Legal
Privacy Policy
One policy for every Zocton product. It describes what each one actually collects, who it is sent to, and what we have not built yet — not what would sound best.
Last updated 10 October 2026
Who we are, and what this covers
Zocton is a family of business software operated by TwoDots. This policy covers the Zocton website at www.zocton.com, the identity service Zocton Accounts, the Zocton Dashboard, and the Zocton modules TurboWorkflow, PaceForms, Entayo CRM and ZuvoChat.
The data controller is Twodots Software Services OPC Private Limited, a company registered in India, whose registered office is:
H-6050, Solitaire Business HubViman NagarPune 411014IndiaOur company website is 2dots.io. For anything about this policy, or to use any of the rights below, write to privacy@zocton.com.
TraceFlow is listed on this site as a module but is not yet available. It has no application, no accounts and no data, and nothing in this policy applies to it until it launches.
The Zocton modules are not one uniform system, and it would be misleading to describe them as one. TurboWorkflow, PaceForms, Entayo CRM, ZuvoChat and the Zocton Dashboard sign you in through Zocton Accounts. The sections below say which product is being described every time it matters.
When we are the controller, and when we are only the processor
For your own account — your name, your email address, your sign-in, your billing — we are the data controller.
For the people you put into a Zocton product, you are the controller and we are your processor. That covers the contacts you import into TurboWorkflow and the people you email through it, the people who fill in a form you built with PaceForms, the contacts and companies you keep in Entayo CRM, and the visitors and customers who talk to you through ZuvoChat. We handle their data on your instructions, to run the product for you. Deciding that you have a lawful basis to hold those contacts, and telling those people what you are doing with their data, is yours to do — not ours.
What each product collects
Zocton Accounts — the sign-in behind most of the modules
Your name, email address, and the profile picture URL from Google if you sign in that way. A password, stored only as a hash, if you sign in with one. A phone number if you give one. A WhatsApp number and the date it was verified, if you complete WhatsApp verification. The region you chose for your workspace, and your workspace address.
Each sign-in also records a session with the IP address and browser user-agent it was created from, and it expires after seven days.
When a workspace address is released it is permanently reserved and never re-issued to anyone else, and the record of that reservation is deliberately kept even if the account that held it is removed. This is to stop a released address being claimed by a stranger.
Where you were already a TurboWorkflow customer, a Zocton account may have been created for you as part of moving TurboWorkflow onto Zocton Accounts, carrying across the name, email address, password hash and WhatsApp verification you already had with us. No new information was collected to do it.
Zocton Dashboard
It stores nothing. The Dashboard has no database. It reads your name, email address and picture out of the sign-in token in order to draw the page, and keeps none of it.
TurboWorkflow
Your account: name, email address, password hash, and — if you buy something — a billing profile with your phone number, company name, GSTIN and address. Payment records, invoices and coupon use.
Your contacts: everything you import or add — email address, first and last name, company, time zone, LinkedIn profile URL, and any custom fields in your own import file. Whether each contact has unsubscribed, bounced or been paused.
The mail itself: TurboWorkflow stores the full subject and body of every email it sends for you, together with the recipient address and the delivery outcome, plus a timeline of what happened to each contact and each sending account.
LinkedIn: where you connect LinkedIn, the invitations, messages and comments it sends on your behalf are stored, along with their outcome.
PaceForms
Your account: name, email address, username, profile picture, password hash, and billing and credit records.
Form submissions: every answer submitted to a form you built, together with the submitter's IP address, browser user-agent and referring page. Files uploaded through a form are held on our own servers, encrypted, and can be downloaded only by the form's owner.
Entayo CRM
Your account: name, username, email address, your role, and the link to your Zocton account.
Your contacts and companies: everything you import or add — names, job title, email addresses, phone numbers, social profile links, city, country, time zone, the company and its details, map coordinates, free-text notes, and any custom fields you create. A timeline of the emails, messages, calls, meetings and notes you log against each record, and the follow-up tasks you set. Files you attach to a record, up to ten megabytes each.
ZuvoChat
Your account and your team: name, email address, phone number, profile picture and the name shown to visitors in chat.
