Privacy Policy
How Zelo handles personal data on this website and on the platform, under the Brazilian General Data Protection Law (LGPD, Law 13.709/2018).
1. Who is responsible
Zelo is the controller for account data and the security logs used to protect the service. For operational content created by your team, your company is the controller and Zelo acts as its processor, under your company's instructions. Requests about that content are handled by your company administrator.
Zelo is also the controller for the data you send through this website's forms. Platform users see the privacy notice inside the product and accept it by version; the version identifier at the top of this page matches the one recorded with each acceptance.
2. What we collect
On this website. Name, email, company, role and message, when you send a contact or demo form. This website sets no cookies, and visits are counted without identifying you.
Account and security data. Name, email, optional profile photo and country, and the company you belong to; login timestamps, IP addresses and failed login attempts, kept to protect accounts.
Operational content. Material catalogues, requests, picking status and the records your team enters while handling them.
3. WhatsApp requests (optional)
If your company turns on WhatsApp requests and you link your number, we keep your WhatsApp phone number, the company it is authorized for, and when the authorization expires (30 days, renewable). Messages exchanged with Zelo are used only to build your material request. Their content is erased once each message is processed, and an unfinished request is erased about 30 minutes after your last message. We keep delivery and processing records without message content.
4. Why we process it
Account data and operational content are processed to perform the service contract with your company (LGPD art. 7, V). Security logs are processed under our legitimate interest in preventing fraud and unauthorized access (LGPD art. 7, IX).
Linking your WhatsApp number and processing your WhatsApp requests performs the service your company contracted, at your request (LGPD art. 7, V).
Data sent through this website's forms is used to answer you and prepare a quote, at your request (LGPD art. 7, V).
5. Cookies
On the platform we use only cookies needed to run the service: session, form protection (CSRF), language and, if your company enables it, remembering this device for two-factor sign-in. We set no advertising or cross-site tracking cookies. This website sets no cookies. See the details in Cookie Settings.
6. How long we keep it
Account data is kept while your account is active. Security logs are deleted after 12 months. When an account is removed, personal identifiers are erased or anonymized; records needed for the company's operating history remain in anonymized form.
Your WhatsApp number is kept while at least one company authorization is linked to it; disconnecting the last company releases it. Records without message content stay with your company's request history.
Data sent through this website's forms is kept for up to 3 years from your last contact with us.
7. Who processes data on our behalf
Data is stored with cloud providers acting as processors: application hosting and database, file storage on encrypted object storage, and a content-delivery and security layer. Some processors handle data outside Brazil under their standard contractual safeguards (LGPD art. 33).
On this website, hosting and cookieless visit counting are provided by Vercel, and form submissions are delivered to us by Formspree.
Meta (WhatsApp). Messages between you and Zelo travel through the WhatsApp Business Platform, operated by Meta Platforms, which receives your phone number and the content of those messages to deliver them. Meta processes this data outside Brazil under its terms for that platform. Your own use of WhatsApp is governed by WhatsApp's privacy policy.
Anthropic (AI reading of requests). When a free-text request arrives over WhatsApp, its text is sent to Anthropic, PBC (Claude), in the United States, together with the items already in that request and the codes, names, units and descriptions of your company's active materials, so the model can propose catalogue items, quantities and dates. We don't send phone numbers, user names or the company name. Anthropic processes this data as our processor under commercial terms that don't allow it to be used to train AI models, and keeps it only for a limited period. Every proposal is checked by Zelo and confirmed by you before a request is created. The international transfer relies on contractual safeguards (LGPD art. 33).
8. Your rights
Under LGPD art. 18 you may request confirmation of processing, access, correction, anonymization or deletion of your personal data, and information about sharing. Contact your company administrator or write to us, and we will respond within the legal timeframe.
9. Changes to this policy
Each revision of this policy gets a new version identifier, shown at the top of the page. Platform users are asked to accept the new version the next time they sign in.
10. Contact
Controller for account and security data: Zelo. Write to privacidade@zelosepara.com.br or contact us.
You may also lodge a complaint with Brazil's National Data Protection Authority (ANPD).