Master Privacy Policy
Cross-border data protection architecture and global privacy standards for custom software engineering, cloud platforms, and conversational AI telephony systems.
01.Corporate Identity and Governance Framework
Zeblio Digital Solutions, commercially identified as Zeblio and legally organized under SNS Emporium, having its principal operational headquarters in Erode, Tamil Nadu, 638001, India, functions as the primary Data Fiduciary under Indian data privacy laws and as a Data Controller under corresponding international legal instruments.
Zeblio engineers custom digital applications, enterprise management architectures, point-of-sale infrastructure, and automated conversational artificial intelligence telephony platforms, accessible via the domain https://zeblio.com. This Master Privacy Policy establishes the global data processing standards governing the collection, utilization, cross-border transmission, storage, and erasure of personal information gathered from website visitors, commercial clients, software users, and telephonic communication counterparties across India, the United States, the United Kingdom, the European Union, the United Arab Emirates, and the Kingdom of Saudi Arabia.
02.Typology of Digital Personal Data Processed
Zeblio adheres strictly to the statutory principle of data minimization, collecting exclusively personal information required to execute technical scopes of work, deliver software-as-a-service platforms, and maintain business systems.
Data acquired directly through user disclosure: Encompasses full legal names, corporate email addresses, commercial telephone contact numbers, company names, business physical addresses, and project requirement details submitted via project inquiry portals or scheduling interfaces. For clients deploying or interacting with Zeblio artificial intelligence front desk telephony infrastructure, personal information collected includes inbound caller voice streams, automated audio call recordings, natural language conversation transcripts, telephone metadata, caller identification tags, and scheduling parameters. Commercial billing metadata collected includes Goods and Services Tax Identification Numbers (GSTIN) for Indian accounts, regional Value Added Tax (VAT) identification numbers, corporate tax identifiers, billing addresses, and payment gateway transaction tokens. Direct credit instrument information, cardholder numbers, and bank account credentials are processed directly by certified payment processors and are never written to Zeblio database storage systems.
Data acquired automatically through platform execution: Comprises technical telemetry, including Internet Protocol addresses, unique device identifiers, browser classifications, operating system architectures, localized time-zone configurations, and access timestamps. Platform interaction telemetry includes Uniform Resource Locator clickstreams, referrer addresses, system session durations, and essential functional cookies necessary to sustain user authentication and administrative dashboard integrity.
| Processing Category | Specific Personal Data Elements | Statutory Lawful Basis | Retention Schedule |
|---|---|---|---|
| Inquiry Intake & Scoping | Legal name, corporate email, telephone number, system specifications. | Contractual necessity and pre-contractual steps. | 24 months following initial inquiry or proposal closure. |
| Software Service Delivery | Administrative credentials, API keys, operational database metadata. | Contractual performance under Statement of Work. | Active contract duration plus 90 days post-disengagement. |
| AI Front Desk Telephony | Caller voice audio, digitized transcripts, caller-ID, booking metadata. | Express consent and contractual performance. | 30 days rolling deletion for audio; transcripts retained per contract. |
| Statutory Tax & Accounting | Invoices, GSTIN, corporate entity name, payment reference IDs. | Compliance with Indian and international tax statutes. | 8 years pursuant to Indian GST statutory schedules. |
| Platform Telemetry & Security | IP addresses, browser agents, access timestamps, firewall audit logs. | Legitimate business interest and network defense safeguards. | 180 days rolling schedule within secure server log archives. |
03.Purpose Limitation and Processing Mandates
Personal information is processed strictly within the boundaries of disclosed commercial and technical objectives. The operational framework utilizes personal data to evaluate technical feasibility, generate architectural proposals, provision web applications, manage continuous integration and deployment pipelines, maintain point-of-sale and enterprise resource planning systems, and process payments.
Personal data is never monetized, traded, rented, or leased to external marketing brokers. Client proprietary data and artificial intelligence voice interaction logs are strictly not utilized to train open, foundational public artificial intelligence models without explicit, written contractual authorization.
04.Harmonized Protection of Minors (Universal Age Threshold: 18)
Zeblio provides commercial, enterprise-focused digital systems and business tools. Services are neither marketed to nor intended for use by minors. In adherence to Section 9 of the Indian Digital Personal Data Protection Act, 2023, the Information Commissioner’s Office Age Appropriate Design Code of the United Kingdom, and the United States Children’s Online Privacy Protection Act, Zeblio establishes an absolute age gating threshold of eighteen (18) years.
Zeblio does not knowingly collect or solicit personal information from any individual under eighteen years of age. The studio refrains from tracking, behavioral monitoring, or profiling individuals below the age of majority. If Zeblio identifies that personal data belonging to an individual under eighteen years of age has been submitted through its web properties or conversational interfaces without verified parental consent, internal security protocols mandate the immediate, permanent purging of such records from all operational systems. Legal guardians who identify unauthorized data transmission by minors may mandate immediate erasure by transmitting written notice to contact@zeblio.com.
