Courtesy translation. This English version is provided for your convenience only. The Portuguese version, available at https://zdzcloud.com.br/privacidade/, is the legally binding text. Where this translation and the Portuguese original differ, the Portuguese original prevails.
This Policy explains which personal data we process on this website, why, on which legal basis, who we share it with, how long we keep it, and how you can exercise your rights. It is deliberately written in plain language: a document only its author understands is construed against the party who drafted it (Brazilian Consumer Protection Code, art. 47 and art. 54, §§ 3 and 4).
An honest summary. This is a static, corporate website. It does not ask you to sign up and does not send anything you type to our servers — the calculators and diagnostics run entirely in your browser. There is a single form, on the home page: it is not sent to us either. When you submit it, we open WhatsApp with the message already written, and the conversation only reaches us if you confirm — but note the caveat in section 3: the link that opens WhatsApp carries the text in the address itself, so it passes through a Meta server before any confirmation from you.
There is one exception, and it is yours: the audio message button, present on every page — including this one. If you record and tap Send, that audio is transmitted and stored on our servers, in Brazil, for up to 90 days. Until you tap Send, the recording never leaves your device. It is described in section 4.
The only automatic collection is audience measurement. We do not sell, rent, or transfer data to third parties, and we do not use behavioral advertising.
1. Who processes your data · 2. Scope: this site and our products · 3. What this site does not do · 4. Data we process · 5. Purposes and legal bases · 6. Cookies and browser storage · 7. Sharing and sub-processors · 8. International transfer · 9. Retention and deletion · 10. Security · 11. Access logs and the Marco Civil · 12. Your rights and how to exercise them · 13. Children and teenagers · 14. Changes to this Policy · 15. DPO and authority channels · 16. Governing law and venue
1. Who processes your data
1.1 Controller
| Item | Value |
|---|---|
| Legal name | ZDZCLOUD SERVICOS DIGITAIS LTDA |
| CNPJ (Brazilian company registry) | 61.001.714/0001-09 |
| Physical address | Avenida Paulista, 1636, Conjunto 4, Pavimento 15, Bela Vista, São Paulo/SP, Brazil, ZIP 01310-200 |
| E-mail address (contact and support) | suporte@zdzcloud.com.br |
| Brand | "ZDZCloud" is a trademark of the same legal entity |
Publishing the physical and electronic addresses is mandatory in Brazilian e-commerce (Decree 7,962/2013, art. 2, I and II).
1.2 Data Protection Officer (DPO)
| Item | Value |
|---|---|
| Name | Zdzislaw Kochanski |
| DPO e-mail | dpo@zdzcloud.com.br |
| Deputy | no deputy has been appointed — the DPO channel is the single point of contact |
| Formal appointment | May 26, 2025 |
The DPO channel is monitored. We do not publish a channel we do not read: promising support that does not exist creates documentary evidence against us, besides violating the LGPD.
2. Scope: this site and our products
This Policy covers exclusively the corporate website zdzcloud.com.br.
ZDZCloud's products and platforms — such as ZDZAgentsOS — have their own legal documents, served inside each product, which govern the processing of data of those who purchase and use them. Where there is a conflict, the document served at the address of the product you are using prevails.
3. What this site does not do
We state explicitly what this site does not do, because the absence of processing is just as relevant as its presence:
- Nothing you type reaches our servers. The site has a single form, on
the home page, which asks for your name and e-mail (required), plus your
company and a project description (optional). It is not sent to us: when
you click send, we open WhatsApp in a new tab with the message already composed, and the
conversation only reaches us if you confirm sending it on your device.
An honest caveat about this path: to open WhatsApp we use a link from Meta's wa.me service, and the message text travels in the address itself. This means what you filled in reaches a Meta server the moment the tab opens — even if you later decide not to send it. We think it is important to say this rather than repeat that "nothing leaves your device". If you confirm, the conversation continues on WhatsApp (section 7) and is treated as business communication (section 5).
Apart from this form and the audio message described below, no other part of the site asks for identifying data. - The audio message is the exception — and it depends on an action of yours. On every page of this site, including this one, a floating button in the bottom corner opens a voice assistant; on the BI product page the same feature appears embedded in its own section. It asks you to say your name, your company, and which channel you prefer to be contacted through. The recording happens in your browser: nothing is transmitted until you tap Send, and you can listen to it, re-record, or simply close the page. If you do tap Send, then the file is transmitted and stored by us — it is the only content on this site that reaches our servers. Details in sections 4, 5 and 9.
