Your content isn’t
our business.
Zero message-content retention in Zapzim. Not a claim that nobody else stores your messages.
Zapzim processes voice notes and generated text in memory. It has no conversation archive, transcript database, or persistent message queue. The messaging connection service and WhatsApp operate separately, with their own retention behavior.
What passes through
When you enable transcription, the messaging connection service delivers new-message events to Zapzim. Eligible audio is sent to an AI speech-to-text service. The resulting transcript is then sent to a separate language model for key points and any optional translation or action items.
The reply contains key points first and the original full transcription below. Zapzim doesn’t save this content, including in application logs or backups. It does not import past conversations. In-flight work can be lost after a restart; it is not saved for later replay.
What we keep
- Your name, login email, verification state, password hash, and necessary authentication records.
- Workspace names, memberships, and preferences, isolated by workspace.
- The connected owner’s number, connection identifier, and encrypted connection credentials while the connection exists.
- Daily usage totals for 30 days, without per-message or per-contact records.
- Short-lived, keyed rate-limit identifiers. Session IP addresses and user-agent strings are not stored.
- If enabled, error monitoring receives only allowlisted technical error codes—not messages, request data, or raw exceptions.
Sessions expire after seven days; verification links after one hour; password-reset links after 30 minutes. Expired records require the scheduled metadata-cleanup job. Infrastructure backup expiry must be configured by the operator.
The provider boundary matters
The messaging connection service has separate retention. Its API specification describes storing messages and deleting messages older than seven days overnight. Zapzim disables public media links, but that does not disable the service’s message archive.
AI service providers: prompt logging must be disabled and the operator must confirm the selected speech-to-text endpoint’s retention behavior. The second, text-model request additionally requires ZDR routing and denies data collection. The speech-to-text API does not document the same per-request ZDR option; account-level configuration and endpoint verification are required before enabling processing.
WhatsApp, recipients, and email: returned messages remain in the selected WhatsApp chat and may be retained by participants or their backups. Authentication emails go through the configured email service and your inbox; they never contain WhatsApp content.
Your controls
Transcription and group replies start disabled. A workspace owner decides when to enable processing, whether personal-chat replies go privately to their own number or to the original conversation, and whether group replies are allowed.
When group replies are enabled, the output goes to that group and is visible to its participants. Connect only numbers you are authorized to use and ensure an appropriate basis for processing other people’s audio.
Pause processing, disconnect or remove a number, or delete a workspace from its dashboard. Remove owned workspaces before deleting your login from My account. A failed provider cleanup remains visible and retryable; we do not discard the credentials needed to finish it. Deletion cannot recall messages already accepted by a provider.
What this page is—and isn’t
This describes the application’s technical data-handling boundary. It is not a certification of an operator’s deployment or third-party compliance. Before a public launch, the operator must provide its legal identity, contact channel, subprocessors, applicable legal bases, and verified infrastructure and backup policies.