Privacy and Cookies Policy

Last updated: November 12, 2026 · Leer en español

This Policy describes how Zaclix handles information when a business uses the platform to manage its customer service conversations on WhatsApp, Facebook Messenger and Instagram, and which cookies we use.

1. Who we are

Zaclix is a customer service platform that brings into a single inbox the conversations businesses have with their customers on WhatsApp, Facebook Messenger and Instagram. It lets them receive and reply to messages, organize them by queues and agents, and automate replies with chatbots.

The controller is César Ferreira Martínez (sole proprietorship), trading as Zaclix, Paraguayan tax ID (RUC) 3239355-5, with registered address at Tte. Óscar Caballero casi Capitán Brizuela, Yuty, Paraguay. You can write to us at soporte@zaclix.com or on WhatsApp at +595 992 229482. Website: zaclix.com.

2. Our role regarding the data

Zaclix is a platform used by many businesses. For End Customers’ data —the people who message those businesses— Zaclix acts as a processor: it processes that data on behalf of and following the instructions of the business using the platform, which is the controller. For the data of the customer businesses themselves and their agents, Zaclix is the controller.

If you messaged a business that uses Zaclix and want to know what data it holds about you, or want it deleted, contact that business first, since it decides about that data. If you write to us, we will coordinate your request with it.

3. What information we process

From customer businesses and their agents we process sign-up and billing data —name, email address, user account identifier— and the connection credentials for the messaging platforms (access tokens), which we store to operate the service. Passwords are stored hashed, never in plain text, and we do not store card or other payment method details: they are handled by Paddle, which collects the subscription payments (see “Who we share information with”).

From End Customers, received through Meta and WhatsApp, we process the conversation identifier (the user’s platform identifier —PSID, IGSID— or their phone number, and their name and profile photo when the source platform provides them), the content of the messages (text, images, audio, video and documents) and their metadata: date and time, delivery and read status, and the assigned queue or agent.

Using the platform also generates technical data —IP address, device and browser, access dates and error logs— and, if you allow notifications, the identifier of the device we send them to.

We do not ask for sensitive data (health, ethnic origin, political opinions, religious beliefs, sex life or trade union membership); if an End Customer includes it in a conversation, it is stored as part of the message. The service is aimed at businesses and professionals, not at people under 18; if we learn that a minor’s data was uploaded without proper authorization, we delete it.

4. How we use the information

• To provide the customer service: deliver and display messages and allow replies.
• To organize customer service with queues, agent assignment and automated replies.
• To bill the subscription and answer support requests.
• To operate, maintain and secure the platform.
• To comply with applicable legal obligations.

We do not sell personal data or use it for advertising. We do not use the content of conversations, or information obtained from Meta’s platforms, for purposes unrelated to providing the service to the customer business, or to train general-purpose artificial intelligence models.

When a business connects WhatsApp, Facebook Messenger or Instagram, Zaclix accesses only the information needed to send and receive messages, through Meta’s official APIs and in compliance with the Meta Platform Terms and its Developer Data Use Policy.

We process this data because it is necessary to provide the contracted service, to comply with legal obligations, for our legitimate interest in keeping the platform secure or, where applicable, with your consent —for example, for notifications—. Processing is governed by Paraguayan personal data protection law, in particular Law No. 6534/2020 and, from its entry into force, Law No. 7593/2025. Because the data is stored in Brazil, processing is also subject to Brazil’s General Data Protection Law (LGPD, Law No. 13,709/2018).

5. Who we share information with

We share data only with those who help us provide the service, and only as needed:

• Meta Platforms, Inc., to send and receive WhatsApp, Facebook Messenger and Instagram messages.
• The Constant Company, LLC (Vultr), which hosts the servers, the database and the files in São Paulo, Brazil.
• Google LLC (Firebase Cloud Messaging), for Android app notifications.
• The browsers’ push notification services (the one operated by each agent’s browser), when they are enabled and the agent turns on browser notifications, to alert about new messages; the notification travels encrypted.
• An email delivery provider, for activation, password recovery and service emails.
• Functional Software, Inc. (Sentry), to log application errors; it may receive fragments of data included in error messages.
• Telegram, only if enabled, to receive the service’s operational alerts in a Zaclix chat.
• Paddle.com Market Limited (United Kingdom), our online reseller and Merchant of Record, which collects the subscription payments, issues the purchase receipt and applies the applicable taxes.
• The Pix payment gateway Gerencianet (Efí), only if enabled, to generate Pix charges; it receives the customer business’s name.
• Authorities, when a law or a valid legal order requires it.