- We do not use your voice to identify you. The audio is listened to by a person on the sales team to understand what you are looking for and reply through the channel you requested. We do not extract voice patterns, do not perform speaker recognition, and do not use the audio as biometric data — which is why processing the voice itself is not processing of sensitive data under art. 5, II, of the LGPD. A caveat that seems fair to us: you speak freely, and nothing prevents us from hearing something you chose to share that would be sensitive (a health condition, a political opinion). We do not ask for any of that, we do not use any of that, and the 90-day limit and your right to request earlier deletion still apply. If you prefer not to take that risk, use the form, e-mail, or WhatsApp — the audio is never mandatory.
- We do not ask for CPF, CNPJ, or any other document anywhere on the site.
- The interactive tools — the BI cost calculator, the AI readiness diagnostic, and the product selector — run entirely in your browser. The values you enter are not transmitted to us or to third parties and disappear when you close the page.
- We do not use remarketing pixels or advertising tags.
- We do not perform profiling or automated decisions that affect you (LGPD, art. 20).
- We do not sell, rent, or transfer data to third parties.
If you write to us by e-mail or WhatsApp from a link on the site, that message is sent from your own app, and we then treat it as business communication: we use the data solely to reply to you.
4. Data we process
| Category | What it is | How it is collected |
|---|---|---|
| Browsing data | Pages viewed, time spent, traffic source (search engine, link, or campaign), device and browser type, approximate city-level location, and a pseudonymous browser identifier | Automatically, by the audience measurement tool described in section 7 |
| Contact-initiated signal | An event indicating that someone started a conversation with us — through the form, a WhatsApp link, an e-mail link, or by sending an audio message. It carries only the method and the name of the starting point; it does not carry what you wrote, does not carry the audio or anything said in it, and does not carry your e-mail or any identification of you. Clicks on the DPO's addresses, used to exercise your rights, do not generate this event — asking for privacy is not a business contact | Automatically, together with audience measurement, and only if you have authorized measurement |
| Interface preference | Your choice of light or dark theme, under the key zdz-theme | Your browser's local storage. It stays on your device and is never transmitted |
| Access logs | IP address, date and time with timezone, requested address, and browser identification | Automatically, when serving the page — as on any web server (see section 11) |
| Audio message only if you record and tap Send |
The audio file with whatever you say — usually your name, your company, the channel you prefer to be contacted through, and what you are looking for. Alongside it we store only four technical details: the full address of the page the message was sent from (including campaign parameters, if you arrived through an ad), the date and time it was received, an origin tag (for example produtos/bi or atendente-global) and the browser identification. We do not store your IP together with the audio — but let us be clear with you: the access log in section 11, which is separate and legally required, holds the IP and the timestamp, so this reduces the link, it does not eliminate it | You record in your browser and decide whether to send. Nothing is transmitted until you tap Send: until then you can listen, re-record, or close the page, and the recording disappears with it |
The audio is kept in a private area, separate from the one that serves the site's pages, within Brazil, and its address is neither public nor indexable — only someone holding our credentials can reach the file. It is automatically deleted after 90 days (section 9), and you can request earlier deletion at any time (section 12).
5. Purposes and legal bases
| Purpose | Legal basis (LGPD, art. 7) |
|---|---|
| Measure audience and understand which content is useful | Consent (item I), collected through the notice shown on your first visit. Until you authorize it, nothing is measured — the tool is not even loaded. You can change your mind at any time (section 6) |
| Know how many conversations the site generates, without knowing who started them (the "contact-initiated signal" in section 4) | Consent (item I), the same as the measurement notice: without it the event does not exist. Clicks on the DPO's addresses are excluded by our own decision — exercising a right is not a business contact and must not become a metric |
| Operate the site, keep it available, and protect it against abuse | Legitimate interest (item IX) |
| Keep access logs of an internet application | Compliance with a legal obligation (item II), under art. 15 of the Marco Civil da Internet (Brazilian Internet Civil Framework) |
| Reply to contact you initiate | Preliminary procedures to a contract, at your request (item V) |
| Receive, store, and listen to the audio message in order to contact you through the channel you indicate | Consent (item I), expressed by tapping Send — the notice sits next to the button, and the recording does not leave your device before that. Since the message is a request for contact, the processing also rests on preliminary procedures to a contract (item V). You can withdraw consent and request deletion at any time (section 12), without having to justify it |
You may object to any processing based on legitimate interest — see section 12.
