Privacy policy

1. Who is responsible for the data

Zay.ia is a product of 2MS Serviços em Tecnologias Ltda, CNPJ 32.204.552/0001-08, based in Itajaí, SC, Brazil. For any privacy matter, contact admin@zay.ia.br.

We act in two roles. We are the controller of the data of the professional who subscribes to Zay.ia (account, contact and use of the service). We are the processor of the data of the professional’s clients (name, phone number, messages and appointments): the professional decides what to do with that data, and we handle it only to provide the service to her.

2. What data we handle

• About the professional: name, email, phone, the connected WhatsApp Business number and account settings.
• About her business: services, prices, durations, working hours, service address, calendar and blocked times, and the payments she records.
• About her clients: name, phone number, the content of their WhatsApp conversations with the assistant, and appointments.
• If the professional allows it: the recent chat history of the connected number, which Meta sends once when the number is connected.
• If the professional connects it: her Google Calendar, only to see busy times.
• From the app: the device identifier used to send notifications.
• Technical data: system operation logs, without the content of messages.
• Conversation content: clients may write sensitive data, such as health information. The assistant gives no clinical guidance and passes those topics to the professional.

3. Why we use it and on what legal basis

• To provide the contracted service: answering clients, booking, rescheduling, canceling and reminding (performance of a contract, LGPD art. 7, V).
• To learn the professional’s way of working from chat history: only with her consent, which she can withdraw at any time (art. 7, I). Once consent is withdrawn, we stop using the history; what was already imported is deleted on request.
• To keep the service secure and prevent fraud and abuse (legitimate interest, art. 7, IX).
• To meet legal and regulatory obligations, such as tax rules (art. 7, II).

We do not sell data, we do not use it for advertising and we do not build client profiles for other purposes.

4. Who we share it with

We use providers to run the service. Each receives only what it needs for its role:

• Meta (WhatsApp Cloud API): sending and receiving messages through the professional’s number.
• Supabase: database and queues, on servers in São Paulo.
• Google Cloud: hosting of the system, in São Paulo.
• OpenRouter and the language model providers it calls (currently Google and DeepSeek): they receive the conversation text and the setup data needed to write the assistant’s reply.
• Google Calendar, only if the professional connects it.
• Expo and the phone notification services (Apple and Google), to alert the professional in the app; the alert carries no client data.

We may also share data under an order from a competent authority or to defend rights in legal proceedings.

5. International transfers

Some of the providers above, especially OpenRouter and the language model providers, Meta and Expo, may process data outside Brazil. In those cases the transfer takes place under the situations in LGPD art. 33, in particular when necessary to perform the contract with the professional (art. 33, IX).

6. Security

• Connections protected by HTTPS/TLS.
• Isolation: each professional can access only her own data, through rules in the database and in the code, with automated isolation tests.
• WhatsApp and Google access tokens stored encrypted; secrets kept out of the code.
• Technical logs without the content of messages.

No system is completely immune to incidents. If one could cause relevant harm, we will notify those affected and Brazil’s data protection authority (ANPD), as the law requires.

7. How long we keep it

We keep data while the professional’s account is active. When the professional asks for deletion (including when canceling), we delete the data, except what the law requires us to keep (for example, tax records), and only for as long as it requires. How to ask and how fast we reply: see the Data deletion page.

8. Your rights

You can ask us to confirm that we handle your data, and request access, correction, anonymization, portability, deletion, information about who we share it with, and withdrawal of consent. Write to admin@zay.ia.br; we reply within 15 days. If you are a client of a professional, you can also talk to her, since she is responsible for your information in the service.

You may also ask for review of decisions made solely by automated processing and object to processing you consider unlawful. The channel for data subjects is admin@zay.ia.br. You may also complain to Brazil’s National Data Protection Authority (ANPD) at gov.br/anpd.

9. Minors

The service is for adult professionals. We do not direct it to people under 18 and do not knowingly handle their data as users.

10. This website

This website uses no cookies, has no trackers or ads, and loads no third-party scripts or fonts. The hosting service may record visitors’ IP addresses in access logs, for security.

11. Changes to this policy

When we change this policy we will update the date at the top of the page and, if the change is relevant, notify professionals in the app or by email.