All our providers are required to keep the data confidential and to process it only for the purposes we set. Data that passes through Meta is also subject to Meta’s own privacy policies.

Paddle processes purchase data —name, email, country, payment method— as an independent controller, because it is the party that sells and collects payment: that processing is governed by Paddle’s privacy policy. Paddle shares with us the data needed to enable and manage your subscription.

In addition, when using the app, each agent’s browser requests resources directly from these services, which receive at least its IP address: OpenStreetMap (maps of shared locations, with their approximate coordinates); Google static maps, only if we enable them; Google Fonts (interface fonts); jsDelivr (images for the emoji picker); twemoji.maxcdn.com (images of the emojis displayed, including those in message content, with each emoji’s code); the Facebook JavaScript SDK (when adding Meta connections); and YouTube (videos on the help screen).

To show the preview of a link included in a message —including those sent by contacts— our server downloads that page: the linked site receives the server’s IP address and the URL, which may contain personal data.

6. Where your data is processed

The platform is hosted on Vultr servers located in São Paulo, Brazil. In addition, Meta and Google process the data that passes through their services mainly in the United States, and Paddle processes payments from the United Kingdom. This involves an international transfer of data for processing and storage. We take measures to keep that processing secure and in line with this Policy. By using the service, the customer business acknowledges and authorizes this processing abroad.

7. How long we keep data

We keep information while the customer business keeps its service active and as long as it is needed to provide it. Specifically:

• Account and contact data: while the account is active. After cancellation, the business has 30 calendar days to export it, and we delete it from the production database within the following 30 calendar days (no later than 60 days after cancellation).
• Conversations and attachments: while the account is active, or until the business deletes them; after cancellation, on the same timeline as account data.
• Access logs: up to 12 months, for security.
• Accounting and billing records: for the period required by Paraguayan tax law.
• Backups: deleted through rotation once they are 15 days old; data they still hold after cancellation is gone within 15 days of its deletion.

When data is no longer needed, we delete or anonymize it, unless we must keep it to meet a legal obligation.

8. Security

We apply reasonable technical and organizational measures to protect information against unauthorized access, loss or alteration: access control by business and by role, encrypted transmission, isolation of each customer business’s data, encrypted storage of integration credentials and database servers not exposed to the internet.

No system is invulnerable. If a security incident significantly affects personal data, we will notify the affected businesses without undue delay and, where applicable, the competent authority.

9. Your rights

Under applicable law, you may exercise these rights free of charge:

• Access: request a copy of the information we hold about you.
• Rectification: ask us to correct or complete inaccurate or incomplete data.
• Erasure: ask us to delete your data, unless a legal obligation requires us to keep it.
• Restriction: ask us to restrict processing in certain cases.
• Objection: object to certain processing on grounds relating to your particular situation.
• Portability: request your data to take it to another provider, where technically feasible.

To exercise them, write to us at soporte@zaclix.com. We may ask you to verify your identity before handling the request.

10. How to ask us to delete your data

Anyone can request access to, rectification of or deletion of their personal data processed through Zaclix. To request deletion, email soporte@zaclix.com with the subject “Data deletion”, stating the account, number or identifier you contacted us from. We will handle the request without undue delay.

If your data was processed on behalf of a business that uses Zaclix, we will coordinate the request with that business, which is the controller. The full procedure, with the steps for each case, the timeframes and what is and is not deleted, is set out in How to delete your data (in Spanish).

11. Cookies and local storage

Zaclix uses only the cookies and similar technologies it needs to work. A session cookie keeps you signed in while you use the platform and is deleted when you close the browser. The browser’s local storage remembers your language and interface preferences and lets us detect new versions of the app.

We do not use advertising or cross-site tracking cookies. You can block or delete cookies in your browser settings, but if you disable the necessary ones you may not be able to use the platform. The public website and the app load fonts from Google Fonts, which may log the visitor’s IP address under Google’s policies.

12. Complaints and changes to this Policy

If you believe the processing of your data does not comply with the law, you can complain to us at soporte@zaclix.com and also to the competent supervisory authority where you live.

We may update this Policy to reflect changes in the service or in the law. We will publish the current version at this same address, with its last-updated date.