Privacy Policy

1. Who we are

Zailor is a product of Workbits ("Workbits", "we", "us"). This Privacy Policy applies to the website zailor.io, the application at app.zailor.io, the website chat widget, the APIs, and Zailor's integrations with third-party channels such as WhatsApp, Instagram and Facebook Messenger (together, the "Service").

For any privacy matter, including contacting our data protection officer (DPO), email suporte@zailor.io.

2. Our role in processing data

• As controller: Workbits is the controller of the data of people who create and use Zailor accounts (our "Customers" and their users) and of visitors to the zailor.io website.
• As processor: when a business uses Zailor to talk to its own customers, that business is the controller of the conversation and contact data, and Workbits acts as a processor, handling that data only to provide the Service and according to the Customer's instructions.

If you talked to a business that uses Zailor and want to exercise your rights, we recommend contacting that business first. You can also write to us and we will help route your request.

3. Data we process

3.1. Account data

Name, email, password (stored only as a cryptographic hash), profile picture, company name, job title or role, language, time zone, notification preferences and account settings. If you purchase a paid plan, we also process billing and business contact data.

3.2. Data from connected channels, including Meta platforms

When you connect a channel to Zailor, we process the data needed to receive, display and send messages through it:

• WhatsApp (WhatsApp Business Platform / Cloud API, including coexistence with the WhatsApp Business app): identifiers of the WhatsApp Business Account (WABA), phone number and business portfolio, access tokens issued by Meta, message templates, the content of messages sent and received (text, images, voice notes, videos, documents, locations and shared contacts), delivery and read statuses, and the profile name and phone number of the people who message the Customer.
• Instagram and Facebook Messenger: identifiers of the Facebook Page and Instagram professional account, access tokens, the content of direct messages, story replies and mentions, and profile data made available by Meta about senders (such as name, username and profile picture).
• Email: the address and credentials or access tokens of the connected mailbox, and the content, attachments and metadata of messages.
• Website chat: visitor identifier, messages, name and email when provided, IP address, browser, operating system, language and the page where the chat was opened.

3.3. Contacts and CRM data

Contacts, companies, notes, labels, custom attributes and other information that the Customer's users create or import in Zailor.

3.4. Usage and technical data

IP address, access date and time, device and browser type, pages and features used, error logs, and security and audit logs.

3.5. Artificial intelligence features

When the Customer enables Captain or other AI features, the content of conversations and of the knowledge base (such as help center articles and uploaded documents) is processed to generate replies, suggestions and summaries.

3.6. Cookies

See Cookies and similar technologies.

4. Why we use data and legal bases

Purpose	Legal basis (LGPD art. 7 / GDPR art. 6)
Create and maintain your account, authenticate users and provide the Service	Performance of a contract
Receive, display, organize and send messages from connected channels on the Customer's behalf	Performance of a contract (with the Customer, who is the controller of that data)
Generate AI replies, suggestions and summaries, when enabled by the Customer	Performance of a contract
Support, Service communications and important notices	Performance of a contract and legitimate interests
Security, fraud and abuse prevention, and improving Service reliability	Legitimate interests
Complying with legal and regulatory obligations, and defending legal claims	Legal obligation and regular exercise of rights

We do not sell personal data and do not use it for advertising.

5. Data from Meta platforms

Zailor connects to WhatsApp, Instagram and Facebook Messenger only through Meta's official APIs, with the permissions the Customer grants when connecting their accounts. Regarding data obtained from these platforms ("Platform Data"), we commit to:

• use it only to provide the Service to the Customer who connected the account, such as receiving and sending messages, listing connected accounts and numbers, and managing message templates;
• not sell or license it, or use it for advertising, marketing profiles or any purpose unrelated to the Service;
• not use conversation content to train artificial intelligence models;
• share it only with the processors needed to provide the Service (section 6), under confidentiality and security obligations;
• delete it when the Customer disconnects the channel, deletes the inbox or account, removes Zailor's access in Meta settings, or when we receive a valid deletion request, as described in our data deletion instructions;
• comply with Meta's Platform Terms and Developer Policies, the WhatsApp Business Policy and other applicable policies.

