Zizelo Privacy Policy

Version 2026-10-24.7. This English version is a translation; if there is any difference, the Portuguese text prevails. This policy describes how Zizelo processes personal data in compliance with the LGPD (Lei Geral de Proteção de Dados, Brazil's General Data Protection Law, Law 13,709/2018). It applies to the website, the dashboard and the events API. Operational draft: it must be reviewed by legal counsel before the commercial launch.

1. Who we are and our roles in processing

Zizelo is operated by [company name and CNPJ to be defined], headquartered at [address to be defined] ("Zizelo", "we", "us").

Zizelo acts in two roles. It is the controller of the account data of the people who use the platform: name, email, password (stored only as a hash), access logs and acceptance of these documents. It is the processor of the data that each customer company registers or syncs in its workspace, such as people, tools, costs, domains and ad accounts. In this second case, the customer company is the controller and decides the purpose; Zizelo processes that data only to provide the contracted service and according to the customer company's instructions.

2. Data we process

User account. Name, work email, password hash, sign-up date, the workspaces the user belongs to and their role in each one, favorites and recent visits, the version and date of acceptance of the Terms of Use and of this Policy, and the language chosen for the interface and emails (Portuguese or English).

Company. CNPJ (Brazilian company registration number) and public data from the Receita Federal (Brazil's federal tax authority) obtained in the lookup: legal name, trade name, business activity (CNAE, Brazil's national classification of economic activities), size, municipality, state, opening date and whether it is a MEI (Brazilian individual microentrepreneur). Also the email domain used at sign-up.

Workspace content, registered by the customer company or read by connectors it sets up:

• Inventory people: name, work email, group, status (active or offboarded), offboarding date and the tools they are linked to. Being listed in the inventory does not give a person a login.
• Tools and costs: name, vendor, category, amounts, billing frequency, licenses, renewal, person in charge, owner and administrator, contract reference.
• Domains and digital assets: name, address, owner, administrator, person in charge, provider, verification evidence, expiration date and status in the public registry.
• Ad accounts: identifier, name, stated budget, spend, and aggregate clicks and conversions for the month. We do not read data about the people reached by the ads.
• Tasks, opportunities, report and workspace settings.

CSV statements. The file is read to detect recurring charges. We store the file name, the number of lines and the recurring charges detected (vendor, amount, interval and occurrences). The other lines of the statement are not stored.

Connector credentials. Keys and tokens provided by the administrator for Google Workspace, Microsoft 365 or Meta Ads. They are encrypted at rest (AES-256-GCM, with a dedicated key separate from the session key), are never shown back in the interface (only the last four characters) and are deleted when the connector is removed. We request read-only permissions. For Google Workspace, instead of pasting a key, the administrator can authorize access on Google's own screen: in that case we store the refresh token Google gives us (encrypted the same way) and the email and domain of the account that authorized it, so that reading keeps working for the whole workspace without new authorizations. The administrator can revoke the authorization at any time, in Zizelo (by removing or reconnecting the connector) or in the Google account (myaccount.google.com/permissions).

Feedback sent from the dashboard. When someone uses the "Send feedback" button, we store the text written, the sender's name and email, the workspace they were in, the screen they sent it from and the date. The Zizelo team reads these messages in the admin area, marks what has been handled and may reply to the email provided. The content is used only to improve the service and to get back to the person.

Technical and security records. An audit trail per workspace (who did what, when, before and after, without the content of passwords or credentials), active sessions (identifier, expiry and browser), password reset requests (code stored only as a hash, expiry and attempts), sync runs and events received through the API. Also the log of the Zizelo team's actions in the admin area: which team member did what, when, on which account or workspace and for what reason.

Tracking of relationship messages. For each relationship message (such as the founder's welcome message), we store the sending date and the events Resend reports to us: delivery, open, link click (only the link address, without parameters), bounce and spam complaint, with date and time. Opens are measured with a tracking image and clicks go through a Resend redirect address; some email programs block or prefetch this measurement. We do not store the IP address or device data of these events. We also store the unsubscribe date and, when the person replies to the founder, a mark that they replied and a short note from the team about the reply. To assess whether the message helped, the team sees, next to these events, whether the person came back to the dashboard and what they added afterwards (number of tools, imports, connectors and invitations), without reading the content added.

