Privacy Policy

1. Who is responsible

Zera Company, located at Rua Paraná, 2361, Cascavel, Paraná, Brazil, is the controller of the personal data processed on this site, under Law 13.709/2018, the Lei Geral de Proteção de Dados Pessoais (LGPD, Brazil's General Personal Data Protection Law).

The channel for anything about personal data, including access and deletion requests, is [email protected]. That is where the data protection officer (the "encarregado" under the LGPD) responds, as provided in Article 41 of the LGPD.

2. Sign-up data

When you fill in the form at app.zeracompany.com/en/start, we collect and store the following, and nothing else:

Your name, email, WhatsApp, company, role in the company, the plan you chose and the source of the visit are also recorded in ZeraCRM, Zera's own customer relationship system, so that the team can follow your subscription. Later, the number form, the connection and the confirmed purchase are recorded there too, with the document and the address you gave the payment provider.

If the database fails in the middle of sign-up, the raw request is kept for up to 30 days in a temporary area, so that it is not lost and can be completed manually. After that period, this temporary record is deleted automatically.

3. Diagnosis data

The form at zeracompany.com/contato collects name, company, email, WhatsApp and your answers about industry, conversation volume, team size, what you want to automate, which systems you use and the text in which you describe the problem. We also store IP, browser identification, the consent text and the source of the visit.

The legal basis here is consent, Article 7, I, of the LGPD, which you give by checking the authorization box in the form. This data serves one purpose only: studying your case and replying. It does not go into any mass-messaging list and is not used for any other purpose without new consent.

The diagnosis record is deleted automatically after 180 days, counted from submission, unless you become a customer during that period, in which case it becomes part of the account history.

A summary of the request is also sent to the team's internal channel on Discord, so that someone sees it and replies. It contains name, company, email, WhatsApp and the beginning of the text you wrote.

4. Plan-choice guide data

The guide at app.zeracompany.com/en/discover, also in Portuguese and in Spanish, asks a few questions about your customer service and shows which plan suits you. To show the recommendation, it asks for your name and an email. When you submit, we record the following, and nothing else:

The legal basis is Article 7, items V and IX, of the LGPD: you asked for the recommendation, and talking to you about it is a step prior to a possible subscription, in your interest and in ours. That is why this screen does not ask for separate authorization. If you subscribe later, the account created is linked to this record, so that we know the subscription came from the guide.

Besides our database, two copies go out at the moment of submission. A notice goes to the team's internal channel on Discord, with your name, your email, the first answer, the recommendation with the price shown and the campaign source. And a record goes to ZeraCRM, Zera's own customer relationship system, with your name, your email, the first answer, the recommendation with the price shown, the language and the source of the visit, so that someone on the team can contact you. The step measurement by Meta and Google, described in section 5, also applies to the guide.

For how long. There is currently no automatic deletion of the guide record: it stays stored until you request deletion. If you subscribe, it becomes part of your account history, with the periods in section 10.

How to request deletion. Write to [email protected], from the same email you used in the guide, requesting deletion. We delete the guide record in our database, the copy kept in the queue for ZeraCRM, the record in ZeraCRM and the notice in the team's internal channel on Discord, and we confirm in writing within the period in section 11, stating what was deleted. The measurement notice already sent to Meta and Google, described in section 5, stays with those companies and we are not able to delete it. If you subscribed, the record is part of the account history and follows the rules in section 12. If you only want us to stop contacting you, say so in the same email.

5. Dashboard access and cookies

The dashboard opens in two ways, and you choose. You can sign in with email and password, which you set at sign-up or later, inside the account. And you can sign in through the email link: you request access, receive a link and, when you click it, the browser gets a session cookie. Anyone who has never set a password keeps signing in through the link, as they always have.