05.Cloud Hosting Architecture, Security Safeguards, and Cross-Border Transfers
Zeblio maintains its core cloud databases, application servers, and development repositories within Tier-3 cloud data centers, principally on Amazon Web Services infrastructure situated within the Asia-Pacific region (ap-south-1, Mumbai, India), utilizing globally peered Content Delivery Networks for edge caching.
Cross-border transmissions of personal data originating from clients or callers located outside India are executed in compliance with statutory transfer regulations. Personal data originating within the United Kingdom or the European Economic Area is transferred to systems outside those territories pursuant to European Commission Standard Contractual Clauses (SCCs) or the United Kingdom International Data Transfer Agreement (IDTA), supplemented by localized technical risk assessments. Personal data originating within the United Arab Emirates or Saudi Arabia is managed under the cross-border requirements of UAE Federal Decree-Law No. 45/2021 and the Saudi Personal Data Protection Law (Royal Decree M/19), ensuring target recipient environments offer adequate data protection safeguards or operate under binding data processing agreements.
Technical security controls implemented by Zeblio include Advanced Encryption Standard 256-bit (AES-256) encryption for all structured and unstructured data at rest. Data moving across public communications networks is secured via Transport Layer Security (TLS 1.3) protocols. Internal operational access to source control systems, database administrative consoles, and artificial intelligence call records is governed by multi-factor authentication, principle-of-least-privilege access rules, and automated immutable access logging. In the event of a verified data security incident involving personal data, Zeblio will notify impacted Data Principals without undue delay, alongside statutory transmission of breach notifications to the Data Protection Board of India and applicable international supervisory authorities within mandatory 72-hour statutory timeframes.
06.Jurisdictional Data Rights and Global Exercise Protocols
Zeblio provides comprehensive procedural mechanisms enabling individuals to exercise statutory rights granted by the legislation of their respective jurisdictions:
Data Principal Rights (India DPDP Act, 2023)
- Right to Access Information: Summary of processed data and processing identities.
- Right to Correction & Erasure: Updating outdated, incomplete, or inaccurate records.
- Right of Grievance Redressal: Direct statutory recourse via internal Grievance Officer.
- Right to Nominate: Designation of legal representative in the event of death/incapacity.
Data Subject Rights (UK & EU GDPR)
- Right of Access: Subject Access Requests (SARs) delivered in structured export format.
- Right to Rectification & Erasure: Right to be Forgotten for expired scopes.
- Right to Restrict & Object: Cessation of direct marketing and non-essential processing.
- Right to Data Portability: Machine-readable transmission of user-provided data.
- Right to Lodge Complaints: Direct escalation to UK ICO or European National DPAs.
Consumer Rights (US CCPA / CPRA & State Laws)
- Right to Know: Categories and specific pieces of personal information collected.
- Right to Delete & Correct: Permanent purging and correction of personal information.
- Right to Opt-Out: Freedom from sale or cross-context behavioral advertising.
- Right to Non-Discrimination: Equal service pricing and quality upon exercising privacy rights.
Data Subject Entitlements (UAE & KSA PDPL)
- Right to Revoke Consent: Unconditional withdrawal without retroactive invalidation.
- Right to Restrict & Mandate Erasure: Halting processing when data is no longer necessary.
- Right to Object to Automated Decisions: Request for human intervention in automated flows.
- Right to Escalate Disputes: Recourse to UAE FAID or Saudi SDAIA supervisory authorities.
07.Statutory Grievance Redressal Mechanism
Pursuant to the mandatory requirements of the Indian Information Technology Act, 2000, the Information Technology (Intermediary Guidelines and Digital Media Ethics Code) Rules, 2021, and Section 13 of the Digital Personal Data Protection Act, 2023, Zeblio has formally designated and appointed a statutory Grievance Redressal Officer:
Grievance Redressal Officer & Data Protection Lead
Zeblio Digital Solutions (SNS Emporium)
Zeblio Studio, Erode, Tamil Nadu, 638001, India
Required Subject Heading: Please title email communications as STATUTORY DATA PRIVACY GRIEVANCE
Investigation & Resolution SLA: The Grievance Officer acknowledges all formal data rights submissions within forty-eight (48) hours of receipt, issuing a case tracking identifier. Substantive investigation and resolution are completed within fifteen (15) to thirty (30) business days. If an Indian resident considers the determination unsatisfactory, the Data Principal may escalate the grievance directly to the Data Protection Board of India. International users maintain the right to petition their regional supervisory bodies (UK ICO, European DPAs, UAE Data Office, or Saudi SDAIA).