ZAKORAPrivacy Policy
Last updated November 13, 2026
Short version: Zakora is software that creators use to answer their Instagram messages and manage their leads. We process data only to run that service for them. We never sell personal data and never use it for advertising. Anyone can ask for their data to be deleted.
Who we are
Zakora ("Zakora", "we", "us") is operated by Zakora AI, based in Florida, USA. It provides the website zakora.ai and the Zakora app at app.zakora.ai. Contact: admin@zakora.ai.
Two kinds of people
- Customers: creators and businesses that sign up for Zakora, and their team members. For their account data, Zakora is the controller.
- Their contacts: people who message, comment on or buy from a customer (for example, someone who DMs a creator on Instagram). For this data, the customer is the controller and Zakora processes it on the customer's behalf and following their instructions. Each customer is responsible for their own privacy notice to their contacts.
What we collect
- Account data: name, email, password (stored hashed by our authentication provider), workspace name, team members and their roles, and the settings a customer enters (offers, prices, links, tone, keywords).
- Instagram data: when a customer connects an Instagram professional account through Facebook Login for Business, we receive the account's ID and username, the linked Facebook Page ID and name, and an access token. We then receive messages and comments sent to that account, the sender's Instagram-scoped ID, username and name, and timestamps. We do not access followers, insights, ads or posts beyond the comments needed for keyword replies.
- Connected apps: when a customer connects Whop, we receive their products, memberships, payments, refunds, disputes and support cases, including buyer names, usernames and emails. We never receive full card numbers.
- Leads and notes: what customers and their teams record about contacts, such as stage, score, notes and form answers.
- Technical data: our hosting provider logs IP addresses and request details for security. Zakora uses no advertising pixels, analytics trackers or tracking cookies. The only browser storage is the login session, which is strictly necessary.
How we use it
- To run the service: show messages in the inbox, send the replies and keyword resources the customer set up, organize and score leads, and handle support, refunds and cancellations the customer starts.
- To produce AI drafts, summaries and lead scores for the customer (see below).
- To keep accounts secure, prevent abuse, fix problems and meet legal obligations.
- To contact customers about their account and the service.
We do not sell personal data, share it for advertising, or use contacts' data to train AI models.
AI processing
Zakora uses Anthropic's Claude to draft replies, summarize conversations and rank which leads need a person. The relevant message content and the customer's settings are sent to Anthropic only to produce that output, under Anthropic's commercial terms, which do not allow training on this data. Automated replies are limited to what the customer configured; other replies can be reviewed by a person before sending.
Data from Meta (Instagram)
We use Instagram Platform data only to provide the messaging and comment features the customer turned on, as allowed by Meta's Platform Terms and Developer Policies. We only reply to people who contacted the account first, within the time windows Meta allows. We do not sell, license or transfer Platform data to data brokers or advertisers, and we delete it when the customer disconnects, closes their account or asks us to, or when a contact asks (see Data deletion).
Who we share it with
| Service provider | What for |
|---|---|
| Cloudflare | Hosting, security, email forwarding |
| Supabase | Database and login (United States) |
| Anthropic | AI drafts, summaries and lead scoring |
| Meta | Receiving and sending Instagram messages for connected accounts |
| Whop | Purchases, memberships, refunds and support cases, if the customer connects it |
We may also disclose data if the law requires it, to protect rights and safety, or as part of a merger or sale of the business, in which case this policy continues to apply.
How long we keep it
- Customer workspace data: while the account is active, and deleted within 30 days after the account is closed, except where we must keep records longer by law (for example billing records).
- Instagram tokens: deleted as soon as the account is disconnected.
- Raw webhook logs: deleted after 30 days.
Security
Data is encrypted in transit. Connection keys and tokens are stored encrypted (AES-GCM). Database access is limited per workspace, so a customer's team can only see their own workspace. Refunds, cancellations and deletions are limited to owners and admins and are logged.
Your rights
Depending on where you live (for example California, the EU/UK or other US states), you may have the right to access, correct, delete or get a copy of your data, and to object to or limit some uses. Customers can do most of this in the app. Contacts of a customer should ask that customer first; you can also write to admin@zakora.ai and we will help or pass the request on. We will not discriminate against you for using these rights.
Children
Zakora is for businesses and is not directed to children under 16. We do not knowingly collect their data.
International transfers
Zakora is run from the United States and data is stored in the United States. If you are outside the US, your data will be processed there.
Changes
We will post changes here and update the date above. For significant changes we will notify customers by email or in the app.
Contact
admin@zakora.ai. To delete data, see Data deletion.