Privacy Policy
AI Reply Assistant for Zoho Desk, by Orovim · Last updated 2 October 2026
This extension generates support replies inside Zoho Desk from your own documents. To do that it reads ticket conversations and sends them to an AI provider that your own agents choose and pay for. This page says exactly what is read, what is stored, and what leaves our systems.
Who we are
Orovim operates this extension. Contact: support@orovim.com.
What we store
| Data | Why |
|---|---|
| Your email address, name and profile picture | To sign you in and show who is using the app |
| A Zoho refresh token, your data centre, and which help desk the connection is for | To read tickets and post replies as you, in the right help desk |
| The AI provider API key you enter | To generate replies on your own account |
| Documents you upload, and pages you link | To answer from your material rather than guessing |
| Your team's reply instructions, tones, and the address replies are sent from | To write in your team's voice, from the address your help desk uses |
| An automation log: organisation, ticket number, the agent whose connection was used, what was done and why, which of your documents were used, the provider and model, and the reply that was written | So an automatic reply can be explained afterwards, and so you can see what was sent while nobody was watching |
| A secret address for automatic replies, one per organisation | So Zoho can tell this extension a ticket has arrived, and nobody else can |
| Feedback you send from settings, with your email address and which help desk you work in | To fix what is not working. Nothing from a ticket is attached to it |
| A short code and your user id while you link this app to a second window | To sign you in there without typing a password again. The code stops working after ten minutes, and the record is removed the moment it is used |
| Request counts per account, removed automatically within two hours, and the IP address of attempts to link a window, removed within minutes | To limit abuse of the service |
What we do not store
Ticket conversations and attachments are read when a reply is requested and are not kept afterwards: not the customer's messages, not the files on the ticket.
The one exception is the automation log. When a reply is written with no agent watching, the log keeps the reply itself, so you can see afterwards what your help desk said in your name. It never holds the customer's message.
Where your data goes
- Google Cloud (Firebase): our servers, database and file storage, hosted in the United States.
- The AI provider your agent chooses: Google (Gemini), OpenAI, Anthropic (Claude) or Groq. Ticket text, attachments and the relevant parts of your documents are sent there to generate a reply. That provider's own terms and privacy policy apply to the request, made on your own API key.
- Google (Gemini embedding API), on our own key: whichever provider generates the reply, your uploaded documents, linked pages and each ticket's question are sent to Google's embedding model so the right passages can be found. Google's terms apply to that request; it is not used to train their models.
- Zoho: replies and notes the agent chooses to post are written back to your help desk.
We do not sell data, share it with advertisers, or use your tickets or documents to train any model.
Your API keys
Provider API keys are stored so replies can be generated without asking for the key on every ticket. They are encrypted before they reach our database (AES-256), with the encryption key held separately in Google Secret Manager, so a copy of the database alone cannot reveal them. They are never shown back in full, and are never sent anywhere except to the provider they belong to. Your Zoho connection token is protected the same way.
Deleting your data
- Settings → Danger zone → Reset my setup deletes your Zoho connection and every API key you have saved.
- Settings → Danger zone → Erase everything additionally deletes your organisation's uploaded documents, linked pages, reply instructions, tones and automation settings.
- Settings → Danger zone → Delete my account deletes your sign-in itself, along with your own documents, linked pages and saved keys.
- Two things outlive all three, on purpose: the automation log, so an automatic reply can still be explained, and the secret address Zoho sends new tickets to, so a reinstall does not need reconfiguring in Zoho. Email support@orovim.com to have those removed as well.
- Uninstalling the extension removes its access to your help desk.
- To have all remaining data deleted, email support@orovim.com and we will do it within 30 days.
How long we keep things
Credentials, documents, settings, the automation log and the secret address for automatic replies are kept until you delete them or ask us to. Request counters delete themselves within two hours. A linking code is removed as soon as it is used, and stops working after ten minutes either way.
Children
This is a business tool and is not directed at anyone under 16.
Changes
If this policy changes materially we will update the date above and note the change on the Marketplace listing.