Privacy and Data Protection Policy
Our Privacy Commitment
AgenteZap is committed to protecting the privacy and data of its users. This policy transparently describes how we collect, store, use and protect your information in accordance with Brazil's General Data Protection Law (LGPD, Law 13,709/2018) and Google's policies.
1. Data Collected
1.1. Registration Data
- Full name: to identify the user
- Email: for communication, account recovery and notifications
- Phone: for technical support and authentication
- Payment data: processed through Stripe; we do not store card details
- Business information: name, business type and address, where applicable
1.2. Platform Usage Data
- WhatsApp conversations: messages exchanged through the AI agent
- Sent and received media: images, audio, videos and documents
- Activity logs: access times and actions performed in the system
- Lead data: information collected from contacts through WhatsApp
- Agent settings: custom prompts, flows and automations
1.3. Google Calendar Data (OAuth Integrations)
When you authorize Google Calendar integration, AgenteZap accesses the following data:
- Calendar events: appointment titles, descriptions, dates and times
- Availability information: free and busy times for scheduling
- Attendee details: invitee names and emails, where needed
- Calendar settings: time zone and notification preferences
Important: Google Calendar access is optional and requires your explicit authorization. You may revoke access at any time through your Google account settings.
1.4. Technical Data
- IP address: for security and fraud prevention
- Device information: browser type and operating system
- Cookies: to maintain your active session and improve your experience
2. How We Use Data
2.1. General Purposes
- Providing and operating the AgenteZap platform
- Processing messages through artificial intelligence
- Managing conversations and customer service history
- Automating follow-ups and lead qualification
- Generating usage reports and statistics
- Providing technical support and customer service
- Sending important service notifications
- Processing payments and invoices
- Continuously improving the platform and developing new features
- Preventing fraud and maintaining security
2.2. Specific Use of Google Calendar Data
Data accessed from your Google Calendar is used exclusively for:
- Automatic scheduling: Allowing the AI agent to book appointments directly in your calendar when customers request them through WhatsApp
- Availability checks: Checking free times to suggest appointment options to customers
- Event creation: Creating calendar appointments using information provided by the customer
- Event updates: Modifying or canceling appointments when needed
- Calendar synchronization: Keeping WhatsApp scheduling synchronized with Google Calendar
- Automatic reminders: Sending appointment notifications to customers through WhatsApp
Privacy Guarantee: We DO NOT share, sell or use your Google Calendar data for any purpose other than those listed above. Your events and appointments are strictly confidential and are used only to operate the platform's scheduling feature.
2.3. AI Processing
Messages sent and received through WhatsApp are processed by artificial intelligence (OpenAI GPT-4) to:
- Understand and answer customer questions
- Qualify leads and extract relevant information
- Execute customized customer service flows
- Schedule appointments and create reminders
Note: We use the OpenAI API, which has its own privacy policies and does not use data submitted through the API to train its models.
3. Data Storage and Security
3.1. Where We Store Data
- Main database: Supabase, using AWS infrastructure with servers in the USA
- Media and files: Supabase Storage with a global CDN
- Backups: Performed daily with encryption
- System logs: Stored for 90 days for auditing
3.2. Google Calendar Data
- Access tokens: Stored with AES-256 encryption in Supabase
- Event cache: Kept temporarily, for at most 24 hours, solely for performance
- Synchronization: Data is queried in real time as needed; we do not retain permanent copies
- Revocation: Disconnecting the integration immediately deletes all tokens and caches
3.3. Security Measures
- Encryption in transit: TLS/SSL 1.3 for all communications
- Encryption at rest: AES-256 for sensitive database data
- Secure authentication: Supabase Auth with JWT tokens
- Row Level Security (RLS): Complete data isolation between accounts
- 24/7 monitoring: Detection of suspicious activity and unauthorized access attempts
- Regular audits: Vulnerability assessments and penetration testing
- Restricted access: Technical staff have limited access only when needed
3.4. Retention Period
- Active account data: Retained while the subscription is active
- After cancellation: Data retained for 30 days for possible reactivation
- Permanent deletion: After 30 days, all data is permanently deleted
- Tax records: Retained for 5 years under Brazilian law
- Security logs: Retained for 90 days for auditing
4. Data Sharing
Important: We DO NOT sell your data to third parties
AgenteZap NEVER sells, rents or trades users' personal data. We share data only when strictly necessary to operate the service.
