Privacy Policy

1. Introduction

ZAPFLUX LTDA (“ZapFlux”, “we”), operator of the ZapFlux platform, is committed to protecting privacy and personal data. This Policy describes what data we process, for what purpose, on what legal bases, and how you can exercise your rights.

ZapFlux integrates with official channels, including the WhatsApp Business Platform and Instagram professional accounts, through Meta's official APIs and permissions. Data from these channels is accessed only when the customer company expressly authorizes the connection and exclusively to deliver the contracted features.

2. Who we are

Controller of the data processed on this platform: ZAPFLUX LTDA, registered under CNPJ no. 65.600.828/0001-26. Contact: suporte@zapflux.app.

3. Data we may collect

We collect only the data needed to operate the platform and deliver the features authorized by the customer:

• Account and registration data;
• Data from Meta channels authorized by the company;
• WhatsApp Business Platform data;
• Instagram professional account data;
• Message and operational interaction data;
• Technical and platform usage data.

4. Connected Meta channel data

When the company authorizes connecting Meta business assets, ZapFlux may access and store identifiers and metadata needed to keep the connection working, such as:

• Business Account ID;
• WhatsApp Business Account ID (WABA ID);
• Connected phone number IDs;
• Associated Facebook Page IDs;
• Instagram professional account IDs;
• Access tokens provided by Meta, stored securely;
• Connection status and events received via webhooks.

5. WhatsApp and Instagram data

For customer service via WhatsApp Business Platform and Instagram Messaging we may process: contact numbers/identifiers, display name when provided by Meta, message content (text, media, audio) for operational purposes, and delivery/read status and other events.

6. How we use data

We use the data to:

• Authenticate users and keep accounts secure;
• Connect and maintain authorized Meta business assets;
• Receive and send business messages on connected channels;
• Process events received via webhooks;
• Organize service, sales, support and relationships (CRM);
• Run automations configured by the company itself;
• Comply with legal, tax and regulatory obligations.

7. We do not sell data

ZapFlux does not sell personal or business data and does not use data from connected Meta channels for purposes other than delivering the authorized features.

8. Legal basis

Processing is carried out on one or more grounds: performance of a contract; the data subject's consent; the company's express authorization to connect its Meta assets; compliance with a legal obligation; and legitimate interest, respecting the data subject's rights.

9. Data sharing

We do not sell or rent data. We may share strictly with: Meta, to operate the authorized integrations; cloud infrastructure providers; payment processors; and public authorities when required by law.

10. Storage and security

We adopt technical and organizational measures: encryption in transit and at rest, secure storage of tokens and credentials, restricted access control and per-organization segregation (multi-tenant), monitoring and backups.

11. Retention

We keep data while the account is active and while needed for the purposes of this Policy. After termination, we retain it for the applicable legal period and then anonymize or delete it.

12. Data subject rights (LGPD)

You may: confirm processing and access your data; correct data; request anonymization, blocking or deletion; request portability; withdraw consent. Contact: suporte@zapflux.app or the Data Protection Officer (DPO): dpo@zapflux.app.

13. Data deletion

You may request deletion at any time by emailing suporte@zapflux.app. See the Data Deletion page for the step-by-step and how to disconnect Meta channels.

14. International transfer

Some providers and Meta's own platforms may process data outside Brazil. When this happens, we adopt adequate safeguards.

15. Children and adolescents

ZapFlux is a business platform, not directed at children or adolescents; we do not intentionally collect their data.

16. Changes

We may update this Policy periodically. Relevant changes will be communicated by email or a notice on the platform.

17. Contact

Privacy questions: suporte@zapflux.app (support) or dpo@zapflux.app (Data Protection Officer / DPO). ZAPFLUX LTDA — CNPJ 65.600.828/0001-26.