Privacy policy

Introduction and scope

This Privacy Policy explains how Zild.ai, referred to here as Zild or we, processes personal data related to the website, platform, integrated channels, support, commercial activities and contracted services.

It applies to website visitors, leads, customers, administrators, authorized users and people whose data is sent or made available by customers in service, sales, voice, document, back-office and other operational workflows.

The English route is a convenience translation. If there is a conflict, the Portuguese version controls.

Zild's role

Zild may act in different roles depending on the processing context.

• As a controller, we process website, marketing, commercial relationship, account, billing, support, security, contract and operational communication data.
• As a processor, we process data sent, connected or configured by the customer to operate agents, integrations, messages, audio, transcripts, documents, knowledge bases, queues and workflows, under the contract, DPA and customer instructions.
• When the customer is the controller of its end users' data, Zild supports the customer in handling requests and may direct the data subject to the responsible customer.

Data we may process

The categories below depend on the contracted product, enabled integrations, channels used and settings defined by the customer.

• Identification and contact: name, email, phone, company, role, language, country and professional data.
• Account and contract: user, permissions, authentication, plan, billing, subscription, acceptance, preferences and communications with Zild.
• Operational content: messages, audio, transcripts, documents, forms, attachments, prompts, responses, summaries, tool calls, CRM, ERP or other connected-system records.
• Usage, security and audit: IP, device, browser, usage events, access logs, authentication, audit trails, errors, cost, latency and execution metadata.
• Support, diagnostic and commercial: requests, forms, diagnostic answers, meetings, preferences, service history and information needed for next steps.
• Cookies and similar technologies: browsing data, analytics and conversion or security signals, where applicable.

Channels, voice, documents and AI

Zild operates workflows that may involve WhatsApp, email, telephony, private channels, documents, authorized sources and AI providers. In these cases, processed data may include conversation content, voice, transcripts, files, extractions, classifications, recommendations, routing decisions and evidence from the operational turn.

We do not sell personal data or monetize customer data. We also do not use customer data to train public models or third-party models without express authorization or an applicable contractual basis.

When we use AI, cloud, messaging, telecommunications or security providers, we seek appropriate contractual controls for confidentiality, data protection and use restrictions.

Purposes and legal bases

We process personal data for legitimate purposes that are proportionate to the service and compatible with Brazil's General Data Protection Law, Law No. 13,709/2018.

• Provide, operate, maintain and improve the website, platform, modules, APIs, integrations, agents and configured workflows.
• Authenticate users and administer accounts, permissions, security, support, billing, contracts and operational communications.
• Execute customer instructions, including automations, human handoffs, routing, transcripts, analysis, QA, logs and audit trails.
• Comply with legal, regulatory, tax, accounting and contractual obligations and requests from competent authorities.
• Send service notices, permitted commercial communications and relevant content, with opt-out options where applicable.
• Produce metrics, analysis, security, abuse prevention and improvements using aggregated, anonymized or authorized data.

Legal bases may include contract performance, preliminary procedures, legitimate interest, compliance with legal or regulatory obligations, regular exercise of rights, credit protection and consent, where applicable.

Sharing and subprocessors

We may share data only when necessary to operate Zild, meet obligations, protect rights or execute customer instructions.

• Infrastructure, cloud, hosting, security, observability, support, CRM, billing, analytics and communication providers.
• AI, messaging, telephony, email, WhatsApp, private-channel and customer-enabled integration providers.
• Consultants, auditors, legal, accounting or financial advisors, under confidentiality and need-to-access limits.
• Public authorities, courts or third parties when required by law, a valid order or to protect rights, security and service integrity.
• Parties involved in corporate reorganization, merger, acquisition, investment or asset sale, with appropriate safeguards.

The applicable subprocessor list may vary by product and contract and is available upon request.

International transfers

Zild and its providers may process data in first-party or third-party infrastructure located in Brazil or other countries. When international transfer occurs, we adopt LGPD-compatible mechanisms such as contractual clauses, security standards, vendor assessment and other applicable safeguards.

Regional hosting, data residency or specific restrictions may depend on the plan, contracted architecture, technical availability and agreed regulatory requirements.

Retention, export and deletion

We keep personal data for as long as necessary to fulfill this Policy's purposes, perform contracts, follow customer instructions, protect security, resolve disputes and comply with legal, tax, accounting or regulatory obligations.

• Customer data may follow configurable retention policies, export, manual deletion or contract-defined periods.
• After contract termination or fulfillment of the purpose, data may be deleted or anonymized unless retention is required or permitted by law, contract or defense of rights.
• Backups, logs and security records may remain for a limited period and be removed according to technical cycles and applicable obligations.

Security

We adopt technical, administrative and organizational measures to protect data against unauthorized access, loss, alteration, improper disclosure or improper destruction.

• Role-based access control, least privilege, authentication, customer isolation and configurable permissions.
• Encryption in transit and, where applicable, at rest, plus logs, monitoring, alerts and audit trails.
• Incident response processes, vendor review, internal policies and production controls.

No system is absolutely secure. If we identify an incident affecting personal data, we will assess impact and notify customers, data subjects or authorities as required by applicable law and contracts.

Data subject rights

Under LGPD, data subjects may request confirmation of processing, access, correction, anonymization, blocking, deletion, portability, information about sharing, information about the possibility of not consenting, withdrawal of consent, objection to processing and review of decisions made solely on the basis of automated processing, where applicable.

Requests may be sent to privacy@zild.ai or support@zild.ai. We may ask for information to confirm identity, protect the account and route the request to the customer controller when Zild acts as processor.

Automated decisions and human review

The platform may classify, summarize, score, route, recommend or execute actions configured by the customer. Customers define policies, permissions, limits, blocking criteria and points where a person must review the case.

When a decision made solely on the basis of automated processing affects a data subject's interests, the data subject may request review under LGPD. When the decision is controlled by the customer, Zild will support the customer in the analysis under the contract.

Cookies and marketing choices

The website may use cookies, pixels, analytics and similar technologies for operation, security, usage measurement, experience improvement, diagnostics and, where applicable, commercial communication. You may manage preferences in the browser, available consent mechanisms or through unsubscribe options in marketing communications.

Sensitive data and minors

Zild does not direct the website or platform to children. Sensitive data, health data, financial data, minors' data or information subject to sector rules should be entered in the platform only when necessary, lawful and covered by a contract, legal basis, notice, authorization or appropriate customer configuration.

Changes and contact

We may update this Policy to reflect service improvements, new products, legal, regulatory, contractual or security changes. Relevant changes will be published on the website and, where appropriate, communicated through available channels.

For questions, requests or exercise of privacy rights, use privacy@zild.ai, support@zild.ai or the Zild support page.

Contract, DPA, commercial proposal, security addendum or documented customer instructions may supplement this Policy for contracted services.