Privacy Notice

1. Data Controller

"Zaplia" is the trade name under which the service is provided by an individual registered as a sole proprietor with Mexico's Federal Taxpayer Registry (hereinafter, "ZAPLIA" or the "Controller"). The Controller's name, tax ID and tax address appear on the tax invoice (CFDI) for every charge and are provided in writing on request at privacidad@zaplia.app; the Controller may assign its role to the company it incorporates to continue the service. ZAPLIA is legally domiciled in Mexico, is the controller responsible for the processing and protection of your personal data under Mexico's Federal Law on Protection of Personal Data Held by Private Parties and its regulation, applied supplementarily. Following the reform published in the Federal Official Gazette on March 20, 2025, the competent authority is no longer INAI (dissolved) — it is now the Secretaría Anticorrupción y Buen Gobierno (Anti-Corruption and Good Governance Secretariat), through its General Directorate for Personal Data in the Private Sector.

2. Zaplia as Controller and as Processor

This distinction matters and Mexican law requires it to be explicit: for your account data (you, your team, your billing), ZAPLIA is the Controller. For your customers' data — the contacts who message you on WhatsApp or your webchat — ZAPLIA acts only as a Processor: we handle that information under your instructions, so you can serve them, and never use it for our own purposes or mix it across businesses (every account is isolated at the database level). The business using Zaplia is the Controller toward its own customers and should maintain its own privacy notice covering Zaplia's processing.

3. Data We Collect

• Identification: Name, email address, WhatsApp number and job title.
• Mexican tax invoicing (CFDI 4.0): Tax ID (RFC), legal name, tax regime and postal code, only if you request Mexican invoicing.
• Business operations: Product catalog, quotes, conversations and transaction history that you and your customers generate while using the platform.
• Sensitive data: Zaplia does not request or require sensitive personal data (health, religion, political views, ethnicity) to operate. Because the CRM processes free-text WhatsApp conversations, a customer may mention this kind of data on their own (for example, in insurance or health-related businesses) — in that case we handle it only as part of the conversation history, on the business's instructions (as Processor), under the same security measures as the rest of your data.

4. Purpose of Processing

Your data is used for:

• Necessary purposes: creating and running your account, the multi-agent WhatsApp inbox, PDF quotes, atomic inventory, Mexican tax invoicing and technical support.
• Necessary purposes: generating draft replies and classifying messages via artificial intelligence (Google Gemini) to help you respond faster — the AI never sets prices and never processes payments or refunds, and any message it sends autonomously follows business rules you control.
• Optional purposes: sending you product updates or survey invitations — you can opt out at any time without affecting the service.

5. Data Transfers

Zaplia never sells or rents your databases. To operate the service, we share data with the following providers (Processors/sub-processors), who only process data to deliver the service we hire from them, under confidentiality obligations equivalent to this notice:

• Supabase — database and storage.
• Google (Gemini API) — natural-language processing for the AI assistant.
• Meta (WhatsApp Business Platform) — WhatsApp message delivery.
• Stripe — only YOUR Zaplia subscription billing (never the payments you collect from your own customers).
• MercadoPago — if you connect your own account to collect payments from your customers, the money goes directly to your account; Zaplia never receives or holds it.

Some of these providers process information on servers outside Mexico (mainly the United States). Under Article 35 of the Law, we require each of them to provide protection guarantees equivalent to those required by Mexican law, and we communicate this notice's purposes to them before sharing any data.

6. Access, Rectification, Cancellation & Objection (ARCO) Rights and Deletion

You may exercise your Access, Rectification, Cancellation and Objection (ARCO) rights — the Mexican-law equivalent of GDPR's access, rectification, erasure and objection rights — free of charge, by emailing privacidad@zaplia.app with your name and the data the request concerns. We will respond within the time limits set by law. We may only charge you, where applicable, the justified cost of reproducing or mailing copies.

You also have a permanent account deletion option in your settings panel to irreversibly erase your entire account, messages and inventory.

If you connected your Instagram account and want to request deletion specifically of the data we obtained from Meta, see Instagram Data Deletion.

7. Information Security

All communication is encrypted with TLS 1.3, with encryption at rest for sensitive secrets and per-account isolation (Row-Level Security) at the database level, so one business can never see another business's data. In the event of a security breach that could significantly affect your property or moral rights, we will notify you without delay, as required by law.

8. Changes to This Notice

Any change to this Privacy Notice will be published on this page with its update date; if the change is material (new purposes, new recipients), we will also notify you by email or in-app before it takes effect.