• We do not store your password in the database, nor a scrambled version of it that can be reversed. We store the output of a slow derivation function, designed to be expensive for anyone trying to guess it. Someone who read our entire database would not have your password.
• We do not store the link or the cookie either, but a cryptographic fingerprint of them. Someone who read our entire database could not get into any account.
• Alongside the session we keep the creation date, the IP and the browser identification, so that you can terminate an access you do not recognize.
• The email link is valid for a few minutes. The session cookie is valid for up to 30 days and is marked HttpOnly and Secure, which prevents any page JavaScript from reading it.

No page on this site loads another company's script. There is no Meta pixel, Google tag, session recorder or ad network running inside the page here. As a consequence, there is no third-party cookie either: every cookie on this list is written by the very address you are reading.

There are three, and each does one thing only:

How we measure, and who this is shared with. When you move forward in the recommendation form or complete the sign-up, our server notifies Meta and Google Analytics that that step happened. The notification goes out from our server, not from your browser. What it contains: which step it was, which path of the form you followed, the IP address, the browser identification, the campaign parameters and, at the moment you leave your email, your email and your first name scrambled by a one-way cryptographic function, in the format these companies require to recognize a sign-up without receiving the readable text. The legal basis is the legitimate interest in measuring the effectiveness of our own advertising, under Article 7, item IX, of the LGPD.

Opting out of measurement. Blocking this site's cookies in your browser only prevents zorigem and zmid from being stored; not zs_sess, because without it the dashboard does not open. The step notice leaves our server even without a cookie, with a disposable identifier, and today we have no way to switch off measurement for a single person. If you do not want to be measured, do not fill in the guide or the sign-up form. To delete what we already hold, write to [email protected] requesting deletion, as described in section 4. The notice already sent to Meta and Google stays with those companies.

6. Payment data

The card number, the security code and the expiration date never pass through our servers and are never recorded by us. You type this data into a surface hosted by the payment provider, and what reaches us is only the card's secure identifier, the card brand and the last four digits, which let you recognize which card is registered.

This is not an engineering detail, it is a risk decision: transmitting the card number, even without storing it, would already put Zera in a compliance scope we do not have, and a single debug record would be enough to write a customer's card into a log.

7. Your customers' conversations

When you use the inbox, the people talking to your number are your customers. In these conversations, you are the controller of the data and Zera is the processor, under Article 5, items VI and VII, of the LGPD: we process this data following your instructions and the purpose you defined.

In practice, this means it is up to you to inform your customers how you handle their data, and it is up to us to keep your account isolated from other customers' accounts, deliver an export when you ask and delete when you tell us to.

We do not use your customers' conversations to train any artificial intelligence model, neither ours nor a third party's.

8. Who we share with

We do not sell personal data and we do not pass the contact list on to anyone. Sharing exists only with the companies needed for the service to work, each with a specific piece:

We may also share data when there is a court order or a request from a competent authority. In that case, we notify you, unless the order itself prohibits notice.

9. Data outside Brazil

The ZeraSync platform, the automations and ZeraCRM run on a Zera server in the United States. That is where the conversations and contacts in the inbox and the ZeraCRM records described in section 8 are kept.

In addition, Meta, Google, Asaas, Resend, Cloudflare and Discord may process and store data on servers outside Brazil. This is an international data transfer, governed by Article 33 of the LGPD, and it happens because it is necessary to perform the contract you entered into with Zera, to fulfill the recommendation request you made in the plan-choice guide and, in the case of the diagnosis, on the basis of your consent.

For these transfers, each company's own data protection terms currently apply. We are still reviewing these contracts, one by one, against the ANPD standard contractual clauses (ANPD Resolution CD/ANPD No. 19/2024). If you do not want your data to leave the country, the service cannot be provided, because the WhatsApp API itself runs on Meta's infrastructure and the ZeraSync platform runs on the server in the United States.

