Privacy Policy

1. Who we are

This Privacy Policy describes how {EMPRESA} ("we", "ZapZap"), acting as the Data Controller under the Brazilian General Data Protection Law (LGPD, Law No. 13,709/2018), handles the personal information collected while you use the service available at {DOMINIO}.

By using the Service, you agree to the practices described in this document. If you do not agree, you must stop using the platform.

2. Data we collect

We collect the following categories of personal data:

• Sign-up: name, email, phone number (optional), password (encrypted).
• Financial: tax ID (CPF/CNPJ), billing address and payment data (processed by the Stripe and Asaas gateways; we do not store card data).
• Operational: WhatsApp instances created, connected numbers, usage metrics, sending and audit logs.
• Messages and media: content that travels through your WhatsApp instances, processed in transit for delivery through the WhatsApp protocol.
• Automatic reading of conversations (optional): if you turn on the platform's artificial intelligence features, such as automatic support or tracking conversation reading, the content of messages is sent to an AI provider for analysis. Audio may be transcribed and images described in text, and this reading is stored together with the corresponding message. These features come turned off and only work after you turn them on.
• Technical: IP address, device type, browser, operating system, session identifiers and cookies.

3. What we use your data for

• Creating, authenticating and managing your account and instances.
• Processing payments and balance top-ups, and issuing invoices and receipts.
• Running the monthly prepaid billing cycle and low-balance notices.
• Keeping the platform secure and detecting fraud, abuse and violations of the Terms of Use.
• Sending operational communications (suspension, top-up, instance alerts) and, with your consent, marketing and news.
• Complying with legal and regulatory obligations and court orders.
• Improving the product through aggregated, anonymous usage metrics.

4. Legal basis (LGPD)

Data processing relies on the following grounds from Article 7 of the LGPD:

• Performance of a contract (Art. 7, V), for everything involved in providing the Service.
• Compliance with a legal obligation (Art. 7, II), tax, accounting and regulatory.
• Legitimate interest (Art. 7, IX), security, fraud prevention and product improvement.
• Consent (Art. 7, I), marketing communications and optional cookies.

5. Who we share data with

We share strictly necessary data with the processors that make the Service possible:

• Stripe, card payment processing.
• Asaas, PIX and bank slip (boleto) processing.
• Resend, sending transactional emails (notifications, password recovery).
• Infrastructure providers, cloud servers, CDN, backup and media storage.
• WhatsApp/Meta, the content of messages sent through your instances travels through Meta's infrastructure, according to the WhatsApp protocol.
• Artificial intelligence providers (OpenAI and Anthropic), conversation analysis, audio transcription and image description, only when you turn these features on. The content is used to produce the requested reply or analysis, not to train models.
• Competent authorities, when required by law, a court order or a regular administrative request.

Affiliate Program: if you signed up through a referral link or code, we share with the affiliate who referred you your name, email, phone number and account status (sign-up, verification, connection and deposit), in order to follow your activation and provide support. The affiliate may use this data only for that purpose; transfer, sale or use for any other purpose is prohibited. You can ask us to stop this sharing at any time through the contact channels listed in this policy.

We do not sell personal data to third parties for advertising purposes, under any circumstances.

6. Cookies and tracking

We use essential cookies for authentication (JWT token, session), interface preferences and security (CSRF protection). Analytics and marketing cookies, where applicable, depend on your explicit consent.

You can set your browser to block cookies, knowing that blocking essential cookies makes the dashboard unusable.

7. Data retention

• Active account: we keep the data while the account is in use.
• After cancellation: personal data is anonymized or deleted within 90 days, except where the law requires otherwise.
• Financial records: kept for 5 years, in accordance with Brazilian tax legislation.
• Audit logs: kept for 12 months to investigate security incidents.
• Messages and media: stored for as long as needed to operate the instance and deleted within 30 days after the instance is deleted.
• AI-generated transcriptions and descriptions: follow the same retention as the original message and are deleted along with it. A request to delete a contact's data also removes the transcriptions of that contact's conversations.

8. Information security

We apply appropriate technical and administrative measures to protect your data, including:

• Encryption in transit (TLS 1.2+) and at rest for sensitive data.
• Passwords stored with bcrypt hash + salt, never in plain text.
• API tokens with restricted scope and the ability to rotate them.
• Role-based access control, with auditing of administrative operations.
• Firewall, rate limiting and continuous monitoring against abuse.
• Automated backups and a disaster recovery plan.

In the event of a security incident that may put your data at risk, we will notify you and the Brazilian data protection authority (ANPD) within the deadlines required by the LGPD.

9. Your rights (Art. 18 LGPD)

You may exercise the following rights at any time:

• Confirmation that your data is being processed.
• Access to the data we hold about you.
• Correction of incomplete, inaccurate or outdated data.
• Anonymization, blocking or deletion of unnecessary data.
• Portability of your data to another provider.
• Deletion of personal data processed on the basis of consent.
• Information about the entities with which we share your data.
• Withdrawal of consent, where applicable.

To exercise any of these rights, send a request to [email protected]. We will reply within 15 days.

10. Minors

The Service is intended for people aged 18 or over. We do not knowingly collect data from minors. If we identify a sign-up by a minor without valid parental consent, the account will be deleted immediately.

11. International transfers

Some of our processors (e.g. Stripe, Resend, cloud providers and the artificial intelligence providers mentioned in item 5) may store and process data outside Brazil. In these cases, we ensure the transfer takes place to countries with an adequate level of protection or under contractual clauses that preserve LGPD standards.

12. Data Protection Officer (DPO)

For any matter related to the protection of your personal data, contact our Data Protection Officer:

13. Updates to this policy

This policy may be updated to reflect regulatory changes, new services or improvements in transparency. Relevant changes will be communicated at least 15 days in advance by email or through the dashboard. The date of the last update is always at the top of this document.