Privacy Policy

GBS Systems Ltda ("GBS", "we"), registered under CNPJ No. 04.770.406/0001-04, headquartered at Rua Dona Antônia de Queirós, 549, Consolação, São Paulo/SP, CEP 01.307-014, as data controller, presents this Privacy Notice in compliance with the California Consumer Privacy Act (CCPA/CPRA) and applicable US privacy laws.

This document describes how we collect, use, store, and protect the personal data of users of the ZapRag platform.

1.1 Data provided by the User

• Full name and email (registration)
• Phone number (WhatsApp/Telegram connection)
• Payment data (processed exclusively by Stripe)
• Documents uploaded to Drive (PDFs, spreadsheets, images)

1.2 Automatically collected data

• IP address and approximate geolocation
• Browser type and operating system
• Pages accessed and browsing time
• Access logs (as required by applicable US federal and state laws)

1.3 Message data

• Text messages, audio, video, images, and documents received and sent through connected services (WhatsApp, Telegram)
• Message metadata (sender, recipient, date/time)
• Transcriptions automatically generated from audio and video

We process your personal data for the following purposes, based on the legal bases provided by the CCPA and applicable US privacy law:

2.1 Performing services (Business Purpose)

• Provision of contracted services (message centralization, search, and analysis)
• Payment processing and subscription management
• Technical support and User assistance

2.2 Consent (Opt-in)

• Sending marketing communications and Platform news
• Use of non-essential cookies and tracking technologies

2.3 Legitimate business operations

• Improvement and development of new features
• Fraud prevention and Platform security
• Aggregated and anonymous statistical analyses

2.4 Legal obligation compliance

• Storage of access records as required by applicable US federal and state laws
• Compliance with judicial requests or competent authorities

Your personal data may be shared with:

• Stripe: payment processing (financial data)
• AI Providers (Google, OpenAI, Mistral, xAI): when the User uses artificial intelligence features, selected conversation excerpts are sent to the chosen provider for processing. The User configures their own API key.
• Infrastructure providers: servers and storage services (Wasabi, dedicated servers)
• Public authorities: when required by law or court order

GBS does not sell, rent, or trade its users' personal data.

• All messages are encrypted with AES-256-GCM at rest.
• Client-server communications use TLS 1.3.
• Server access is restricted and protected by multi-factor authentication.
• Backups are performed periodically and stored in encrypted form.
• Data is stored on servers located in Brazil, unless expressly stated otherwise.

• Account data: retained while the account is active.
• Messages and media: according to the retention settings defined by the User for each chat.
• After cancellation: data retained for 30 days for export, then permanently deleted.
• Access logs: retained for 6 months (legal obligation).
• Payment data: retained for the legally required period for tax purposes.

The User, as a consumer under the CCPA, may exercise the following rights:

• Right to know: know what personal information we collect, use, disclose, and sell, and request a copy of that information.
• Right to delete: request deletion of personal information we have collected.
• Right to opt-out of sale/sharing: opt out of the sale or sharing of your personal information.
• Right to correct: request correction of inaccurate personal information.
• Right to limit use of sensitive personal information: limit how we use and disclose sensitive personal information.
• Right to non-discrimination: not be discriminated against for exercising your CCPA rights.

To exercise any of these rights, contact us at privacidade@zaprag.ai or through the Contact page. We will respond within 45 days as required by the CCPA.

• Essential cookies: necessary for Platform operation (authentication, session).
• Analytics cookies: used to understand Platform usage and improve experience (can be declined).

The User can manage cookie preferences in browser settings.

When the User uses AI features, data excerpts may be sent to AI provider servers located outside the United States. In such cases, we ensure the transfer complies with appropriate safeguards under applicable US privacy law, through adequate contractual clauses or data subject consent.

The ZapRag Platform is not intended for individuals under 18 years of age. We do not intentionally collect data from minors. If we identify that minor data has been collected, we will proceed with immediate deletion.

For questions related to personal data protection, our Privacy Contact can be reached:
Email: privacidade@zaprag.ai
Address: Rua Dona Antônia de Queirós, 549, Consolação, São Paulo/SP, CEP 01.307-014

This Privacy Policy may be updated periodically. Relevant changes will be communicated by email or through the Platform. The date of the last update will always be indicated at the top of this document.

This Policy is governed by the laws of the State of California and applicable US federal law, in addition to the California Consumer Privacy Act (CCPA/CPRA). Disputes shall be resolved in courts of São Paulo, Brazil, as GBS Systems Ltda is headquartered in Brazil.

GBS Systems Ltda
CNPJ: 04.770.406/0001-04
Address: Rua Dona Antônia de Queirós, 549, Consolação, São Paulo/SP, CEP 01.307-014
General email: contato@zaprag.ai
Privacy email: privacidade@zaprag.ai