Zizelo team access. Zizelo team members have an admin area with the companies' registration data, the workspaces and their aggregate figures (number of users, tools, recorded spend, opportunities, connectors and last activity) and the list of accounts, so they can monitor the service and provide support. To diagnose a problem, the team can open the dashboard in "view as" mode, seeing the workspace exactly as a user sees it. This mode is restricted to the team, lasts at most two hours, does not allow accepting terms or invitations on the person's behalf, and leaves a trace in two places: in the team log (who opened it, when, for which user and for what reason) and in the workspace's own audit trail, visible to the customer company, where the access and any change made in this mode are marked as performed by the Zizelo team on the user's behalf.

3. Purposes and legal bases

We do not use workspace data for advertising, we do not sell data and we do not build behavioral profiles of people.

4. Who we share data with

We share the minimum necessary, and only with:

• BrasilAPI, a public CNPJ lookup service: receives the CNPJ number entered at sign-up or when creating a workspace.
• Domain registries (Registro.br for .br domains and the IANA RDAP directory for all others): receive the registered domain names, when the domains connector is active.
• Google, Microsoft and Meta, only when the workspace administrator sets up the corresponding connector, using the customer company's own credentials, to read the data described above.
• Resend, a transactional email service: receives the recipient's email address, name and the message content (password reset code, password changed notice, invitation to a workspace, welcome message and the monthly report sent to users of the workspace itself). It also sends the founder's welcome message and reports to us the delivery, open and click events of these messages, described in section 2. We do not send third-party marketing emails.
• Hosting and database provider [to be defined], which stores the data on our behalf under a confidentiality agreement.
• Authorities, when there is a legal obligation or a court order.

The browser does not load third-party fonts, scripts or trackers: all dashboard content is served by Zizelo itself.

5. International transfer

The Google, Microsoft and Meta connectors exchange data with those vendors' servers, which may be located outside Brazil, under their own policies and safeguards. Sending emails through Resend processes the address and message content on servers in the United States, based on Art. 33 of the LGPD (the vendor's contractual clauses) and on the need to perform the contract. The location of Zizelo's hosting will be stated here once it is defined.

6. Cookies and browser storage

The first time you open Zizelo, a banner asks for your choice about cookies and browser storage, by category. You can accept everything, keep only what is necessary or manage each category, and you can change your choice whenever you like under "Cookie preferences" (in the user menu, in the footer of the sign-in screens and on these pages). Your choice is valid for 12 months, and if the categories change, the banner appears again.

Necessary (always on, no consent required, based on performance of the contract). zizelo_session, which keeps you signed in: it is httpOnly, restricted to the site itself and lasts up to 30 days or until you sign out. zizelo_staff_session, which exists only in the browser of a Zizelo team member while they use "view as" mode, has the same characteristics and is deleted when the mode ends or on sign-out. zizelo_consent, which stores your choice in this banner (version, date and authorized categories) for 12 months; the site itself can read it, so that the interface respects your choice before storing any preference. zizelo_lang, which stores the language you chose (Portuguese or English) for 12 months; it is created only when you switch languages, and without it the site follows the browser's language. zizelo_oauth, created only when an administrator starts authorizing a connector on the provider's screen (currently Google Workspace): it is httpOnly, lasts at most 10 minutes, serves only to check that the provider's response came back to the same browser that started the request, and is deleted once the process is complete.

Interface preferences (only with your permission). Light or dark theme, collapsed menu and expanded groups, stored in the browser's local storage (zizelo-theme, zizelo-sidebar, zizelo-groups). They never leave your device and do not identify you. If you withdraw permission, these preferences are deleted and the dashboard returns to its defaults on every visit.

Usage statistics (only with your permission). No analytics tool is currently enabled and no third-party script is loaded. If we ever start measuring usage in aggregate, this will only happen for people who authorize this category, and this policy and the banner will be updated first.

We do not use advertising cookies. For signed-in users, the choice is also recorded in the account (version, categories and date) as proof of consent; in "view as" mode, the choice applies only to the team member's browser and is not recorded in the customer's account.