6. Cookies and browser storage
How the control works. On your first visit a notice appears with two options: Accept or Decline. The measurement tool is only loaded if you accept — we do not resort to the trick of loading it first and "turning it off" later. If you decline, or simply ignore the notice, no measurement cookie is set and no browsing information leaves your browser. Your choice is stored on your own device, and the notice does not bother you again.
| Technology | What it stores | When it exists |
|---|---|---|
| Audience measurement cookies (Google Analytics) |
A pseudonymous browser identifier, to avoid counting the same visit twice | Only after you accept. Before that, they do not exist |
| localStorage (zdz-consent) | Your answer to the notice: authorized or declined | After you answer. It is what avoids asking again on every page |
| localStorage (zdz-theme) | Your light/dark theme preference | When you toggle the theme. It is not a cookie and is never transmitted |
| localStorage (zdz-atendente-dispensado) | That you closed the voice assistant, so it does not reappear | When you dismiss the assistant. It stays on your device and is never transmitted |
| Microphone permission stored by your browser, not by us |
If you authorize recording, your browser may remember that authorization for this site. The browser stores it, not us | When you authorize it. To revoke it, use the padlock (or microphone) icon in your browser's address bar — we cannot do that for you |
We do not use advertising, cross-site tracking, or profiling cookies.
6.1 Changing your mind at any time
Withdrawal is as simple as consent, as required by art. 8, §5 of the LGPD:
You can also delete cookies and local storage through your browser settings, or install the Google Analytics opt-out add-on. Either way, the site keeps working in full.
7. Sharing and sub-processors
To operate this site we rely on the vendors below. None of them receives your data, on our initiative, for advertising purposes of their own. The fonts have been served from our own domain since August 2, 2026 — no request leaves your browser toward Google Fonts, which is why it no longer appears on this list:
| Vendor | Role | What it receives |
|---|---|---|
| Google LLC — Google Analytics 4 | Audience measurement | The browsing data described in section 4 |
| Microsoft Corporation — Azure | Storage of the pages' static files and, in a private and separate area, of the audio messages | For the pages, nothing beyond what is needed to deliver the requested file. For the audio messages, the audio file and the four technical fields described in section 4. Storage is located in the Brazil South region (São Paulo), with encryption at rest, and the vendor does not use this content for purposes of its own |
| Meta Platforms, Inc. — WhatsApp | Business contact channel, when you decide to write to us | The message text, which includes whatever you filled in on the home page form (name, e-mail, company, and project description), plus the data Meta processes on its own in operating the app. Mind the timing: since the wa.me link carries the text in the address, that information reaches a Meta server as soon as the tab opens — before your confirmation. What depends on your confirmation is the conversation reaching us |
The edge infrastructure that serves the site is operated by ZDZCloud itself and is therefore not a sub-processor. See Google's privacy policy for the processing it performs as a vendor.
8. International transfer
The vendors in section 7 may process data outside Brazil. These transfers rely on the contractual clauses and protection commitments offered by each vendor in their respective data processing agreements, under art. 33 of the LGPD.
One deliberate exception: the audio messages do not leave Brazil. They are stored in the Brazil South region (São Paulo) — a choice we made precisely because they are the most personal data this site receives.
An operating rule we keep: a sub-processor without a formalized legal basis receives no data.
9. Retention and deletion
- Audience data: kept for the period configured in the measurement tool and, at its end, deleted or anonymized by the service itself.
- Access logs: kept for 6 (six) months, the period set by art. 15 of the Marco Civil da Internet, and discarded afterwards, unless a court order requires longer retention.
- Communications you initiate: kept for as long as the relationship lasts and for the applicable limitation periods.
- Audio messages: 90 days. Deletion is automatic — a rule in the storage itself deletes the file 90 days after receipt, without depending on anyone remembering to do it. If, before that, the contact turns into a negotiation, the relevant content becomes business communication (item above) and the original audio is still deleted on schedule. You can request deletion before the 90 days through the DPO channel, dpo@zdzcloud.com.br — and you can also ask directly whoever is talking to you, via comercial@zdzcode.com.br or WhatsApp; we will forward the request.
