This Privacy Policy explains how VZENN LABS PRIVATE LIMITED ("Vzenn", "we", "us") collects, uses, shares, and protects personal data when you use the Vzenn platform — our web app, mobile apps, and related services (together, the "Service"). Vzenn is a workplace platform that combines HR, projects, a knowledge base, and chat, calls, and meetings. We take a data-minimising, purpose-limited approach: we collect what the Service needs to work for your organisation, and nothing we cannot explain here.
1. Who this policy covers
Most people use Vzenn because their employer or organisation (the "Customer") has adopted it. For workspace content and HR records, the Customer is the data controller and Vzenn acts as a data processor on their instructions — how those responsibilities are split is set out in our Data Processing Addendum. For our own account, billing, and website data — and for external guests who join a meeting by link — Vzenn is the controller, and this Policy governs.
2. Data we collect
Account & profile
Name, work email, password (stored only as a salted hash), profile photo, role, department, timezone, and language preference.
Workspace & HR data (on the Customer's instructions)
Depending on which modules your organisation uses: attendance and shift punches, leave and overtime records, probation status, payroll and full-and-final settlement inputs, project tickets and comments, knowledge-base documents, and the files you upload.
Communications content
Chat messages, direct messages, reactions, in-meeting chat, and shared files. Message content is stored so conversations persist across your devices.
Calls, meetings & derived data
Meeting metadata (participants, join/leave times, duration) and, only where your organisation has enabled the feature and consent has been captured, call recordings, transcripts, and AI-generated summaries. See section 6.
Connected calendars
If you connect a Google or Microsoft calendar, we store OAuth access and refresh tokens (encrypted at rest) and the calendar data needed to show your availability and mirror your Vzenn meetings. See section 7.
Device & technical data
IP address, device and browser type, operating-system version, app version, push-notification tokens (APNs/FCM), and diagnostic logs. We use these to deliver notifications, keep the Service secure, and debug problems.
3. How we use data
- To provide, maintain, and secure the Service.
- To deliver messages, notifications, calendar invites, and meeting reminders.
- To generate the features your organisation has enabled — such as transcripts and AI meeting summaries.
- To authenticate you and prevent fraud, abuse, and unauthorised access.
- To provide support, and to improve reliability and performance using aggregated, non-identifying diagnostics.
- To comply with legal obligations and enforce our Terms.
We do not sell personal data, and we do not use your workspace content or communications to train general-purpose AI models.
4. Legal bases (EEA/UK) & India (DPDP)
Where the GDPR or UK GDPR applies, we rely on: contract (to provide the Service to you and your organisation); legitimate interests (to secure, debug, and improve the Service, balanced against your rights); consent (for features such as call recording and AI notes, captured before capture begins and withdrawable); and legal obligation. Where India's Digital Personal Data Protection Act applies, we process personal data for the lawful purposes described here, with the consents required by that Act.
5. AI features
When your organisation enables AI notes, meeting audio is transcribed and summarised using trusted subprocessors (see section 8). AI output can be inaccurate or incomplete and should not be relied on as a verbatim or authoritative record. AI features are off unless enabled, are disabled automatically for end-to-end encrypted meetings, and are surfaced with an in-meeting indicator so participants know when they are active. Content sent to our AI subprocessors is processed to produce your output only and is not used to train their models.
6. Calls, meetings, recordings & consent
Vzenn carries audio/video through a self-hosted media server, so call media is not handed to a third-party calling vendor. Recording, live captions, and AI summaries are optional and controlled by your organisation and the meeting host.
- When any capture is active, participants see a clear indicator, and an affirmative-consent step is presented before capture begins.
- Hosts can turn capture off; enabling end-to-end encryption for a meeting hard-disables recording, captions, and AI notes, because the media is opaque to our servers.
- Recordings, transcripts, and summaries are access-scoped to authorised participants. Transcripts and AI summaries can be deleted on request; recordings are removed automatically under a fixed retention schedule.
You are responsible for meeting the recording and consent laws that apply to you and your participants, including where guests join from other jurisdictions.
7. Connected calendars
Connecting a Google or Microsoft calendar is optional and initiated by you. With your authorisation we request the minimum scopes needed to (a) read your free/busy and events to help schedule meetings and show availability, and (b) create, update, and remove the Vzenn meetings you organise on your calendar. OAuth tokens are encrypted at rest, are used only for these purposes, and are never shared. You can disconnect a calendar at any time from your settings, which revokes our access and removes the stored tokens. Vzenn's use of information from Google APIs adheres to the Google API Services User Data Policy, including the Limited Use requirements.
9. International transfers
Our primary hosting and data storage are in India (DigitalOcean, Bangalore region). Some subprocessors process data outside India — for example, speech-to-text transcription and AI summaries are processed in the United States. Where personal data is transferred across borders, we rely on appropriate safeguards, such as the EU Standard Contractual Clauses and equivalent mechanisms, and comply with applicable Indian data-protection requirements.
10. Retention & deletion
We retain personal data for as long as your organisation's account is active and as needed to provide the Service, then delete or anonymise it within a commercially reasonable period, unless a longer period is required by law. Your organisation can configure retention for AI summaries and transcripts, and can trigger deletion on request — including the erasure of a specific meeting's transcript and AI summary. Call recordings are retained for a fixed retention period (currently 30 days) and then automatically deleted. On account termination we delete or return Customer data as described in the DPA.
11. Security
We protect data with encryption in transit (TLS) and at rest, scoped and token-gated access to files, least-privilege access controls, audit logging, and optional end-to-end encryption for meetings. No system is perfectly secure, but we work to protect your data and to notify the Customer promptly of any personal-data breach as required by law.
12. Your rights
Depending on where you live, you may have rights to access, correct, delete, port, or restrict the processing of your personal data, and to object to certain processing. Because your employer usually controls workspace and HR data, please direct those requests to your organisation; we will assist them as required. For data where Vzenn is the controller, contact us at [email protected]. You also have the right to complain to your local data-protection authority.
14. Children
Vzenn is a workplace tool and is not directed to children. We do not knowingly collect personal data from anyone under the age of 18.
15. Changes to this policy
We may update this Policy from time to time. When we make material changes, we will update the "Last updated" date above and, where appropriate, notify you or your organisation.
16. Contact us
VZENN LABS PRIVATE LIMITED, 2nd Floor, 1-6-141/7/3/B10, Rajeevnagar, Vidyanagar, Suryapet, Telangana 508213, India.
Privacy enquiries: [email protected]. A Data Protection Officer / EU representative is not currently appointed.