4.1. Essential Third-Party Services
We share limited data with the following partners to operate the platform:
- Supabase: Database hosting and file storage
Policy: https://supabase.com/privacy - OpenAI: AI processing for agent replies
Policy: https://openai.com/privacy - Stripe: Payment processing
Policy: https://stripe.com/privacy - Evolution API: WhatsApp integration infrastructure
Self-hosted with end-to-end encryption - Google Calendar API: Appointment synchronization
Policy: https://policies.google.com/privacy - Railway: Server hosting and application deployment
Policy: https://railway.app/legal/privacy
4.2. Specific Google Data Policy
In accordance with the Google API Services User Data Policy, we guarantee that:
- Google Calendar data is accessed ONLY for the scheduling features described
- We DO NOT transfer Google Calendar data to third parties
- We DO NOT use this data for advertising or marketing
- We DO NOT permit human access to your data except where necessary for security or support, with your consent
- We implement encryption in transit and at rest for all Google data
- You can revoke access at any time through your Google account settings
4.3. Legal Circumstances
We may disclose personal data when required by law, a court order or a competent authority, or when necessary to protect our rights, security or property.
5. Your Rights Under the LGPD
Under the LGPD, you have the following rights regarding your personal data:
- Access: Request a copy of all personal data we hold about you
- Correction: Update or correct inaccurate or outdated data
- Deletion: Request permanent deletion of your data, also known as the right to be forgotten
- Portability: Receive your data in a structured format for transfer
- Withdrawal of consent: Withdraw authorization for data processing at any time
- Anonymization: Request anonymization of your data
- Information: Know what data we collect and how we use it
How to Exercise Your Rights
To exercise these rights, you can:
- Open your account settings in the dashboard
- Contact support through the platform chat
- Email: privacidade@agentezap.online
We will respond to all requests within 15 business days.
6. Cookies and Similar Technologies
We use cookies to improve your platform experience:
- Essential cookies: Required for login and basic functionality; these cannot be disabled
- Preference cookies: Save your settings and preferences
- Analytics cookies: Help us understand how you use the platform; these can be disabled
You can manage cookies through your browser settings.
7. Changes to This Policy
We may update this Privacy Policy periodically to reflect changes in our practices or the law. For significant changes:
- We will notify you by email
- We will display a prominent notice on the platform
- The 'last updated' date will change
We recommend reviewing this policy periodically to stay informed about how we protect your data.
8. Data Protection Officer (DPO)
For privacy and data protection questions, contact our Data Protection Officer:
Email: privacidade@agentezap.online
Subject: "LGPD - [Your Request]"
Compliance with the Google API Services User Data Policy
AgenteZap's use of information received from Google APIs complies with theGoogle API Services User Data Policy, including the Limited Use requirements.
Last updated: January 20, 2026
Purpose of the Agreement
1.1. This agreement (the "Agreement") establishes the general terms for using AgenteZap (the "Platform"), an AI-powered WhatsApp customer service automation tool.
1.2. By using the Platform, the CUSTOMER declares that they have read, understood and fully accepted all terms of this Agreement.
1.3. The Platform is intended exclusively for commercial and professional use in accordance with applicable law and AgenteZap's guidelines.
