Privacy Policy
How AgendaZap handles data from app users and people who book services through WhatsApp.
1. Who handles your data
AgendaZap is a service provided by AC Informática to manage bookings, teams and customer conversations. This policy covers the website, app and integrations offered by the service.
AC Informática determines how to process data needed to manage accounts, provide support and protect the service. Each establishment determines how to use its customers’ data to provide its services. In those cases, AgendaZap processes data on the establishment’s behalf and according to its instructions.
2. Data we process
Accounts and establishments: names, email addresses, hashed passwords, language, permissions, invitations, establishment name, address, WhatsApp number and service settings.
Customer service: customer names and phone numbers, incoming and outgoing messages, delivery records, staff notes, services, professionals, availability, bookings and cancellations. We also store images that an establishment adds to its message flow.
Operations: technical access and security data, such as IP addresses when recorded by the infrastructure, request information, errors and operational metrics. Avoid entering sensitive data, such as health information, unless it is needed for the service.
3. How we use data
We use data to authenticate users, separate access between establishments, manage schedules, reply to messages, send confirmations and reminders, provide support, and investigate errors or misuse.
Depending on its purpose, processing relies on performing a contract or steps requested by the individual, legal obligations, exercising rights, or legitimate interests in security and service operation, with respect for individual rights. Where consent is required, it must be requested for the relevant purpose.
4. Google Calendar connection
This optional connection requires an administrator’s authorization. We receive the Google account identifier and email address. We store names and identifiers of calendars created by AgendaZap, synchronization records and authorization tokens, which are encrypted on the server.
We use this access to create dedicated AgendaZap calendars and create, update or delete events in them. You choose one shared calendar or one per professional, and which professionals to include. We do not use your main calendar. Events may contain the customer’s name, service, professional, address and times. We do not send customer phone numbers or notes, or add guests. Changes made in Google are not imported into AgendaZap in this version.
Our use of information received from Google APIs follows the Google API Services User Data Policy, including its Limited Use requirements. We do not sell this data, use it for advertising, or use it to train general-purpose artificial intelligence models.
You can disconnect the account in Settings → Google Calendar and revoke permission in your Google Account connections. Disconnecting deletes saved tokens and stops sending events; events already created in Google remain. Account, calendar and event identifiers may remain to support reconnection without duplicates. Use the contact below to request their deletion.
5. Sharing and providers
Authorized establishment staff can access data needed to serve customers. Twilio and WhatsApp/Meta process phone numbers and content needed to deliver messages. Google receives event data when the integration is active. These providers also have their own privacy policies.
Infrastructure providers may process data to host and maintain the service. Some providers may operate outside Brazil; these operations must follow applicable data protection and international transfer rules. We may also disclose data when needed to meet a legal obligation or protect rights. We do not sell personal data.
6. Cookies and browser features
We use session cookies and security mechanisms to keep users signed in and protect forms. Blocking them may prevent access to the app. AgendaZap does not use advertising cookies. App fonts may load from Google Fonts, which receives technical data needed for the connection.
The time zone button reads the device’s time zone setting. It does not request GPS location.
7. Protection and retention
The service uses HTTPS, access controls by establishment, password hashing and encryption of integration tokens. No system removes all risks; protect your credentials and report suspected unauthorized access.
We keep data for as long as needed to provide the service, follow establishment instructions, meet legal obligations or exercise rights. Deletion is assessed against these purposes and obligations. Backups may retain data for their retention cycle, with restricted access. There is no single retention period for every data category.
8. Your rights and requests
Under Brazil’s LGPD, you may request confirmation and access, correction, information about sharing and, where applicable, portability, anonymization, blocking, deletion, objection to processing and withdrawal of consent. Withdrawal does not invalidate earlier lawful processing.
For booking and service records, contact the establishment where you booked. For your AgendaZap account or questions about this policy, email contato@acinformatica.com.br. Describe your request and the establishment involved without sending passwords or tokens. We may request proportionate information to confirm your identity. You may also contact Brazil’s National Data Protection Authority (ANPD).
9. Policy changes
We may update this policy to reflect changes in the service or applicable rules. The date at the top identifies the published version. We will communicate significant changes through service channels; new purposes that require consent will need new authorization.