Data Processing Agreement (DPA)

Last updated: October 31, 2026

This Data Processing Agreement ("Agreement") is part of SyncZap's Terms of Use and governs the personal data that Atlas Equities LLC ("SyncZap") processes on behalf of the customer organization ("Customer") when providing the service, under Brazil's General Data Protection Law (Law 13,709/2018, LGPD). It complements the Privacy Policy.

1. Parties, subject and term

The Customer is the organization that subscribes to SyncZap and accepts the Terms of Use. This Agreement applies from acceptance of the Terms and for as long as SyncZap processes the Customer's personal data, including after the subscription ends, until that data is deleted. If it conflicts with the Terms on personal data, this Agreement prevails.

2. Definitions

Personal data, sensitive personal data, data subject, controller, processor, processing, deletion, security incident and ANPD have the meaning given by the LGPD. "Subprocessor" is a third party SyncZap hires that processes the Customer's personal data. "Panel" is SyncZap's admin area.

3. Roles and instructions

• For synced WhatsApp conversations, contacts, the robot's knowledge base and other data the Customer puts into the service, the Customer is the controller and SyncZap is the processor. For account, subscription, support and security data, SyncZap is controller, as the Privacy Policy describes.
• SyncZap processes the Customer's data only to provide the service, following the Customer's documented instructions: the Terms, this Agreement, the settings an owner or admin makes in the Panel (which conversations to sync, "Sync all conversations", automatic transcription, the robot and its modes, AI assistants, API keys and webhooks) and written requests to support.
• SyncZap tells the Customer if it believes an instruction violates the LGPD and may suspend it until it is clarified.
• SyncZap does not use the Customer's data for its own purposes, advertising, profiling, training AI models or improving the service for another customer, including in aggregated or derived form.

4. Description of processing

• Data subjects: contacts and participants of the Customer's WhatsApp conversations and members of the organization on SyncZap.
• Data: names and numbers of conversations; messages of conversations with sync on (text, captions, sender, date, reactions, edits, delivery status); media descriptors and temporary file copies, deleted 24 hours after the download; AI transcripts and readings; with the Robot add-on, the knowledge base, decision records and drafts (90 days), approved learned replies and content-free usage counts.
• Sensitive data: SyncZap does not ask for it, but it may appear in conversation content. The robot does not answer health or legal matters or messages with sensitive data: it hands the conversation to a person.
• Purpose: syncing, showing, searching and replying to conversations; serving the AI assistants and integrations the Customer authorizes; transcribing and reading media; and, with the Robot add-on, preparing replies from the Customer's base.
• Duration: while the service lasts and until deletion under clause 13.

5. Customer's duties

• Having a legal basis to process contacts' data (arts. 7 and 11) and to use the robot with them.
• Informing contacts clearly, including about the virtual assistant (art. 9). SyncZap offers a notice template for the WhatsApp profile and first message.
• Getting the consent required before messages that depend on it, such as reminders, and honoring opt-out requests.
• Handling data subjects' requests and reviews of automated decisions (art. 20), with the support in clause 10.
• Being responsible for the AI assistants, API keys and webhook destinations it connects: those services are chosen and contracted by the Customer and are not SyncZap subprocessors.

6. Confidentiality

Only authorized people bound by confidentiality access the Customer's data, and only to operate the service, handle the Customer's requests or comply with the law. The platform console shows administrative data and counts, not conversation content.

7. Security measures

• Per-organization isolation: each number has its own database, WhatsApp session, knowledge base and directory; every request is authorized on the server against the user's membership in the organization.
• HTTPS in transit; email with mandatory TLS; passwords, tokens and API keys stored only as hashes; webhook secrets and Cloud API tokens encrypted.
• Panel-to-sync-server communication authenticated with HMAC and replay protection; WhatsApp credentials and AI provider keys stay only on the sync server.
• Media is not stored: temporary copies are deleted 24 hours after the download.
• Robot: AI providers contracted without using the data for training; context limited to the conversation being handled and the number's own base; messages, names and documents treated as data, never as instructions; code validation before any reply; no index, cache or batch shared between customers; evaluations use synthetic examples, never real conversations.
• Audit log of administrative actions and technical access restricted to the responsible team.