6. Who we share data with

• Meta Platforms (including WhatsApp, Instagram and Facebook): to deliver the messages the Customer sends and receive those arriving through connected channels. Meta processes this data under its own terms and privacy policies.
• Email providers connected by the Customer (such as Google or Microsoft), to receive and send email.
• Processors that help us provide the Service: cloud infrastructure and hosting providers, file storage, transactional email delivery, error monitoring, AI model providers (only when AI features are enabled) and, where applicable, payment processing. These processors may only use the data to provide services to Workbits.
• Authorities: when required by law, court order or a request from a competent authority.
• Corporate transactions: in the event of a merger, acquisition or asset sale, with the protections of this policy maintained.

The Customer may also connect integrations and webhooks that send data to systems of their choice. In those cases, sharing happens at the Customer's decision and under the Customer's responsibility.

7. International transfers

Some of our processors, including Meta and infrastructure and AI providers, may process data outside Brazil or the European Economic Area, for example in the United States. In those cases, we apply the safeguards provided for in articles 33 to 36 of the LGPD and Chapter V of the GDPR, such as standard contractual clauses and the use of providers with adequate data protection guarantees.

8. How long we keep data

• Account data: while the account is active. When an administrator deletes the account in the app, it is scheduled for deletion in 7 days (during which the deletion can be cancelled) and its data is then deleted.
• Messages, contacts and CRM data: for as long as the Customer keeps the account and the related inbox, or until the Customer deletes them. Deleting an inbox also deletes its conversations.
• Channel access tokens: deleted when the channel is disconnected, when the inbox or account is deleted, or when access is revoked on the source platform.
• Backups: deleted data may remain in backups for up to 90 days until it is overwritten.
• Access logs: kept for 6 months as required by Brazil's Marco Civil da Internet (Law 12,965/2014), or longer when required by law or needed to defend legal claims.

Deletion requests made by email are completed within 30 days, as described in our data deletion instructions.

9. Security

We use technical and organizational measures to protect data, such as encryption in transit (HTTPS/TLS), hashed passwords, role-based access control, least-privilege access, audit logs and backups. No system is completely free of risk; if a security incident occurs that may cause relevant risk or harm, we will notify affected people and the competent authorities, such as Brazil's ANPD, as required by law.

10. Your rights (LGPD and GDPR)

Under article 18 of the LGPD and articles 15 to 22 of the GDPR, you may request:

• confirmation that we process your data and access to it;
• correction of incomplete, inaccurate or outdated data;
• anonymization, blocking or deletion of unnecessary or excessive data, or data processed unlawfully;
• deletion of your personal data, except where the law requires us to keep it;
• portability of your data to another provider;
• information about the entities we share data with;
• information about the possibility of not giving consent and its consequences, and withdrawal of consent where consent is the legal basis;
• objection to and restriction of processing, where provided by law;
• review of decisions made solely on the basis of automated processing.

To exercise your rights, email suporte@zailor.io. We may ask for information to confirm your identity. We respond within the legal deadlines (up to 15 days for the full statement under the LGPD and up to one month under the GDPR). If the data belongs to a Zailor Customer, we will forward your request to them and support them in handling it.

You may also lodge a complaint with Brazil's National Data Protection Authority (ANPD) or, if you are in the European Union, with your local data protection authority.

11. Cookies and similar technologies

• zailor.io website: we do not use advertising or tracking cookies.
• Application (app.zailor.io): we use strictly necessary cookies and local storage to keep you signed in, authenticate requests, protect against fraud and remember preferences such as language.
• Chat widget on Customer websites: uses cookies or local storage to identify the visitor's session and keep the conversation history in the same browser.

You can delete or block cookies in your browser settings, but some features may stop working.

12. Children

Zailor is intended for businesses and professionals and is not directed at anyone under 18. We do not knowingly collect children's data to create accounts.

13. Changes to this policy

We may update this policy to reflect changes to the Service or the law. We will publish the new version on this page with its update date and notify Customers of material changes.

14. Contact

Workbits, operator of Zailor. Email: suporte@zailor.io.

This English version is provided for convenience. If there is any conflict between versions, the Portuguese version prevails for users in Brazil.