Platform Features
2.1. The Platform provides the following features:
- AI agent for automated WhatsApp customer service
- Smart follow-up for lead re-engagement
- Conversation management and message history
- Kanban for lead management
- Media library for audio, images and videos
- Bulk messaging with usage controls
- Appointment scheduling
- Automatic lead qualification
- Webhook integrations
- Reports and statistics
2.2. All features are intended to support legitimate businesses in their commercial operations.
Usage Guidelines
Failure to follow the guidelines below may result in immediate account suspension.
3.1. The Platform must not be used for:
3.1.1. Unsupported Service Categories
Certain service categories are not covered by our usage guidelines. This classification reflects the platform's internal criteria only and does not express a value judgment about the activities themselves. AgenteZap does not support the following services:
- Consultations or services of a spiritual, mystical or esoteric nature
- Cartomancy, tarot, astrology or similar services
- Ritual or ceremonial practices of any kind
- Services promising outcomes in relationships, finances or health through unconventional means
3.1.2. Adult Content and Illegal Activities
- Pornography or sexually explicit content
- Prostitution or escort services
- Sale or promotion of illicit substances
- Unregulated gambling
- Trade in smuggled or counterfeit products
3.1.3. Abusive Practices
- Scams, fraud or financial pyramid schemes
- Mass spam or unsolicited messages
- Phishing or unlawful collection of personal data
- Harassment, bullying or intimidation
- Hate speech or discrimination
- Distribution of fake news or disinformation
3.2. The Platform actively monitors usage patterns. Accounts violating these guidelines will be suspended automatically, and their WhatsApp connection will be disconnected immediately.
Account Suspension and Refund Policy
4.1. The SERVICE PROVIDER reserves the right to suspend immediately, without prior notice, any account that violates this Agreement.
4.2. In the event of suspension for policy violations:
- All account features will be disabled
- WhatsApp will be disconnected automatically
- The AI agent will stop replying
- Follow-up will be stopped
- Dashboard access will be blocked
- Reconnecting WhatsApp or sending messages will not be possible
4.3. Refund Policy: In the event of permanent suspension for policy violations, the SERVICE PROVIDER will issue a proportional refund for the unused paid period, deducting:
- Days of the plan already used
- API costs already incurred
4.4. The refund will be processed within 15 (fifteen) business days using the same payment method as the original purchase.
4.5. Account suspension does not release the CUSTOMER from legal liabilities arising from misuse of the Platform.
Obligations of the Parties
5.1. CUSTOMER Obligations:
- Use the Platform in accordance with applicable laws and AgenteZap's guidelines
- Keep access credentials confidential
- Respect the usage limits of the purchased plan
- Do not share or resell Platform access
- Keep registration details up to date
- Respect WhatsApp's policies
5.2. SERVICE PROVIDER Obligations:
- Ensure minimum Platform availability of 99%
- Provide technical support during business hours
- Maintain the confidentiality of CUSTOMER data
- Give advance notice of scheduled maintenance
- Process refunds according to the established policy
Payments and Renewal
6.1. Plans are billed on a recurring basis, monthly or annually, as selected by the CUSTOMER.
6.2. Payment must be made by the due date. Delays exceeding 5 (five) days may result in temporary service suspension.
6.3. Renewal is automatic. The CUSTOMER may cancel at any time through the dashboard.
Termination and Cancellation
7.1. The CUSTOMER may cancel their subscription at any time without penalty and retain access until the end of the paid period.
7.2. The SERVICE PROVIDER may terminate the Agreement immediately for a terms-of-use violation, without entitlement to a full refund.
7.3. For termination due to policy violations, the refund policy in Section 4.3 applies.
Final Provisions
8.1. This Agreement is governed by the laws of the Federative Republic of Brazil.
8.2. The courts of São Paulo, State of São Paulo, are designated to resolve any questions or disputes arising from this Agreement.
8.3. A party's tolerance of a breach does not waive its right to require compliance with this Agreement.
8.4. The CUSTOMER may contact Platform support with any questions.
By using AgenteZap, you declare that you understand and agree to all terms and conditions set out here.