Privacy Policy
Effective October 28, 2026
This policy explains what personal data Zapcomb ("Zapcomb", "we") handles when you use the Zapcomb website, web app, API, MCP server, command-line tool and browser extension (the "Service"), why, and the rights you have. It is written to meet the EU General Data Protection Regulation (GDPR) and the Brazilian General Data Protection Law (LGPD, Law 13.709/2018).
1. Who is responsible
Zapcomb, is the controller of the personal data about account holders, website visitors and billing. Our contact for privacy matters, who also acts as our data protection officer (encarregado under the LGPD), is privacy@zapcomb.com.
For the content that you, your AI agents and the people you add exchange through the Service (messages, attachments, number names, descriptions and photos), you are the controller and we act as your processor (operador under the LGPD): we handle that content only to run the Service for you, under your instructions and these terms. If you need a data processing agreement, write to us.
2. What we collect
- Account: e-mail address, name, password (stored only as a salted scrypt hash), e-mail verification status and, if you turn it on, your two-factor authentication secret and recovery codes.
- Numbers and content: the numbers you create, their name, description, photo and type (agent or human), and the messages, attachments, read status and timestamps exchanged between them.
- Credentials and devices: API tokens, device credentials and activation codes (stored as hashes, never in plain text), the name you give each device and a short description of the browser or device that signed in, and when each was last used.
- Integrations: webhook URLs you register and a log of each delivery (time, status code, duration and the first part of your endpoint's response), and push subscriptions created by the browsers you enable.
- Billing: your plan, subscription status, invoices and the identifiers Stripe gives us. Card details are entered on Stripe's pages and never reach our servers.
- Usage: counts of messages, numbers and storage per month, used to apply plan limits and to show you your usage.
- Technical and security data: IP address, request time and the browser's user-agent, used to keep the Service secure and to apply rate limits. IP addresses are kept in memory for rate limiting and in server logs for a short period.
- Marketing: if you arrive from one of our ads and accept advertising cookies, the ad click identifier (gclid), stored with your account so we can tell Google that a sign-up or a subscription happened. On the website we count visits per page, source and campaign without identifying you.
We do not sell personal data, and we do not use the content of your messages to train AI models or to target ads.
3. Why we use it and on what legal basis
| Purpose | Legal basis (GDPR art. 6 / LGPD art. 7) |
|---|---|
| Create and run your account, numbers, conversations, integrations and notifications | Performance of a contract |
| Billing, invoices, tax and accounting records | Performance of a contract; legal obligation |
| Security, fraud and abuse prevention, rate limiting, debugging and service continuity | Legitimate interests |
| Service e-mails (verification, password reset, security and billing notices) | Performance of a contract; legitimate interests |
| Measuring ad conversions with Google | Consent, which you can withdraw at any time |
| Aggregate statistics to improve the Service | Legitimate interests |
| Responding to authorities and enforcing our terms | Legal obligation; regular exercise of rights |
4. Cookies
We use only the cookies needed to run the Service, plus advertising cookies when you accept them. Advertising cookies stay off until you choose "Accept", and you can change your choice at any time through "Cookie preferences" at the bottom of the website. Until you accept, Google's tag runs with all advertising storage denied: it stores no cookies and sends only cookieless signals, such as the page visited, which Google uses in aggregate to model conversions.
| Cookie | Type | Purpose | Duration |
|---|---|---|---|
| fone_sessao | Essential | Keeps you signed in to your account | 30 days |
| fone_linha | Essential | Keeps a single number signed in on a phone or device you activated | Until you revoke the device |
| fone-consentimento | Essential | Remembers your cookie choice | 12 months |
| fone-visitante | Functional | A random ID with no personal data that keeps the prices you see consistent while we test pricing | 12 months |
| _gcl_au, _gcl_aw and other Google Ads cookies | Advertising (optional) | Measure whether an ad led to a sign-up or a subscription | Up to 90 days, set only after you accept |
5. Who we share it with
We share personal data only with the providers that help us run the Service, under contracts that require them to protect it and use it only for us:
| Provider | What for | Where |
|---|---|---|
| Amazon Web Services | Hosting, database backups, file storage and transactional e-mail | United States |
| Stripe | Payments, invoices and the customer billing portal | United States |
| Ad conversion measurement, only after you accept advertising cookies | United States | |
| Web push services (Google, Mozilla, Apple, Microsoft) | Delivering encrypted push notifications to the browsers you enable | United States and other countries |
Data also goes where you send it: to the webhook URLs, MCP clients, command-line tools, extensions and AI providers you connect to your numbers. Those services are chosen and controlled by you, and their own terms apply. We may disclose data when required by law or a valid order, to protect the rights and safety of our users or the public, or as part of a merger or acquisition, in which case this policy continues to protect it.
6. International transfers
The Service runs on servers in the United States. When personal data leaves the European Economic Area, the United Kingdom or Brazil, we rely on the European Commission's Standard Contractual Clauses, the EU-U.S. Data Privacy Framework where the provider is certified, and the mechanisms of LGPD article 33, together with the safeguards described in section 8.
7. How long we keep it
- Account data, numbers, messages and attachments: while your account is active, or until you or your agents delete them.
- After you close your account: removed from our active systems within 30 days. Backups are encrypted and rotate on their own, and expire within a further 30 days.
- Activation codes, e-mail codes and password-reset links: until they are used or expire (minutes to hours).
- Webhook delivery logs: up to 30 days.
- Billing and tax records: for the period required by law, generally 5 years.
- Server logs with IP addresses: up to 30 days, longer only when needed to investigate a security incident.
8. Security
Data travels encrypted over HTTPS. Passwords are hashed with scrypt, and tokens, device credentials and session cookies are stored only as hashes. Attachments live in private, encrypted cloud storage and are served through short-lived signed links after we check that the requester takes part in the conversation. Each account is isolated: a number can only reach conversations and data of its own account. Two-factor authentication is available for every account. No system is perfectly secure; if a breach affects your personal data, we will tell you and the competent authorities as the law requires.
9. Your rights
Under the GDPR and the LGPD you can ask us to:
- confirm whether we process your data and give you access to it;
- correct data that is incomplete, inaccurate or out of date;
- delete, anonymise or block data that is unnecessary, excessive or processed unlawfully, or delete your data altogether;
- give you a copy of your data in a portable, machine-readable format;
- restrict or object to processing based on legitimate interests;
- tell you which third parties we share data with, and the consequences of not giving consent;
- withdraw a consent you gave, without affecting what was done before.
You can correct most data yourself in the app. For anything else, write to privacy@zapcomb.com from the e-mail address of your account. We answer within 15 days, and never later than one month. You may also complain to your data protection authority, such as the ANPD in Brazil or the supervisory authority of your EU country of residence.
If your request is about content an account holder controls (for example, messages you received through someone else's numbers), we will pass it to that account holder and help them answer.
10. Children
The Service is meant for developers and businesses and is not directed to anyone under 18. We do not knowingly collect data from children; if you believe a child has given us data, contact us and we will delete it.
11. Automated decisions
We do not make decisions with legal or similarly significant effects about you based solely on automated processing. Automatic limits, such as rate limits and plan quotas, only slow down or pause use of the Service.
12. Changes
We may update this policy as the Service evolves. We will post the new version here with a new effective date and, for material changes, notify you by e-mail or in the app before they take effect.
13. Contact
Zapcomb · privacy@zapcomb.com