1. Our role
Zapstro acts in two different roles, and this matters for your rights:
- As a controller for the personal data of website visitors, prospects who contact us, and the people who create and manage Zapstro accounts (account holders and their users), including billing and support data.
- As a processor (service provider) for the data our customers upload to or collect through the platform — for example their contacts, conversations, messages, call recordings, files and CRM records ("Customer Data"). For Customer Data, the business using Zapstro is the controller and decides why and how that data is processed. We process it only on their instructions, under our Terms of Use and data processing commitments.
If you are a contact of a business that uses Zapstro (for example, you chatted with a company on WhatsApp), please contact that business directly to exercise your rights. If you contact us instead, we will forward your request to them.
2. Data we collect
On our website (zapstro.com):
- Information you send through our contact form: name, email, WhatsApp number, company, country, team size and message.
- Your country choice, stored only in your own browser (localStorage) to show the right language and prices.
- Technical data processed by our content delivery network to serve the site securely (such as IP address, browser type and request time).
- Only if you accept in our cookie banner: analytics and advertising measurement through Google Analytics and, when enabled, the Meta Pixel (pages visited, clicks on sign-up buttons, form submissions, approximate location and device). If you reject, these tools stay off (Google may receive cookieless, aggregated signals under Consent Mode).
When you create and use an account:
- Account and profile data: name, email, phone/WhatsApp number, company name, country, time zone, language and password (stored as a secure hash).
- Billing data: plan, billing cycle, invoices and payment status. Card details are entered directly with our payment provider, Stripe; we never see or store full card numbers.
- Usage and security data: log-ins, IP addresses, devices, actions taken in the account, API calls and audit logs.
- Support data: messages and tickets you send to our team.
Customer Data processed on behalf of our customers, as described in section 1.
3. Why we use it and our legal bases
We use personal data only for specific purposes, each with a legal basis under the EU/UK GDPR and Brazil's LGPD:
- To provide the service — create and run your account, deliver features, process payments, provide support (performance of a contract).
- To keep Zapstro secure — prevent fraud, abuse and spam, monitor for incidents and enforce our Terms (legitimate interests; legal obligations).
- To improve the product — understand how features are used, using aggregated or pseudonymised data where possible (legitimate interests).
- To communicate with you — service notices, trial and billing reminders, and, if you are a customer or asked us, relevant product news. You can opt out of marketing at any time (legitimate interests or consent, where required).
- To meet legal obligations — tax, accounting, and responding to lawful requests from authorities (legal obligation).
We do not sell personal data and we do not use Customer Data for our own marketing.
4. Artificial intelligence features
Zapstro offers AI features such as AI agents, suggested replies, BrAIn lead scoring, transcription and the Creative Studio. When a customer turns these features on, the relevant content (for example, a conversation or a prompt) is sent to the AI provider selected for that account — currently OpenAI, Google (Gemini) or Anthropic (Claude) — to generate the result.
- These providers process the data under their business/API terms, which do not allow them to use it to train their models.
- Customers decide which AI features are active and what their AI agents may do. AI output can be wrong and should be reviewed where it matters.
- Zapstro does not make decisions that produce legal or similarly significant effects about individuals solely through automated means.
5. Who we share data with
We share personal data only with service providers that help us run Zapstro, under contracts that require them to protect it, and only as needed:
- Payments: Stripe.
- Messaging and social channels: Meta Platforms (WhatsApp Business Platform, Instagram, Facebook, Threads) and other networks you connect (such as LinkedIn, TikTok, YouTube, Telegram, Google Business Profile), plus the connection providers we use to reach them.
- AI providers: OpenAI, Google and Anthropic, as described in section 4.
- Infrastructure: cloud hosting, databases, storage, email/SMS delivery and our content delivery network (Bunny.net) for the website.
- Website measurement (only with your consent): Google (Analytics) and Meta (Pixel).
- Integrations you enable: if you connect a third-party tool (for example Google Calendar, Shopify or HubSpot), data flows to it according to your settings and that provider's terms.
- Authorities and advisers: when required by law, to protect rights and safety, or to our legal and accounting advisers under confidentiality.
If Zapstro is involved in a merger or acquisition, data may be transferred as part of that transaction, subject to this Policy.
6. International transfers
Zapstro is operated from Brazil and our providers may process data in Brazil, the United States, the European Union and other countries. When personal data from the EU, the UK or Brazil is transferred to a country without an adequacy decision, we rely on appropriate safeguards such as the European Commission's Standard Contractual Clauses, the UK addendum and the mechanisms in article 33 of the LGPD.
7. How long we keep data
- Account data: for as long as the account is active.
- Customer Data: during the subscription and for up to 90 days after it ends, so the customer can export it; then it is deleted or anonymised, except for backups that expire on their normal cycle.
- Contact-form requests from prospects: up to 24 months after the last interaction, unless you become a customer.
- Billing and tax records: for the period required by law (usually 5 to 10 years).
- Security logs: generally up to 12 months.
8. Security
We use technical and organisational measures appropriate to the risk, including encryption in transit, role-based access control, two-factor authentication options, audit logs of API and AI-tool activity, backups and restricted staff access. No system is 100% secure; if a breach affects your personal data, we will notify you and the competent authorities as required by law.
9. Your rights
Depending on where you live, you may have the right to: access your data; correct it; delete it; restrict or object to its processing (including for direct marketing); receive it in a portable format; withdraw consent; and not be subject to solely automated decisions. Residents of California and other US states may also have the right to know, delete and correct, and to not be discriminated against for exercising their rights — we do not sell or share personal data for cross-context behavioural advertising.
To exercise your rights, email contact@zapstro.com. We will answer within 30 days (or sooner where the law requires) and may need to verify your identity. You can also complain to your data protection authority — for example the CNPD (Portugal), the Garante per la protezione dei dati personali (Italy), the ICO (UK) or the ANPD (Brazil).
10. Cookies and similar technologies
On zapstro.com we store your country choice and your cookie decision in your browser. Analytics (Google Analytics) and advertising measurement (Meta Pixel, when enabled) are only activated if you click "Accept" in the cookie banner; you can change your mind at any time by clearing this site's data in your browser. The Zapstro app uses essential cookies to keep you signed in and secure. Google and Meta process this data under their own privacy policies.
11. Children
Zapstro is a business tool and is not intended for anyone under 16. We do not knowingly collect personal data from children.
12. Changes to this Policy
We may update this Policy as the product or the law changes. We will post the new version here with a new date and, for significant changes, notify account holders by email or in the app.
13. Contact
AMAZING TECH LTDA · CNPJ 33.115.766/0001-70 · Jundiaí, São Paulo, Brazil. Email: contact@zapstro.com.