This Privacy Policy explains how ZAVORA SAS ("Zavora", "we") handles personal data of visitors to zavorai.com, of the businesses that use our Service and their users, and of the people who message those businesses through our AI agents. People in Colombia are covered by our Spanish-language policies.
Summary
- We do not sell personal data and do not share it for cross-context behavioral advertising.
- We do not use your conversations to train AI models, and we contract our AI providers under terms that exclude training on your content.
- Our website and dashboard use only essential cookies.
- When you message a business that uses Zavora, that business decides how your data is used; we process it on its behalf.
1. Our role
For data of website visitors and of our business customers' account users, Zavora is the business (controller) responsible for it. For data of people who message our customers' WhatsApp lines ("End Customers"), Zavora is a service provider (processor) acting on the instructions of that business, which is responsible for its own privacy notice. End Customers should direct privacy requests to that business; we will help it respond.
2. Personal data we collect
| Category | Examples | Source |
|---|---|---|
| Identifiers and contact data | Name, email, phone number, business name and address | You, when you register, book a demo or contact us |
| Commercial information | Plan, billing records, orders processed through the Service | You and the Service |
| Messages and content | WhatsApp messages, voice notes, images, catalogs | End Customers and our business customers |
| WhatsApp profile data | Profile name and phone number sent by Meta when someone writes to a business | Meta, via Twilio |
| Internet activity | IP address, browser type, access logs, actions in the dashboard | Your device |
| Payment references | Payment status and references (not full card numbers) | Payment processors |
We do not intentionally collect sensitive personal information, and we ask End Customers not to send health data, government ID numbers or full payment card numbers to an AI agent.
3. How we use personal data
- to provide the Service: interpret messages, build orders, send replies and notifications;
- to operate the website, answer inquiries and schedule demos;
- to bill, keep accounting records and meet legal obligations;
- to secure the Service and prevent fraud and abuse;
- to improve the Service using usage metrics and aggregated or de-identified data;
- to send service communications and, only with consent where required, marketing communications.
4. How we use artificial intelligence
Zavora uses AI to interpret customer messages, transcribe voice notes, read catalogs, draft the agent's replies and power the business assistant in the dashboard. We access AI models from third-party providers as a service; we do not train our own models on your data. AI does not make decisions with legal or similarly significant effects about anyone: businesses can review and edit every order, End Customers confirm orders, and anyone can ask to talk to a person.
5. Service providers and disclosures
We disclose personal data only to providers that help us run the Service, under contracts that limit their use of it, and to authorities when the law requires it.
| Provider | Purpose | Location |
|---|---|---|
| Twilio | Sending and receiving WhatsApp messages | United States |
| Microsoft Azure (including Azure OpenAI Service) | Hosting, storage, email, AI models | United States / European Union |
| Groq | AI model for the dashboard assistant | United States |
| Neon | Database | United States |
| Mercado Pago | Payment links, where available | Colombia / Argentina |
Messages an End Customer sends to a business are visible to that business in its dashboard. If Zavora is involved in a merger or acquisition, personal data may be transferred as part of it, subject to this Policy.
6. International transfers
Zavora is based in Colombia, and personal data is processed in the United States, the European Union and Colombia. We protect transfers with contractual safeguards with our providers.
7. Retention
- Business account data: while the account is active and up to five years after, for accounting, tax and legal purposes.
- End Customer data: while the business keeps its account active, or until it instructs deletion.
- Website logs: 12 to 24 months.
- De-identified or aggregated data: without a fixed limit.
8. Cookies
The dashboard uses only essential cookies to keep you signed in and protect against cross-site request forgery. The website does not use advertising cookies. If we add analytics, we will update this Policy and ask for consent where the law requires it. We treat Global Privacy Control signals as a request to opt out of sale or sharing, although we do neither.
9. Privacy rights for US residents
Depending on your state (including California, Colorado, Connecticut, Virginia, Texas and others with similar laws), you may have the right to:
- know what personal data we collect, use and disclose, and access a copy of it;
- correct inaccurate personal data;
- delete personal data, subject to legal exceptions;
- opt out of the sale or sharing of personal data, targeted advertising and profiling (we do not engage in these);
- appeal our decision on your request;
- not be discriminated against for exercising these rights.
To exercise them, email zavora845@gmail.com with the subject "Privacy request". We will verify your identity using information we already have and respond within 45 days, which we may extend once by 45 days when reasonably necessary. You may use an authorized agent, who must provide proof of authorization. If you are an End Customer of a business that uses Zavora, we will forward your request to that business.
California notice at collection. The categories of personal information we collect, their sources, purposes and recipients, and how long we keep them are described in Sections 2, 3, 5 and 7. In the past 12 months we have not sold or shared personal information, and we do not knowingly sell or share the personal information of consumers under 16.
10. Rights outside the US
If you are in another country, you may have rights under local law, such as access, correction, deletion and objection. Contact us at the email above and we will respond as the applicable law requires.
Brazil (LGPD). If you are in Brazil, you may ask us to confirm whether we process your data, access, correct, anonymize, block or delete it, request portability, obtain information about the entities we share it with, and revoke consent, under Law No. 13,709/2018. You may also file a complaint with the National Data Protection Authority (ANPD). Write to the email above with the subject "LGPD request".
11. Security
We use encryption in transit (TLS 1.2+) and at rest, per-business isolation in the database (row-level security), hashed passwords, role-based access, secure session cookies and audit logs. No system is perfectly secure; if an incident affects your personal data, we will notify you and authorities as the law requires.
12. Children
The Service is for businesses. We do not knowingly collect personal data from children under 13, and we will delete it if we learn we have.
13. Changes
We will post updates on this page with a new effective date and notify business customers of material changes by email or in the dashboard.
14. Contact
ZAVORA SAS · NIT 902053100-8 · Bogotá D.C., Colombia · zavora845@gmail.com