroccan data protection authority, the Commission Nationale de contrôle de la protection des Données à caractère Personnel (CNDP), at https://www.cndp.ma, or with the authority of your country.

Our main servers are in the European Union. Some providers listed in section 6 are located in other countries, including the United States. When data leaves Morocco or the European Union, we rely on the safeguards offered by those providers, such as standard contractual clauses, and we transfer only what the service needs.

The Zahrex dashboard uses essential cookies only: to keep you signed in and to remember the organization you are working in. Our website and dashboard do not use advertising or third-party analytics cookies.

Zahrex is a business tool for adults. We do not knowingly collect data from anyone under 18.

We may update this policy when our service changes. The "Last updated" date at the top shows the latest version. If a change is significant, we will notify Merchants by email or in the dashboard before it takes effect.

WEBTRIX SARL AU, Technopark Casablanca, Bureau 425, Casablanca, Morocco. Email: privacy@zahrex.com