The people who contact you: the name, email address and phone number a visitor gives, and the identifier of any messaging channel they write from. Every chat message and every email, in full, with attachments and voice notes. When a message is edited or deleted, its earlier text is kept so that the conversation can be audited.
The chat widget on your website sets no cookies and does not record a visitor's IP address, location or device. It keeps a random visitor identifier, and the widget's own display settings, in the visitor's browser storage so that a returning visitor sees their own conversation.
Where your data is kept
When you create a Zocton workspace you choose a region — North America, Europe or Asia Pacific — and TurboWorkflow, PaceForms, Entayo CRM, ZuvoChat and the Zocton Dashboard serve your workspace from that region's servers and database.
Zocton Accounts is the exception, and it is a permanent one. Identity is central: Zocton Accounts runs in Europe only, whichever region you chose. So your name, email address, password hash, phone and WhatsApp numbers, sign-in sessions and the IP addresses attached to them are held in Europe, even for a workspace in North America or Asia Pacific. Your region choice governs where the products run and where their data sits — it never moves your identity record out of Europe.
Signing in, and WhatsApp verification
You can sign in with an email address and a password, or with Google. Signing in with Google asks Google only for your basic profile and email address —never for access to your Gmail. TurboWorkflow also supports signing in with a Microsoft account.
WhatsApp verification runs in reverse, deliberately. We show you a six-digit code and you send it to us on WhatsApp. We never message you first, and there is no code in our products that can. To match your message to the code we read the recent messages of that one chat. We keep your number and the date it was verified; the code itself is stored only as a hash and the challenge is deleted within a day of being used or expiring.
Connecting your mailbox to TurboWorkflow
TurboWorkflow sends from your own mail account, so it asks that provider for permission. This is the part of Zocton with the widest access to anything of yours, so it is worth stating exactly.
| Provider | What we ask for | What we actually do with it |
|---|---|---|
| Google Gmail | Send mail; read mail; modify mail and labels | Send your messages. Read back the message identifier of the message we have just sent, so we can track it. Create a “TurboWorkflow” label and file the sent copy under it. We do not read your inbox and we store no message we did not send. |
| Microsoft Outlook | Read your profile; send mail; read and write mail | Read your email address and display name. Send your messages. Find the sent copy and move it into a “TurboWorkflow” folder. We do not read your inbox. |
You can disconnect a sending account at any time in TurboWorkflow, and you can revoke our access from your Google or Microsoft account settings independently of us.
The permission we hold is broader than the use we make of it. Google's permission to read mail is requested for one narrow lookup on messages we have just sent, and Microsoft's read-and-write permission is used only to move a sent copy between folders. We are saying so plainly rather than describing the permission as narrower than it is.
Email tracking in TurboWorkflow
Every email TurboWorkflow sends carries an invisible one-pixel image, and every link in it is rewritten to pass through us before going on to its destination. That is how opens and clicks are reported back to you.
When a recipient opens or clicks, we record:
- the time,
- the browser or mail client user-agent string,
- and, for a click, which link was clicked.
We do not record the recipient's IP address and we do not work out their location.
Tracking cannot currently be switched off. There is no setting in TurboWorkflow, at any level, that sends an untracked email. If you need to send without tracking today, TurboWorkflow is not the tool for that message. We would rather say this than let you assume a switch exists.
Every email also carries an unsubscribe link, and it cannot be removed. A recipient who unsubscribes is suppressed for that sender, and a recipient whose address hard-bounces is suppressed permanently.
Form submissions in PaceForms
When somebody fills in a PaceForms form, we store their answers along with their IP address, user-agent and referring page. The IP address is kept so the form's owner can identify abuse and duplicate submissions.
A submission may also leave our systems immediately, on the form owner's own instructions: PaceForms emails the submission to the addresses the owner chose, using the owner's own mail server if they configured one, and posts the submission to any webhook address the owner set up. Where those go is the form owner's decision, not ours.
If you filled in a form and want your submission removed, contact the organisation whose form it was. They control it, and they can delete it. We will help them do so.
Artificial intelligence
TurboWorkflow can draft emails for you with an AI model. This only happens when you ask it to, and only when you have supplied your own API key for the provider you want — Anthropic, OpenAI, Google Gemini, xAI, z.ai or DeepSeek. When you use it, the fields of the contact the message is for are included in the prompt sent to that provider. Your agreement with that provider governs what they then do with it.
