Privacy & data handling

This page covers two separate things, and they should not be confused: (A) how this marketing website handles information from visitors — the binding policy for this site; and (B) a plain-language summary of how the Zahen product handles a customer's data once deployed, which is a transparency description, not the contract. The binding data-protection terms for the product are set out in your customer agreement / DPA with Toobler, not here.

Overview

This website is operated by Toobler Technologies Pvt Ltd ("Toobler"), registered at 1st Floor, Lulu Cyber Tower-1, Infopark, Kochi, Kerala, India – 682042, which provides the Zahen governed agentic AI platform. For information collected through this website, Toobler is the data controller. Where this page summarises how the Zahen platform handles customer data, that handling is governed by your agreement / DPA, not this page.

Information we collect (this website)

We only collect what you choose to send us, plus the minimum needed to run the site:

• Enquiry-form details — your name, work email, company, role, company size, workflow of interest, and any message you include when you book a readiness workshop or contact us.
• Standard server logs and analytics/cookies — see "Analytics & cookies" below.

We do not sell personal data, and we do not collect anything beyond the above on this marketing site.

How we use it (this website)

We use enquiry details to respond to you, schedule and run your readiness workshop, and to operate and secure the site. Our lawful basis for this processing is our legitimate interest in responding to an enquiry you chose to send us; we do not use these details for marketing without a separate opt-in. We retain enquiry details until your enquiry is resolved and the related opportunity is closed, plus 12 months. Form submissions are processed through our hosting and forms provider, Netlify.

Analytics & cookies

This site uses Google Analytics 4 (via gtag.js; we do not use Google Tag Manager) to understand aggregate usage and improve the site. Analytics cookies are set only if you accept them via our cookie banner — you can decline, and change your choice at any time using "Cookie preferences" in the footer. We do not use advertising or cross-site tracking cookies, and you can also control cookies through your browser settings.

How the Zahen platform handles your data (product)

The following describes the product for transparency. It is a summary, not a contract — the binding terms are in your agreement / DPA.

• Dedicated and single-tenant. Zahen runs as a dedicated instance per customer. Your documents and their embeddings stay inside your own instance — they are not pooled into, or shipped to, a shared multi-tenant service. Private and dedicated deployment options (including data-residency arrangements) depend on the deployment chosen with the customer.
• Access is filtered before retrieval. Knowledge is filtered by role and department before a search runs (not filtered after the fact); documents carry access levels (public, employee, department, restricted).
• Agents never hold credentials. The platform brokers every external call through a secure secret store, scoped to only the keys a plugin declares; secrets and personal data are redacted in logs.
• Append-only audit trail. Every step, tool call, and approval is recorded — who, what, and when — in its own transaction that is never edited or deleted, and can be exported to CSV. PII-heavy content (such as support-ticket bodies) is masked in the trail.
• Human-in-the-loop. High-risk actions pause for a human decision (five outcomes), and no one can approve their own request — this rule cannot be overridden.
• Retrieved content is reference, not instructions — it can inform an answer but cannot redirect the agent's behaviour (prompt-injection isolation).
• Authentication uses MFA (TOTP) with hashed passwords and short-lived tokens; roles are re-loaded from the database rather than trusted from the token. (Single sign-on is not currently offered.)

Sub-processors

To deliver the product we rely on a small number of service categories. The specific providers are selected per deployment with the customer, not fixed for everyone:

• A model (LLM) provider. To generate an answer, the platform sends your query together with the retrieved document snippets to the model provider configured for your deployment. Customer data is not used to train the model provider's foundation models, in line with that provider's enterprise terms.
• Cloud hosting and managed database. Used to run the deployment, again selected per deployment with the customer.

The providers and regions used for a given deployment, and any sub-processor list, are provided as part of that deployment's documentation / agreement rather than a single public list. Customers are notified of changes through that agreement.

Data-protection regimes

Zahen provides deployment support aligned to the regional data-protection and compliance frameworks applicable to your organisation and deployment region. This is deployment support, not a guarantee of compliance, and not a certification; data-protection obligations remain with your organisation and counsel. See Security & Governance.

Your choices & requests

Website data: to access, correct, or delete an enquiry you submitted to this site, contact us at [email protected]. We will respond within 30 days, after verifying your identity.

Platform data: where Zahen processes data inside a customer's deployment, the customer is the controller of that data and Toobler acts as processor; requests from a customer's own users are handled through that customer. The detailed process is set out in the customer's agreement / DPA.

Changes & contact

We may update this page from time to time; material changes will be reflected in the "Last updated" date above. For any privacy or data-handling question, contact [email protected], or write to Toobler Technologies Pvt Ltd, 1st Floor, Lulu Cyber Tower-1, Infopark, Kochi, Kerala, India – 682042.

This page describes the marketing website and summarises how the Zahen platform handles data; it is not the contract. The binding data-protection and commercial terms are set out in your agreement with Toobler.