8. Subprocessors

The Customer authorizes SyncZap to engage the subprocessors below. SyncZap imposes on them data protection obligations equivalent to this Agreement and is responsible for them toward the Customer, as the law provides.

• Meta Platforms, Inc. (WhatsApp): carrying messages sent and received. As a linked device, messages travel through the Customer's own WhatsApp; through the official Cloud API (when available), through Meta's platform linked to the Customer's WhatsApp Business account. United States and other countries.
• Google LLC (Gemini API, paid tier): media transcription and reading when requested and, with the Robot add-on, classification, search (embeddings) and drafting. United States and other countries.
• OpenAI, L.L.C. (API, with storage off): alternative to Gemini for the same purposes. United States.
• Stripe, Inc.: payments and billing portal; receives no WhatsApp content. United States and other countries.
• Resend, Inc.: transactional email delivery; receives the recipient's address and the notice data, never WhatsApp content. United States.
• Resend: transactional email delivery (SMTP); receives the recipient's address and the notice data, never WhatsApp content. United States and Brazil (São Paulo sending region).
• Hostinger: the domain's mailboxes (for example, support@synczap.ai), for messages you send us. European Union and other countries.
• Virtual private server (VPS) provider: hosting of the panel, the databases and the sync server. Its name and country are given to any Customer who asks at support@synczap.ai.

SyncZap will notify the Customer in the Panel or by email at least 30 days before adding or replacing a subprocessor. If the Customer objects on reasonable data protection grounds and the parties cannot find a solution, the Customer may end the affected service and get back the amount paid for the unused period.

9. International transfers

Atlas Equities LLC is based in the United States, and servers and subprocessors may process data outside Brazil. These transfers rely on article 33 of the LGPD, in particular when needed to perform the contract with the Customer (art. 33, IX), and on the contractual safeguards the subprocessors offer. Where the law requires, the parties will adopt the standard contractual clauses approved by the ANPD (Resolution CD/ANPD No. 19/2024).

10. Data subjects' rights

SyncZap helps the Customer answer data subjects (art. 18) with the Panel's tools: turning off sync for a conversation, deleting a conversation, "Erase everything", removing a number, deleting knowledge base sources, marking a contact as "people only" and pausing the robot. For reviews of automated replies (art. 20), the Customer checks the robot's decision records. Requests from data subjects that SyncZap receives about the Customer's data are forwarded to the Customer, without answering on its behalf.

11. Security incidents

SyncZap notifies the Customer without undue delay and, where possible, within 48 hours of confirming it, of any security incident affecting the Customer's data, with the nature of the incident, the data and data subjects possibly affected, the measures taken and a contact. SyncZap cooperates so that the Customer, as controller, can notify the ANPD and data subjects when required (art. 48), and does not notify data subjects on the Customer's behalf without instruction, unless the law requires it.

12. Audit

At the Customer's request, up to once a year and with 30 days' notice, SyncZap provides the information reasonably needed to show compliance with this Agreement, such as answers to questionnaires and a description of the security measures. On-site inspections happen only when required by an authority or after an incident affecting the Customer, by an independent auditor under confidentiality, at the Customer's cost and without access to other customers' data.

13. Deletion and return

• During the service, the Customer deletes data whenever it wants in the Panel ("Erase everything", removing a number, deleting a conversation or knowledge base sources). Temporary media copies are deleted 24 hours after the download and robot records after 90 days.
• Before deleting, the Customer can look up its data in the Panel, through connected assistants and, on plans with developer access, through the API.
• If the organization is only suspended (end of the trial or subscription), data is kept so it can be reactivated, as the Privacy Policy describes. To end for good, the Customer asks for the organization to be deleted at support@synczap.ai, and SyncZap deletes the data within 30 days, except data the law requires it to keep. Backups are replaced in the normal cycle.

14. Liability

Each party is liable for the damage it causes by breaching the LGPD or this Agreement, under articles 42 to 45 of the LGPD. The liability limits of the Terms of Use apply to the extent the law allows.

15. Contact and data protection officer