10. How long we keep data

• Account and contract data: while the subscription exists, and for 5 more years after it ends, the retention period for tax documents and for defense in any collection or complaint.
• Diagnosis: 180 days, with automatic deletion.
• Plan-choice guide: no automatic deletion; it stays stored until you request deletion, or moves to the account history if you subscribe.
• Sign-up kept due to a technical failure: 30 days, with automatic deletion.
• Sessions and access links: deleted when they expire or when you sign out.
• Conversations on the platform: while your account exists, or until you request deletion. Access to the platform lasts until the end of the period you have already paid for, both on cancellation and on non-payment: once that period ends without payment, your account on the ZeraSync platform is suspended. The login remains, but the service dashboard and the conversations are blocked, and the suspension deletes nothing. On non-payment, once the payment is confirmed within the 30 days of suspension, the account comes back as it was; after 30 days of suspension without payment, the subscription is cancelled automatically, as the Terms of Use state, and the cancellation deletes nothing. From the end of the paid period, you have 30 days to request the export of the conversations through support, at [email protected], and they remain stored during that period. After the 30 days, we no longer guarantee the export and the conversations may be removed. This removal is not automatic today: if you want them deleted, request deletion as in section 12.
• Billing and invoice (nota fiscal) records: 5 years, as required by tax law. These cannot be deleted on request.

11. Your rights

Article 18 of the LGPD guarantees that you may request, at any time:

• confirmation that we process your data, and access to it;
• correction of incomplete, inaccurate or outdated data;
• anonymization, blocking or deletion of unnecessary or excessive data, or data processed unlawfully;
• portability of the data to another provider;
• deletion of the data processed on the basis of your consent;
• information about who we share your data with;
• information about the possibility of not consenting, and what happens if you refuse;
• withdrawal of consent, at any time.

We respond within 15 days, which is the period in Article 19 of the LGPD for the complete response. You may also file a complaint directly with the National Data Protection Authority (Autoridade Nacional de Proteção de Dados), as provided in Article 18, paragraph 1.

12. How to request deletion

1. Write to [email protected] with the subject exclusão de dados (data deletion), from the same email that is registered.
2. If the request comes from another address, we will confirm your identity before deleting. This protects you: deleting an account at anyone's request would be the most serious failure possible.
3. We confirm receipt and tell you what will be deleted and what the law requires us to keep, with the period for each item.
4. We carry it out and send written confirmation, within the 15-day period.

Requesting deletion of the account data ends the service, because there is no way to keep the number running without the registration. If what you want is only to stop commercial contact, say so and we delete only the diagnosis and contact record, keeping the account.

13. Security and incidents

What we do, concretely: traffic always over HTTPS; secrets and keys stored outside the code; access token recorded only as a cryptographic fingerprint; card data beyond our reach; customer accounts isolated from one another; and internal access restricted to those who operate the platform.

No system is immune. If a security incident occurs with relevant risk to your data, we notify you and the National Data Protection Authority, as required by Article 48 of the LGPD, stating what happened, which data was affected and what we are doing. We will not hide an incident behind a generic notice.

14. What we do not do

• We do not sell, rent or trade personal data.
• We do not use your customers' conversations to train artificial intelligence models.
• We do not do behavioral profiling of visitors to this site.
• We do not store card numbers, security codes or expiration dates.
• We do not send advertising email to anyone who only requested a diagnosis.

15. Changes to this policy

When this policy changes in a relevant way, we notify active customers by email and update the date at the end of the page. A change that broadens the purpose of use of data collected with consent requires new consent, not a notice.

Version 3, updated on October 4, 2026: Zera's server in the United States, a single email for data requests, the access rule on cancellation and non-payment, what is deleted on a request to delete the guide record, and what can and cannot be refused in measurement. On the same date, the wording of section 10 was corrected to state that, at the end of the paid period, the account on the platform is suspended, the login remains and nothing is deleted. On October 5, 2026, section 10 started stating that, after 30 days of suspension without payment, the subscription is cancelled automatically, without deleting anything. Version 2, of October 3, 2026, added section 4, on the plan-choice guide. Version 1 was in force from July 28, 2026. The rules of the service agreement are in the Terms of Use.