ZuvoChat can summarise a conversation and draft FAQ answers from a document with an AI model. This only happens when a member of your team clicks to ask for it. For a summary, the messages they picked are sent; for an FAQ draft, the text of the document. It goes through OpenRouter by default, or through OpenRouter, OpenAI or Anthropic on your own API key if you add one. A summary can also be made without any AI service at all. Nothing an AI drafts is saved until a person accepts it. ZuvoChat's chat bots follow rules you set and do not use AI.
Entayo CRM has no AI built in. If you create an API key and connect an AI tool of your own to it, that tool reads and writes your CRM data on your instructions, under your agreement with its provider.
PaceForms, Entayo CRM, Zocton Accounts and the Zocton Dashboard send nothing to any AI service.
Who else your data reaches
We do not sell personal data, and we do not share it for anyone else's advertising. These are the outside services the products actually send data to, and what each one receives.
| Service | Used by | What it receives |
|---|---|---|
| All products | Sign-in. For a TurboWorkflow Gmail sender, the messages it sends for you | |
| Microsoft | TurboWorkflow | Sign-in, and the messages an Outlook sender sends for you |
| Cloudflare | All products | Serves and protects every Zocton address. Holds the map from a workspace name to its region |
| Unipile | TurboWorkflow | Your LinkedIn sign-in details, and the invitations and messages it sends for you |
| Brevo · Amazon SES | TurboWorkflow | Recipient addresses and campaign content, for bulk campaign sending |
| Cloudflare R2 | TurboWorkflow | Images, attachments, invoices and account backups |
| Razorpay · Dodo Payments | TurboWorkflow | Your name, email address and phone number, to take payment |
| Paddle | PaceForms | Your email address, to take payment |
| Cloudflare Turnstile | PaceForms | An anti-spam check on submissions to forms where the owner turned it on |
| Cloudflare R2 | Entayo CRM | Files you attach to a record, and images in campaign emails |
| OpenStreetMap | Entayo CRM | The place names you search for on the map. Your browser loads the map itself from OpenStreetMap |
| cdnjs | Entayo CRM | Your browser loads the map's marker images from it |
| OpenRouter · OpenAI · Anthropic | ZuvoChat | Only when your team asks for an AI summary or FAQ draft — see above |
| Postmark or SendGrid | ZuvoChat | Email sent to your support address, where you route it through one of them |
| Meta WhatsApp · Telegram · Twilio | ZuvoChat | Messages to and from the people who write to you, on the channels you connect |
| AI providers you choose | TurboWorkflow | Only when you ask for an AI draft, using your own key — see above |
Your own outgoing mail server, if you configure one in TurboWorkflow, PaceForms, Entayo CRM or ZuvoChat, also receives whatever those products send through it. That server is yours, not ours.
We may also disclose personal data where the law requires it, and to professional advisers or an acquirer in connection with a sale or reorganisation of the business.
Cookies, and this website
www.zocton.com — the site you are reading — sets no cookies at all. It loads no analytics, no advertising and no third-party script of any kind. Nothing about your visit is sent to anyone. The only thing kept in your browser is the record of the privacy choice below, and it never leaves your device.
You can set that choice at any time with the control, which is in the footer of every page. Analytics and marketing are off until you turn them on, and nothing in either category will load while they are off. There is nothing in either category today; the choice is honoured in advance of there ever being.
The Zocton products themselves set these cookies, and no others:
| Cookie | What it is for | How long |
|---|---|---|
| Session | Keeps you signed in. Cannot be read by scripts | 7 to 30 days, depending on the product |
| Sign-in flow | Carries a sign-in safely from one step to the next | Ten minutes or less |
| Theme | Remembers light or dark and your accent colour across Zocton products. Holds no identifier of any kind | One year |
| Selected project | TurboWorkflow and Entayo CRM — remembers which project you had open | One year |
| Form prefill | PaceForms only — carries hidden field values out of a form's address | Two minutes |
None of these is an analytics or advertising cookie, and no Zocton product carries an analytics or advertising script. Where you pay through Razorpay, that checkout runs in your browser and may set its own cookies under Razorpay's own policy.