Relationship messages. Whoever creates a company receives, about 30 minutes later, a welcome message signed by the founder, and replies go straight to him. Every email of this kind includes an unsubscribe link, including one-click unsubscribe from the email program itself; when someone unsubscribes, we store that choice in the account. Security emails (password code, password changed notice) and invitations are still sent, because they are part of how the account works. We record whether and when each message was sent, so that it is not sent twice, and we track delivery, opens, clicks and replies, as described in section 2, to learn whether the message was useful. Whoever unsubscribes receives no further relationship messages, and events already recorded stay linked to the message that produced them.

7. Retention and deletion

Account data is kept for as long as the account exists. The content of each workspace is kept for as long as the workspace exists and the contract is active; the customer company can request export and deletion at any time. Sessions expire after 30 days and are ended when the password is changed. Password reset codes expire after 15 minutes and are deleted after use. When a connector is removed, its credential is deleted immediately; data already read stays in the workspace until the company deletes it. After the contract ends, workspace data is deleted within [period to be defined], unless the law requires it to be kept.

8. Security

Passwords stored with bcrypt; connector credentials encrypted with AES-256-GCM; authorization checked on the server for every read and write, based on the user's membership in the workspace; Administrator, Specialist and Reader roles; an audit trail without secrets; tokens removed from error messages; security headers (CSP, HSTS, framing protection); limits on attempts and requests for password reset; connectors restricted to the vendors' fixed hosts, with timeouts and input validation. No measure eliminates every risk; relevant incidents will be reported to those affected and to the ANPD (Brazil's National Data Protection Authority) as required by law.

9. Data subject rights

Data subjects can request confirmation of processing, access, correction, anonymization, portability, deletion, information about sharing and review of consent, under Art. 18 of the LGPD. When the request concerns data in a workspace, we will forward it to the customer company, which is the controller, and help with the response. Requests about a person's own account are handled directly by Zizelo.

10. Data protection officer and contact

Data protection officer (encarregado) responsible for the processing of personal data: [name to be defined], [email to be defined]. You may also contact the National Data Protection Authority (ANPD).

11. Changes

This policy is published in Portuguese and, as a translation, in this English version (see the note at the top). We update this policy whenever the processing changes (a new connector, new data collected, a new purpose or a new vendor). Each version is dated. When there is a relevant change, the dashboard asks for acceptance again at the next visit.

Version history

• 2026-10-24.7. Tracking of relationship messages: delivery, open and click events reported by Resend (no IP or device data), unsubscribe date, reply mark with a team note and workspace usage counts after the message, seen by the Zizelo team in the admin area.
• 2026-10-24.6. The service is renamed Zizelo, at zizelo.com. Interface and emails in Portuguese and English: the chosen language is stored in the necessary cookie zizelo_lang and, for signed-in users, in the account, so that emails arrive in the same language. Publication of an English version of these documents, as a translation; in case of any discrepancy, the Portuguese text prevails.
• 2026-10-24.5. Google Workspace authorization on Google's own screen (encrypted refresh token, email and domain of the authorizing account, temporary cookie zizelo_oauth) and a "Send feedback" button in the dashboard, recording the text, the sender, the workspace and the screen it was sent from, read by the Zizelo team in the admin area.
• 2026-10-24.4. Cookie consent banner with management by category (necessary, interface preferences, usage statistics), the zizelo_consent cookie and recording of the choice in the account of signed-in users.
• 2026-10-24.3. Zizelo team admin area and "view as" mode for support, with every access recorded in the team log and in the workspace audit trail, marking of changes made in this mode, and the zizelo_staff_session cookie, used only by the team during the mode.
• 2026-10-24.2. Added the founder's welcome message, sent after sign-up with replies going directly to the founder, the record of messages sent and unsubscribe (link and one click).
• 2026-10-24. First published version: account, company by CNPJ, workspaces, inventory, CSV statements, Google Workspace, Microsoft 365, Meta Ads and domain registry (RDAP) connectors, events API, password reset, transactional emails through Resend, and audit trail.