Privacy Policy

1. Who we are and our role

Businesses (our customers) use ZTalk to serve their own customers over WhatsApp, Instagram, Messenger, Telegram and website chat.

• Customer account data (sign-up, billing, panel usage): Zmais.tech is the controller.
• Conversations, contacts and media of each business's end customers: the business is the controller and Zmais.tech acts as a processor, handling that data only to provide the contracted service and following the business's instructions.

2. Data we process

• Account: name, email, phone, password (stored only as a hash), profile photo and team.
• Billing: name or company name, tax ID (CPF/CNPJ), address and payment data handled by our payment providers (we do not store card numbers).
• Connected channels: technical identifiers provided by Meta and other channels, such as WhatsApp Business Account (WABA) ID, phone number ID and number, Facebook Page and Instagram account IDs, message templates and access tokens granted by the business.
• Conversations: messages, media (images, audio, video, documents), name, phone number or identifier and profile photo of the contacts who talk to the business, plus the team's internal notes and attendance records.
• Usage and security: access logs (IP, date and time, browser), panel activity logs and session cookies.
• Public website: with your consent in the cookie banner, Google Analytics collects aggregated browsing data.

3. Data received from Meta (WhatsApp, Messenger and Instagram)

When a business connects its account through Embedded Signup or Facebook Login, it authorizes ZTalk to access its assets with the whatsapp_business_management, whatsapp_business_messaging and business_management permissions and, for Messenger and Instagram, page and messaging permissions.

• We use this data only to connect the business's channels, send and receive its messages, manage its message templates and phone numbers, and show the conversations to its team.
• We do not sell or rent Meta data, and we do not use it for advertising, profiling, data enrichment or any purpose other than the business's own customer service.
• We do not share data received from Meta with third parties, except the processors listed in section 6 that are needed to provide the service.
• The business can remove our access at any time in its Meta business settings (Business settings > Integrations) or by disconnecting the channel in ZTalk.

4. How we use data

• To provide the service: deliver and receive messages, organize the service queue, assign conversations, produce reports and notify the team.
• Support, security, and prevention of fraud and abuse, including enforcing WhatsApp and Meta policies.
• Billing and legal, tax and regulatory obligations.
• Product improvement, based on aggregated usage data.

Legal bases (LGPD art. 7): performance of a contract, legal obligation, legitimate interest (security and service improvement) and consent (website analytics cookies).

5. Artificial intelligence features

Features such as the AI agent, reply suggestions, drafts and audio transcription are optional and turned on by the business itself. When on, only the content needed (for example the conversation text or the audio) is sent to the configured AI provider (OpenAI, Google or Anthropic) to produce the answer or transcription. Under their commercial terms, these providers do not use data sent through their APIs to train their models.

6. Who we share data with

We share data only with processors that help us provide the service, under contract and with confidentiality and security obligations:

• Infrastructure and storage: Magalu Cloud (servers in Brazil) and Amazon Web Services (file storage).
• Messaging channels: Meta (WhatsApp, Messenger, Instagram) and Telegram, to deliver messages.
• Real-time notifications: Pusher.
• Payments: Efí and Stripe.
• AI, when turned on by the business: OpenAI, Google and Anthropic.
• Authorities, when required by law or court order.

Some of these processors may handle data outside Brazil. Such transfers follow LGPD art. 33, with contractual clauses and equivalent protection safeguards.

7. How long we keep data

• While the account is active, we keep the data needed for the service. The business can delete conversations and contacts in the panel.
• After the account is closed or a deletion request is made, data is deleted within 30 days. Backups are overwritten within a further 30 days.
• Data the law requires us to keep, such as access logs (6 months, Brazilian Internet Civil Framework) and tax records, is kept for the legal period.

8. Security

We use encrypted connections (HTTPS/TLS), role- and permission-based access within each team, isolation of each business's data, hashed passwords, backups and monitoring. No system is fully immune to incidents; if a relevant incident occurs, we will notify those affected and the Brazilian data protection authority (ANPD) as required by law.

9. Your rights

Under the LGPD you may request: confirmation of and access to your data, correction, anonymization, blocking or deletion, portability, information about sharing, withdrawal of consent and review of automated decisions.

If you talked to a business that uses ZTalk, that business is the controller of your data: please send your request to it, and we will help it respond. If you cannot reach the business, contact us.

For requests about your ZTalk account, see also our data deletion page: https://ztalk.chat/data-deletion.

10. Cookies

The panel uses only essential cookies (session and preferences). On the public website, analytics cookies are used only with your consent, which you can withdraw at any time in the cookie banner.

11. Children

ZTalk is a service for businesses and is not intended for anyone under 18.

12. Changes and contact

We may update this policy; the date at the top shows the version in force, and relevant changes will be announced in the panel.

Privacy questions and requests, including those addressed to our data protection officer: through the chat on https://ztalk.chat (button in the corner of the screen).