10. Security
The site is served exclusively over an encrypted connection (HTTPS; any
request over http is redirected) and applies a restrictive content
security policy, which limits the origins the page can load resources from. The site
does not receive form data on our servers and does not maintain user accounts, so there are
no visitor credentials or registrations stored in our infrastructure.
For the audio messages, which are the only content that reaches us, the measures are specific: upload over an encrypted connection only; storage in a private area, separate from the one that serves the pages, with public access disabled at the storage-account level, which prevents a wrong setting on an individual container from exposing it; encryption at rest; a file name generated by us, never by your browser; limits on accepted size and format; and automatic deletion after 90 days. The file is delivered as a download and is never displayed embedded in a page. None of these measures is an absolute guarantee — security is built in layers, and what we can promise is that they exist, they are verifiable, and we treat them as an obligation.
11. Access logs and the Marco Civil da Internet
Art. 15 of Law 12,965/2014 requires internet application providers to keep application access logs for 6 months, under confidentiality and in a controlled environment. We comply with this obligation. These logs are only handed to third parties under a court order, and we will inform you whenever the law allows us to do so.
12. Your rights and how to exercise them
You have the rights set out in art. 18 of the LGPD:
| Right | How we fulfill it |
|---|---|
| Confirmation that processing exists and access to the data | We acknowledge receipt within 5 business days; full reply within 15 days (art. 19, II), a period extendable under ANPD Resolution CD/ANPD No. 2/2022, as we qualify as a small-scale processing agent |
| Correction of incomplete, inaccurate, or outdated data | Within 15 days |
| Anonymization, blocking, or deletion of unnecessary or excessive data | Within 15 days, subject to the legal retention described in section 9 |
| Portability | Within 30 days, extendable by another 30, in a structured, interoperable format. An honest note: this site has no user registration. If you sent us an audio message, that file exists and we will hand it to you upon request |
| Information about sharing | The list is in section 7 |
| Withdrawal of consent | Immediate, where processing is based on consent |
| Objection to processing based on legitimate interest (art. 18, §2) | Within 15 days, with a reasoned reply. For audience measurement, the effect is immediate through the means described in section 6 |
| Petition to the authority (art. 18, §1) | You can complain directly to the ANPD at any time, without having to contact us first |
To exercise any of them, write to dpo@zdzcloud.com.br.
13. Children and teenagers
This is a business-content website, not directed at anyone under 18, and we do not knowingly collect data from children or teenagers.
We need to be frank about one point: the audio message button is anonymous and does not verify age — technically, a teenager could record. We cannot prevent that without asking for data we prefer not to ask for. What we do is this: if we realize, upon listening, that a message came from someone under 18, we delete the audio and do not return the contact; and a parent or guardian can request deletion at any time through the DPO channel, with nothing to prove beyond the request itself. If you identify improper collection, write to the DPO so we can delete it.
14. Changes to this Policy
We may update this document to reflect changes to the site or to legislation. The version and date at the top indicate the text in force. Relevant changes — especially the adoption of new collection technologies — will be reflected here before or at the moment they take effect.
15. DPO and authority channels
| Channel | Address |
|---|---|
| Data Protection Officer (DPO) | dpo@zdzcloud.com.br |
| Contact and support | suporte@zdzcloud.com.br |
| Sales | comercial@zdzcode.com.br · WhatsApp +55 11 97689-4645 |
| Brazilian National Data Protection Authority (ANPD) | gov.br/anpd |
16. Governing law and venue
This Policy is governed by the laws of the Federative Republic of Brazil, in particular Law 13,709/2018 (LGPD), Law 12,965/2014 (Marco Civil da Internet), Law 8,078/1990 (Consumer Protection Code) and Decree 7,962/2013.
If you are a consumer, the courts of your place of residence shall have jurisdiction. Nothing in this Policy may be construed as a waiver of any right guaranteed by the Consumer Protection Code.
In all other cases, the courts of the judicial district of ZDZCloud's headquarters, São Paulo/SP, shall have jurisdiction, as the connecting factor required by art. 63 of the Brazilian Code of Civil Procedure, as amended by Law 14,879/2024.