Our legal basis for using your data
If you are in the United Kingdom, the European Economic Area or Switzerland, the UK GDPR and the EU GDPR give us these bases:
| Why we process it | Basis |
|---|---|
| Running the product you signed up for | Performance of a contract |
| Taking payment, and keeping the records tax law requires | Contract, and legal obligation |
| Keeping accounts secure and stopping abuse | Legitimate interests |
| Verifying a WhatsApp number | Legitimate interests |
| Handling the contacts and submissions you put into a product | We act on your instructions as your processor; the basis is yours |
| Anything in a category you switch on under Privacy choices | Consent, withdrawable at any time |
How long we keep it
We would rather tell you what we actually do than publish a schedule we do not enforce.
| What | How long |
|---|---|
| Sign-in sessions | Seven to thirty days depending on the product, and immediately on signing out |
| WhatsApp verification challenges | Deleted within a day of use or expiry |
| TurboWorkflow, Entayo CRM and ZuvoChat account backups | The most recent thirty |
| Entayo CRM and ZuvoChat, once your Zocton account is deleted | Everything they hold for the account is erased |
| TurboWorkflow uploads no longer referenced | Thirty days |
| A deleted TurboWorkflow account | Fourteen days, then everything is destroyed |
| Your account and its contents, otherwise | Until you ask us to delete it |
Two things we have not built, said plainly. Outside TurboWorkflow's fourteen-day deletion, no Zocton product deletes your data on a timer — contacts, sent mail, form submissions and chat conversations are kept until you or we remove them. And outside TurboWorkflow, there is no button that deletes your account: ask us at privacy@zocton.com and we will do it by hand.
Both are on our list to fix. Until they are, this paragraph is the accurate description and we are not going to replace it with a nicer one.
Your rights
Under the UK and EU GDPR, and comparable laws elsewhere, you can ask us to:
- tell you what personal data we hold about you, and give you a copy;
- correct it where it is wrong;
- delete it;
- restrict or object to what we are doing with it;
- provide it in a portable form;
- and withdraw a consent you gave, without affecting what was lawful before.
Email privacy@zocton.com and we will answer within one month. We will not charge you, and we will not make you give a reason.
Some of this is quicker to do yourself: TurboWorkflow can delete your account from within the product, PaceForms can export a form's submissions as a spreadsheet, and you can edit your own profile in Zocton Accounts. TurboWorkflow's backup file is for restoring into TurboWorkflow and is not readable outside it — ask us if you want a readable copy of your data, and we will produce one.
If you are one of our customers' contacts — you received a TurboWorkflow email, filled in a PaceForms form, are a contact in someone's Entayo CRM, or talked to a company through ZuvoChat — the organisation that contacted you controls that data and should be your first stop. Tell us and we will pass it to them and help. Every TurboWorkflow email also carries an unsubscribe link that works immediately, without contacting anybody.
You can also complain to your data protection authority. In the EU that is the supervisory authority where you live; in the UK it is the Information Commissioner's Office.
Data leaving Europe
Zocton Accounts is in Europe. Your workspace is in the region you chose, which may be North America or Asia Pacific — that is your choice and it is shown to you when you make it.
Several of the services listed above operate outside the European Economic Area, including in the United States and India. Where personal data reaches them, it is transferred on the basis of the European Commission's Standard Contractual Clauses or an adequacy decision, as each provider's own terms set out.
Security
Passwords are stored only as hashes and are never recoverable, by us or by anyone. Everything travels over TLS. Uploaded files in PaceForms are encrypted where they are stored. Access to production systems is limited to people who need it.
No system is perfectly secure, and we are not going to claim otherwise. If a breach affects your personal data we will tell the relevant supervisory authority within 72 hours where the law requires it, and we will tell you where the risk to you is high.
Children
Zocton is business software and is not meant for children. We do not knowingly collect personal data from anyone under 16. If you believe a child has given us data, write to privacy@zocton.com and we will delete it.
Changes to this policy
When this policy changes, the date at the top changes with it. Where a change materially affects you we will tell you inside the product or by email before it takes effect.
Contact us
Write to privacy@zocton.com about anything in this policy, or to use any of the rights above.
Twodots Software Services OPC Private LimitedH-6050, Solitaire Business HubViman NagarPune 411014India