Privacy Policy

Zorgen Tecnologia LTDA, registered under Brazilian company number (CNPJ) 30.164.142/0001-55, is responsible for this policy. Requests about privacy and personal data are received at privacidade@zorgen.tech.

There are two different contexts here, and Zorgen's role differs between them:

• On zorgen.tech, Zorgen is the controller: we decide which data is collected and why.
• In the support assistant (the bot answering on a client company's WhatsApp), the company that hired the service is the controller. Zorgen acts as processor, handling data on that company's instructions, under article 5 of Brazil's data protection law (LGPD, Law 13.709/2018). If you talked to a company's assistant, that company is the first door for your requests, and we support them in answering.

• Contact form: your name, email, phone number and the message you write. Used only to answer you.
• Technical access data: IP address, browser and pages visited, logged by the server for security and diagnostics.

The site uses no advertising cookies, no cross-site tracking and no analytics tools. The only data stored in your browser is what the page needs to work.

When you talk to an assistant operated by Zorgen on a client company's WhatsApp, we process:

• the phone number and profile name WhatsApp provides;
• the content of the messages you send and of the replies sent to you;
• identifiers you provide for identity verification, such as a company or personal tax ID, when the request involves a restricted document;
• the documents and information the client company makes available for the assistant to deliver to you.

Conversation content is processed by artificial intelligence providers contracted by Zorgen, under commercial agreements that prohibit using that content to train models.

• Answering your contact from the website: consent, given when you submit the form, and pre-contractual steps (LGPD art. 7, I and V).
• Providing automated support: performance of the contract between you and the client company, and that company's legitimate interest in serving whoever approaches it (art. 7, V and IX).
• Security, fraud prevention and audit logging: legitimate interest and compliance with legal obligations (art. 7, II and IX).

We do not sell personal data and do not hand it to third parties for their own commercial use. We share only with those needed for the service to work:

• Meta Platforms, which operates the WhatsApp the conversation travels through;
• artificial intelligence providers, which generate the assistant's replies;
• cloud infrastructure providers, which host the application and the database;
• the client company, which is the recipient of the support request and your controller.

Some of these providers operate outside Brazil. In those cases the international transfer follows the contractual clauses and safeguards required by article 33 of the LGPD.

Contact messages from the website are kept for the duration of the relationship and, after that, for as long as needed to defend against a possible claim. Assistant conversation history is kept while the contract with the client company is in force, unless that company sets a different period or the law requires one. Once the period ends, data is deleted or anonymised.

The LGPD gives you, among others, the right to confirm that processing exists, access your data, correct incomplete or outdated data, request anonymisation, blocking or deletion, request portability, withdraw consent and be told who we share data with.

To exercise any of these, write to privacidade@zorgen.tech. We answer within 15 days. To delete the data from a conversation with the assistant, the detailed route is on the data deletion page.

Credentials and integration secrets are encrypted and kept out of the source code. Access to support data is restricted to those who need it to operate the service, and actions affecting third-party data are recorded in an audit log. No measure removes risk entirely: if a relevant security incident occurs, we notify the controlling company and Brazil's data protection authority under article 48 of the LGPD.

We may update this document to reflect changes in the service or in the law. The effective date at the top of the page indicates the current version, and material changes are communicated to client companies.