Privacy Policy
How Ziint collects, uses, shares and protects personal data on the ziint.com website, the Ziint platform and Ziint Agents, including data we receive from Google. This policy follows Brazil's General Data Protection Law (LGPD, Law 13,709/2018) and the Google API Services User Data Policy. The Portuguese version prevails in case of conflict.
At a glance
- We don't sell dataNo personal data is sold or used for advertising, including data received from Google.
- Google data only for what you askedSign-in: we identify your account. Calendar: we check availability and book the appointments the agent agreed with the customer.
- No AI trainingGoogle user data and client data are never used to train generalized artificial intelligence models.
- You're in controlRequest access, correction or deletion at contato@ziint.com. We reply within 15 days.
01Who we are
Ziint Consultoria e Desenvolvimento LTDA (“Ziint”), a Brazilian company registered under CNPJ 49.724.906/0001-48, headquartered at Rua Doutor Helvécio Arantes, 110, Luxemburgo, Belo Horizonte/MG, CEP 30380-465, Brazil, is responsible for this policy.
It covers:
- the ziint.com website, including the platform pages at ziint.com/platform;
- the Ziint platform (app.ziint.com and mobile apps): field data collection, forms, workflows, dashboards, AI agents and electronic signature;
- Ziint Agents (agents.ziint.com): AI customer-service agents for WhatsApp, website chat and API, with an optional Google Calendar integration.
When we are controller and when we are processor
- Controller: we act as controller for data about website visitors, people who contact us through the contact form, and account registration and usage data on our platforms.
- Processor: data that a client company records on the platforms (form responses, photos, documents, customer contacts, appointments) belongs to that company. The client company is the controller, and Ziint processes the data only to provide the service, following the client's instructions and the agreement. If you are an employee or customer of a company that uses Ziint, please also read that company's policy.
02Privacy contact and data protection officer
Ziint is a small processing agent (micro-enterprise) and is therefore exempt from appointing a data protection officer (encarregado) under art. 11 of ANPD Resolution CD/ANPD No. 2/2022. Instead, we keep a dedicated channel for data subjects and for Brazil's National Data Protection Authority (ANPD):
Write “Privacy” in the subject line so your message is prioritized.
03Data we collect
Data you provide
- Website contact and proposal forms: name, company, email, phone, interest and your message. In the plan calculator, also your configuration choices.
- Platform registration: name, email, phone, Brazilian taxpayer ID (CPF) and employee number when the client company requires them, optional profile photo, company, access role and password (stored only as a cryptographic hash).
- Content recorded while using the platforms (on behalf of the client company): form responses, photos, audio, video, documents, comments, messages exchanged with customer-service agents and contact details.
- Electronic signature: signer's name, email, phone and CPF, signature image and, when the document requires it, a liveness selfie.
Data collected automatically
- Access logs: IP address, date and time, browser and operating system (user agent) and security-relevant actions such as sign-in, password changes and document signatures.
- Location: when a form asks for it, the platform records the device's GPS coordinates and photo metadata (capture date, time and place). For electronic signatures, we record the approximate location derived from the IP address.
- Technical device data for offline use and notifications: local storage, push notification subscription and error information.
Data received from Google
We receive Google data in two situations, always at your initiative and through Google's own consent screen, which shows exactly what will be shared:
| Feature | Permissions (scopes) | Data we access |
|---|---|---|
| Sign in with Google on the Ziint platform | openid, email, profile | Google account ID, email address and whether it is verified, name and profile picture. |
| Google Calendar integration in Ziint Agents (optional, enabled by a company administrator) | openid, email, calendar.readonly, calendar.events | Email of the connected account; free/busy periods of the calendar; events created by Ziint's agents (title, date, time, description and attendees). |
We do not access Gmail, Google Drive, contacts or any other Google account data beyond what is listed above. Details are in Use of Google user data.
04How we use data and legal bases
Each use relies on a legal basis under the LGPD (art. 7):
| Purpose | Data | Legal basis |
|---|---|---|
| Answering inquiries and preparing proposals | Contact form data | Pre-contractual steps at the data subject's request (art. 7, V) |
| Creating and maintaining accounts, authenticating access (including with Google and two-step verification) | Registration data, credentials, Google ID | Performance of a contract (art. 7, V) |
| Providing the contracted services: field collection, workflows, dashboards, AI agents, customer service and scheduling | Content recorded by the client company; Google Calendar data | Performance of a contract (art. 7, V), as the client's processor |
| Electronic signature with evidence of authorship and integrity | Signer data, IP, approximate location, date and time | Performance of a contract and regular exercise of rights (art. 7, V and VI) |
| Security, fraud prevention and access auditing | Access and audit logs | Legitimate interest (art. 7, IX) and legal obligation (art. 7, II) |
| Keeping application access logs for 6 months | IP, access date and time | Legal obligation under Brazil's Internet Civil Framework, art. 15 (art. 7, II) |
| Meeting tax and accounting obligations | Client billing data | Legal obligation (art. 7, II) |
| Sending account and service communications | Name, email, phone | Performance of a contract (art. 7, V) |
We do not make solely automated decisions that produce legal effects on you. The platform's AI features support people at the client company, who review and decide.
05Use of Google user data
We use data received from Google only to provide the user-facing features you can see and chose to use:
Sign in with Google (Ziint platform)
- We use the verified email to find the account your company has already created for you. Signing in with Google never creates new accounts: if no account matches that email, access is denied.
- We store only the Google account ID, linked to your user, to recognize future sign-ins. Name and picture received from Google are not stored.
