# Privacy Policy

> Learn how Mesa handles multi-tenant workspace data, end-to-end encryption, retention, security, and WhatsApp privacy compliance.

Canonical: https://mesa.zambrite.com/privacy

Last updated: October 4, 2026

## 1. Information We Collect

When you use Mesa, we may collect the following types of information:

- **Account Information:** Email address, organization name, and password hash when you register.
- **WhatsApp and Workspace Data:** Authorized WhatsApp account and phone-number details, contacts, messages, shared media and documents, message templates, delivery status, and business records used by your workspace.
- **API Usage Data:** API request logs, session activity, and message delivery metadata.
- **Technical Data:** IP addresses, browser type, device information, and access timestamps for security and analytics.
- **Billing Information:** Payment details processed through our secure payment providers.

## 2. How We Use Your Information

We use collected information to:

- Provide, maintain, and improve the Service
- Process transactions and manage your subscription
- Send important service notifications and updates
- Monitor and prevent abuse, fraud, and security threats
- Enforce our [Terms of Service](https://mesa.zambrite.com/terms) and rate limits
- Generate anonymized, aggregate analytics to improve the platform

## 3. Message Content

Mesa processes and stores incoming and outgoing messages and related business records to provide your shared inbox, conversation history, customer service, and commerce workflows. Access to workspace data is controlled by organization membership, roles, and authorized integrations. When AI features are enabled, relevant messages, conversation context, and documents may be sent to the configured AI providers to interpret requests, extract information, and generate responses for your business.

## 4. Data Sharing

We do not sell your personal data. We may share information with:

- **Service Providers:** Vendors that provide hosting, storage, WhatsApp connectivity, payment processing, and configured AI services. AI processing may use TypeSafe/Jev, DeepSeek, or another provider configured for your workspace. Relevant data is shared to perform the requested service.
- **Your Integrations:** Services you authorize through workspace settings, API keys, or webhooks receive the data needed for their configured functions.
- **Legal Requirements:** When required by law, subpoena, or to protect our rights and the safety of users.
- **Business Transfers:** In connection with a merger, acquisition, or sale of assets.

## 5. Data Security

Mesa uses access controls, scoped API keys, and webhook authentication to protect workspace data. Connections to the public service use HTTPS. Security protections also depend on the hosting environment and the services configured for your workspace. No method of transmission or storage is 100% secure.

## 6. Data Retention

Workspace data is retained to provide the configured services and conversation history. Retention depends on the type of record and applicable workspace and hosting settings. You can request deletion through our contact page. Upon account deletion or a verified deletion request, we remove your personal data within 30 days and ask configured service providers to delete data they hold, except records that must be retained for legal, accounting, or security purposes.

## 7. Your Rights

Depending on your jurisdiction, you may have the right to:

- Access and receive a copy of your personal data
- Correct inaccurate or incomplete data
- Request deletion of your personal data
- Object to or restrict processing of your data
- Data portability — receive your data in a structured format

To exercise these rights, please [contact us](https://mesa.zambrite.com/contact).

## 8. Cookies

We use essential cookies and session tokens to authenticate users and maintain sessions. We do not use third-party tracking cookies for advertising purposes.

## 9. Children's Privacy

The Service is not intended for use by individuals under the age of 18. We do not knowingly collect personal data from children.

## 10. Changes to This Policy

We may update this Privacy Policy from time to time. We will notify you of material changes via email or through the Service. Your continued use after changes constitutes acceptance.

## 11. Contact

Mesa is operated by Zambrite Management Enterprise Limited, Lusaka, Zambia. For privacy questions, access or deletion requests, email [support@zambrite.com](mailto:support@zambrite.com) or [contact us](https://mesa.zambrite.com/contact).

[WhatsApp us](https://wa.me/260978825597)

## Related
- [Mesa](https://mesa.zambrite.com/)
- [Documentation](https://mesa.zambrite.com/docs)