Data processing agreement

This Data Processing Agreement forms part of the Terms of Use and applies whenever Ziptalk processes personal data on your behalf rather than its own.

In practice that means the WhatsApp number you connect. The conversations on that number involve customers, suppliers and other people who have a relationship with you, not with us. For that data:

• You are the controller. You chose to use the Service, the relationship with those people is yours, and so is the legal basis for processing them.
• Ziptalk is the processor. We handle that data on your instruction, for the purpose you signed up for.

For your own account data — name, email, billing — Ziptalk is the controller, and the Privacy Policy governs.

Accepting the Terms of Use accepts this agreement. There is nothing separate to sign.

Purpose. Receiving the connected number's messages, transcribing the voice ones, returning the text to the chat, and whichever optional features you enable: contact sync, summaries, translation, language filtering and call transcription.

Duration. For as long as the number stays connected and your subscription is active.

Data processed. Phone numbers and contact names, audio content while it is being processed, and message metadata such as date, duration and identifier. Audio and transcripts are not stored, and conversation content is never stored.

Data subjects. The people who talk to the connected number, and the contacts in that number's address book.

Sensitive data. Any conversation may contain data covered by article 11 of the LGPD without anyone planning it. We cannot filter for it in advance, so the defence is minimisation: no content is retained.

We process the data only on your instruction. Your instructions are what you configure in the Service — which features you enable, which numbers you connect, which preferences you set — plus anything you ask of us in writing.

If we believe an instruction of yours breaches data protection law, we tell you before acting on it.

Ziptalk does not:

• use that data for its own purposes;
• train models on the content of your conversations;
• sell, rent or share that data for advertising;
• access the content beyond the automated processing that transcription requires.

Everyone with access to the systems is bound by confidentiality, and access is limited to those who need it to run the Service.

Technical measures include encryption in transit, access control, credential segregation, and encryption at rest for connection credentials. Requests received from Meta's platform are signature-verified before being processed.

The measures are detailed in the Privacy Policy.

You authorise Ziptalk to engage third parties to carry out parts of the processing. They act under contract, with obligations no less protective than those in this agreement, and Ziptalk remains answerable to you for them.

We engage them by function: speech recognition and text processing, hosting and database, error monitoring, payments and tax invoicing, sign-in and website analytics. On the official connection, Meta's platform delivers the messages, and its own processing is governed by its policies.

The list by name is provided on request, in writing, at [email protected]. We do not publish it because that would expose the Service's architecture with no gain in protection for anyone, and the law requires disclosing that sharing happens and what for, not the roster of suppliers.

Before adding a new subprocessor that handles message content, we give reasonable notice, and you may end your subscription if you disagree.

As controller, you are the one who answers data subjects. Ziptalk assists within what is technically available to us.

If a data subject comes to us directly, we do not decide on your behalf: we forward the request and tell the person it has been forwarded. We publish a page written for those people at Your data, explaining how this works and how to opt out.

Inside the Service you can already, without going through us, turn contact sync off, delete the stored address book, disconnect the number and delete the account.

If an incident affects data processed on your behalf, we notify you without undue delay and in any case within 48 hours of becoming aware of it.

The notice carries what is known at the time: the nature of the incident, the data and data subjects involved where identifiable, likely consequences, and the measures taken. As controller, you decide on notifying Brazil's National Data Protection Authority and the data subjects; we supply what you need in order to do so.

The Service's database is in Brazil. Some subprocessors operate abroad, mainly in the United States, which means data is transferred internationally. Those transfers rely on contractual clauses and the safeguards required by applicable law.

When you disconnect a number, we delete that number's stored address book and connection credentials.

When you close the account, data processed on your behalf is deleted or anonymised as described in the Privacy Policy. Only the records the law requires us to keep remain, with nothing identifying the data subjects.

Audio and transcripts do not survive processing, so there is nothing to return or delete afterwards.

On request, and within a reasonable time, we provide what you need to demonstrate you are meeting your obligations — including detail on the security measures and the list of subprocessors by name.

Audit requests are satisfied through that information. An on-site audit, or one by a third party you engage, requires prior agreement on scope, timing and cost, and cannot compromise the security or confidentiality of other customers.

This agreement supplements the Terms of Use. Where the two conflict on the processing of personal data, this document prevails.

Changes follow the same rule as the Terms: the date of the latest revision is shown at the bottom, and material changes are announced inside the app.

Questions: [email protected]

Ziptalk LTDA — CNPJ 62.586.587/0001-10 — Piracicaba/SP, Brazil.