- Access tokens issued by Google are not stored and are not used to call any other API. After sign-in, the session is controlled by Ziint's own token.
Google Calendar (Ziint Agents)
- A company administrator connects a Google account so that the customer-service agents can book appointments with that company's customers.
- calendar.readonly: the agent checks free/busy periods to offer available slots. We do not read the content of other events.
- calendar.events: the agent creates the agreed event (with the name, phone, email and notes of the customer being served) and, when the customer asks, looks up, reschedules or cancels only events that Ziint itself created.
- To write its reply to the customer, availability and booking details are processed by the AI model configured for the agent (OpenAI or Anthropic), only during the conversation. These providers act as processors and, under their commercial API terms, do not use this data to train their models.
- Access and refresh tokens are stored encrypted (AES-256-GCM). When the integration is disconnected, we revoke the token with Google and delete the credentials.
Limited Use
Ziint's use and transfer to any other app of information received from Google APIs will adhere to the Google API Services User Data Policy, including the Limited Use requirements.
07International transfers
Several providers listed above, such as AWS, OpenAI, Anthropic, Google, Meta and Sentry, store or process data outside Brazil, mainly in the United States. The platforms' main servers are in the AWS us-east-1 region (Virginia, USA).
These transfers follow art. 33 of the LGPD and ANPD Resolution CD/ANPD No. 19/2024. We rely on contractual clauses with providers that ensure protection compatible with Brazilian law and, where applicable, on the transfer being necessary to perform a contract at your request (art. 33, IX). We give preference to providers with recognized security certifications such as ISO 27001 and SOC 2.
08Storage, security and retention
How we protect data
- Encryption in transit (HTTPS/TLS) on every connection to the website, platforms and APIs.
- Encryption at rest for AWS databases and file storage, plus additional encryption (AES-256-GCM) for sensitive data: Google tokens, two-step verification secrets, integration credentials and signature data.
- Passwords stored only as hashes; two-step verification available; sessions expire.
- Role-based access control, isolation between client companies, audit logs and masking of personal data in logs and error monitoring.
- Internal access restricted to the people who need it to operate and support the service.
How long we keep data
| Data | Retention |
|---|---|
| Website contact messages | Up to 2 years after the last contact, or until you request deletion |
| Platform accounts and content | While the client company's agreement is active. After termination, data remains available for export for up to 90 days and is then deleted or anonymized |
| Google sign-in ID | While the account exists, or until you ask us to unlink it |
| Google Calendar tokens | Until the integration is disconnected; they are then revoked and deleted |
| Access logs (IP, date and time) | At least 6 months (Internet Civil Framework, art. 15) and no longer than needed for security and the defense of rights |
| Signed documents and their evidence | For the period set by the client company and the applicable legal limitation periods |
| Tax and accounting data | For the periods required by tax law (generally 5 years) |
Users deactivated by the company administrator lose access immediately. Historical records linked to them (such as inspection responses and audit trails) belong to the client company and follow the periods above.
If a security incident may cause relevant risk or harm, we will notify the ANPD and the affected data subjects, as required by art. 48 of the LGPD.
09Your rights
Under the LGPD (art. 18), you may at any time request:
- Confirmation that we process your data and access to it;
- Correction of incomplete, inaccurate or outdated data;
- Anonymization, blocking or deletion of unnecessary or excessive data, or data processed unlawfully;
- Portability of your data to another provider, upon express request;
- Deletion of data processed based on your consent;
- Information about whom we share your data with;
- Information about the possibility of refusing consent and its consequences;
- Withdrawal of consent;
- Objection to processing based on other legal grounds, in case of non-compliance with the law;
- Review of decisions made solely through automated processing;
- Complaint to Brazil's National Data Protection Authority (www.gov.br/anpd).
How to exercise them
- Email contato@ziint.com with the subject “Privacy” and tell us which right you want to exercise.
- To protect your data, we may ask you to confirm your identity, for example by replying from your registered email.
- We reply immediately in simplified form or, when we need to gather information, with a complete statement within 15 days (LGPD, art. 19).
If your data was recorded by a company that uses Ziint (for example, your employer), we will forward the request to that company, which is the controller, and support its response.
10How to revoke Google access
You can withdraw the permissions granted to Ziint at any time:
- Go to myaccount.google.com/permissions with the Google account you used.
- Under “Third-party apps & services”, select Ziint.
- Click Delete all connections you have with Ziint and confirm.
In Ziint Agents, an administrator can also disconnect Google Calendar in the company's integration settings; the token is revoked and deleted immediately.
Revoking access prevents new access but does not delete what we already hold. To delete the Google ID linked to your account or the events created by the agents, email contato@ziint.com. We complete deletion within 15 days, except for data the law requires us to keep.
12Children and teenagers
Ziint's services are intended for professional use by people 18 or older. We do not knowingly collect data from children or teenagers. If you become aware of such a case, email contato@ziint.com and we will delete the data.
13Changes to this policy
We may update this policy to reflect changes in the services, providers or the law. The date at the top shows the version in force. For material changes, especially new uses of Google user data, we will notify you by email or in the platform before they take effect and, where the law requires, ask for new consent.
14Contact
- Controller
- Ziint Consultoria e Desenvolvimento LTDA
- CNPJ (Brazilian tax ID)
- 49.724.906/0001-48
- Address
- Rua Doutor Helvécio Arantes, 110, Luxemburgo, Belo Horizonte/MG, CEP 30380-465, Brazil
- Email (privacy channel)
- contato@ziint.com
- Phone
- +55 31 99804-0904
See also the Terms of Use.