Privacy Policy

GeZap is a platform for management, service, scheduling, digital communication, campaigns, and integrations with external channels such as WhatsApp Business, email, calendar services, and social authentication providers.

In many cases, data is controlled by the contracting company that uses GeZap. In these scenarios, GeZap acts as supporting technology to process, store, audit, and protect information according to the settings and permissions defined by the responsible company.

• System user data, such as name, email, permissions, and access history.
• Customer, lead, professional, service, resource, and appointment data.
• Session, service, campaign, and notification records.
• Communication messages and metadata, such as sending, delivery, and read status.
• WhatsApp Business integration data, business account identifiers, connected phone numbers, templates, categories, languages, statuses, and technical events.
• Technical audit, authentication, security, log, and integration event data.

• Enable secure system access and user permission control.
• Organize scheduling, service, sessions, and operational history.
• Send messages, notifications, reminders, and communications configured by the company.
• Create, view, and manage WhatsApp message templates.
• Track delivery, read, failure, template approval, and other events required for integrations.
• Record audits, prevent misuse, and preserve traceability.
• Improve platform stability, security, support, and operation.

The system may allow login through providers such as Google, Facebook, and GitHub. In these cases, GeZap uses only the minimum information needed to authenticate the user, such as technical identifiers and the email linked to the social account.

Users can revoke the social link under User > My Settings, in the linked accounts section. Public instructions are available at Social Data Exclusion.

GeZap may integrate with external services to send messages, notifications, appointment confirmations, campaigns, reminders, location information, emails, and calendar events. These channels depend on the contracting company's settings and the respective providers' policies.

Message statuses, sending identifiers, webhook events, and technical metadata may be stored for audit, support, queue processing, and communication tracking.

GeZap may use Meta APIs, including the WhatsApp Business Platform, so contracting companies can connect WhatsApp Business accounts, send messages, create and manage templates, track delivery status, and process technical communication events.

The permissions whatsapp_business_messaging and whatsapp_business_management are used only to provide, operate, audit, protect, and support contracted features.

GeZap does not sell data obtained through Meta APIs and does not use that data for purposes independent from providing the contracted service.

Contracting companies may connect Instagram professional accounts and Facebook Pages to GeZap to receive and answer their customers' messages through those channels. The connection is made by the company itself, with the Meta permissions it grants, and the company can undo it at any time. This section describes how the data of those conversations is processed.

The data that reaches us from Meta, with each message, is:

• The contact identifier on the account or Page (an ID assigned by Meta).
• The contact's name and username, when Meta makes them available.
• The text of the messages sent and received.
• The message attachments, such as images, audio, video and files.
• Technical identifiers and message delivery and read events.

We use this data only to receive, display, store and answer conversations inside GeZap, including through the artificial-intelligence secretary the company configured, to keep the service history, for security and audit, and to support the contracting company. We do not sell this data, we do not use it for advertising and we do not use it for purposes independent from the contracted service.

When the company turns on the artificial-intelligence secretary, it replies on the company's behalf and identifies itself to the contact as an automated service. GeZap does not send promotional messages through those channels and never starts a conversation: it only replies to whoever wrote first.

In these conversations, the contracting company is the controller of the data of the contacts who reach it, and GeZap acts as processor, handling that data according to the company's instructions and retention policy. The message text is sent to the artificial-intelligence provider GeZap contracts (OpenAI) to generate the secretary's replies; that provider does not use this data to train its models. The data is also stored with the hosting and file-storage providers that serve GeZap. We do not share it with anyone else for other purposes.

The content of conversations and attachments is kept for the time set in the retention policy the contracting company configures in GeZap and, after the contract ends, for the period described in the Terms of Use. The access tokens for the account or Page are deleted when the company disconnects it, when the GeZap app is removed or de-authorized in Meta's settings, or when the company's account is cancelled.

Anyone who talked to a company through Instagram or Facebook and wants to access, correct or delete their data should make the request to the company itself, which is the controller. You can also write to privacy@gezap.com.br or, for data tied to the Meta/Facebook app, to support@gezap.com.br with the subject Meta/Facebook data deletion request. More details on the Social Data Exclusion page.

Meta processes on its own account the data generated inside Instagram and Facebook, under its own policies. This policy describes only the processing done by GeZap.

• Passwords are stored using irreversible encryption.
• System access is controlled by authentication and permissions.
• Two-factor authentication (2FA) is available and, when enabled by the user, requires a temporary code from the authenticator app at each login, strengthening account protection.
• Relevant operations may be audited to track responsible users and timestamps.
• Each company's data is separated through logical multi-company controls.
• Backups and technical controls may be used for availability and recovery.

GeZap does not sell personal data. Data may be shared only when necessary for platform operation, legal compliance, technical support, integrations configured by the contracting company, or execution of contracted services.

When the contracting company uses external integrations, minimum necessary data may be sent to configured providers such as Meta, WhatsApp Business Platform, email, calendar, storage, authentication, infrastructure, and support services.

Data is retained while there is a relationship with the responsible company, operational need, legal obligation, security, audit, or another applicable legitimate basis.

Tokens, permissions, and technical integration identifiers may be revoked or removed when the company disconnects the integration, when the user unlinks a social account, or when deletion is requested through applicable channels.

Under applicable law, data subjects may request information about data processing, correction, deletion, portability, restriction, or consent withdrawal when applicable.

When the request involves social login data, Meta/Facebook accounts, or other external providers connected to GeZap, the user may also follow the instructions at Social Data Exclusion or request support at support@gezap.com.br.

Requests related to data maintained by a specific company should be directed to the administrator responsible for that company's environment. For GeZap platform matters, use the contacts in the footer.

This Privacy Policy may be updated to reflect legal, operational, technical, or functional changes. The current version will always be publicly available on this page.