Privacy

Last updated 17 October 2026

Zula is an assistant you talk to on WhatsApp. You tell it about your money, your household and the things you need done, so it ends up holding personal details. This page explains, in plain language, what we collect, why, who else touches it, how long we keep it, and how you can see it, change it or delete it.

1. Who we are

Zula is built and run by GARVITECH Solutions Private Limited, a company registered in India with its registered office at Pottayath House, Meloor, Poolani, Chalakudy, Koovakkattukunnu, Mukundapuram, Thrissur, Kerala 680311. In this policy, "Zula", "we" and "us" mean GARVITECH Solutions Private Limited, and "you" means anyone who uses Zula or joins the waitlist on heyzula.com.

For the purposes of India's Digital Personal Data Protection Act, 2023, we are the Data Fiduciary for the personal data described here.

2. What we collect and why

Each item below is listed with the reason we need it. We do not use any of it for a purpose that is not listed here.

When you join the waitlist

When you use Zula on WhatsApp

Some of what you tell Zula is about other people, such as a friend you lent money to. Please share only what you need to, and only the way you would note it in your own diary.

When you pay for Zula

If you buy a subscription, payment is handled on our website by a licensed payment provider. We receive only the result of the payment (paid or failed, amount, date and a reference number). We never see or store your card, UPI PIN or bank login.

3. What we never do

• Sell, rent or trade your personal data.
• Show you third-party ads, or share your data with advertisers. (Offers from an app you have linked are shown only for things you buy, and only if you turn them on.)
• Use your messages or records to train AI models, whether ours or anyone else's.
• Read your SMS inbox, contacts, call log, photo gallery or location. Zula only sees what you send it.
• Message, call or email the people you mention.
• Move money or pay anyone on your behalf.
• Place an order or booking without first showing you the items and total and getting your confirmation in the chat.

4. How AI is used

Zula uses AI language models to understand what you mean, for example that "gave 500 to Ravi" is a loan, or which category a spend belongs to. These models are provided by Anthropic and OpenAI. When Zula needs them, the relevant part of your message (and, where needed, a little recent context) is sent to them for processing.

• Both providers process this data for us under terms that prohibit them from training their models on it, and they keep it only for a limited period for safety and abuse monitoring.
• We send the minimum needed for the request. We do not send your full history.
• Totals, balances, budgets and who-owes-whom are calculated by Zula's own code, not by the AI, so the numbers you see come straight from your records.
• Zula can still misunderstand you. Every entry is shown back to you so you can correct it.

5. Linked apps and orders

You can connect Zula to apps such as Swiggy, Zomato and Zepto so it can search, build a cart and place an order or reservation for you. Linking is optional, and you sign in on the app's own page. Zula never sees your password for that app.

Your choices when you link an app

When you link an app, Zula asks you separately about each of these. Each one is optional, and linking works without them:

• Order logging: save your orders to your Zula ledger.
• Suggestions: use your order history and patterns for reorder suggestions, relevant offers and insights.
• Reorder reminders: let Zula message you first when something is usually due for a reorder.

You can change any of these at any time by telling Zula, for example "stop reorder suggestions" or "turn off order logging".

• We use data from a linked app only for the purposes above that you have turned on: placing your orders, reorder suggestions, relevant offers, your ledger and your own insights.
• To improve Zula's features, we may also study aggregated, anonymised ordering patterns across users, such as how often groceries are reordered in general. This never identifies you, and your individual data is never shared or sold.
• We never sell app data, never use it for third-party advertising, and never use it to train AI models.
• We do not keep the app's search results or menus beyond the conversation that needed them.
• Type "unlink Zepto" (or the app's name) at any time. We delete the token straight away, and the order history and patterns we hold from that app within 30 days. Orders already saved to your ledger stay there as your own records unless you delete them. You can also remove Zula's access from inside the app.
• If you delete your account with that app, or ask us to, we delete the data we hold that came from it.
• Your order itself is between you and the app. Their own privacy policy covers what they do with it (for example, Swiggy, Zomato, Zepto). To see, correct or delete data the app holds, use that app.

6. Who we share data with

We share personal data only with the service providers that help us run Zula, only for the purposes in this policy, and under contracts that require them to protect it.

We may also disclose data if Indian law requires it, for example in response to a valid order from a court or government authority, or to protect someone's safety. If the company is ever merged or sold, your data would move only under the same protections, and we would tell you first.

7. Where your data is stored

Your records are stored on servers in India. Some of our providers, including the AI providers, process data outside India, mainly in the United States. When that happens we send only what the request needs, and we rely on the provider's contractual protections. Transfers outside India are made only to countries the Government of India has not restricted.

8. How long we keep it

Anonymous usage counts (for example, how many messages Zula handled in a month) contain nothing that identifies you and may be kept longer.

9. How we protect it

• All data is encrypted in transit. Linked app tokens are additionally encrypted at rest.
• Access to production data is limited to the people who run Zula, and only to fix a problem you raised or keep the service running.
• Our logs record technical events, not your message content.
• Your personal and business records, and each user's data, are kept strictly separate.

No system is perfectly secure, but we treat your data the way we would want our own treated.

10. Your rights

Under the Digital Personal Data Protection Act, 2023 you have the right to:

• See your data. Ask Zula for a summary or report in chat, or email us for a full copy of what we hold and who we have shared it with.
• Correct it. Tell Zula ("that was 450, not 540"), or email us.
• Delete it. Delete any entry in chat, or type "delete everything" to erase your account and all your records. This cannot be undone.
• Withdraw consent. Stop using Zula, unlink an app, turn off reminders or tips, or delete your account. Withdrawing is as easy as giving consent. It does not affect what was done before you withdrew.
• Nominate someone to exercise these rights for you if you die or become unable to.
• Raise a grievance with us (see section 15). If you are not satisfied with our answer, you can complain to the Data Protection Board of India.

We reply to requests within 30 days, and resolve grievances within the 90 days allowed by law.

11. Children

Zula is for people aged 18 and over. We do not knowingly collect data from anyone under 18. If you believe a child is using Zula, write to us and we will delete the account.

12. Cookies and the website

heyzula.com does not use advertising or tracking cookies. We count visits with Cloudflare Web Analytics, which does not use cookies and does not track you across other sites.

13. If something goes wrong

If a security incident affects your personal data, we will tell you without delay in WhatsApp or by email: what happened, what it means for you, and what we are doing about it. We will also report it to the Data Protection Board of India and CERT-In as the law requires.

14. Changes to this policy

We will update this page as Zula grows. If a change affects how we use data you have already given us, we will tell you in the chat before it takes effect and, where the law requires, ask for your consent again. The date at the top always shows the latest version.

15. Contact and grievances

For any question, request or complaint about your data, contact our Grievance Officer:

Please write from the email address or WhatsApp number linked to your account, so we can verify it is you.