Privacy Policy

Last updated: October 31, 2026

SyncZap (https://synczap.ai) is a service of Atlas Equities LLC that connects an organization's WhatsApp to a web panel and to the AI assistants the organization itself authorizes, such as ChatGPT and Claude. This policy describes what personal data we process, why, who we share it with, how long we keep it and how you exercise your rights under Brazil's General Data Protection Law (Law 13,709/2018, LGPD) and, for California residents, the California Consumer Privacy Act (CCPA).

1. Who we are

For account, subscription, support and security data, Atlas Equities LLC is the controller. For the WhatsApp conversations an organization syncs, the customer organization is the controller and Atlas Equities LLC acts as processor, handling that data only to provide the service, according to the organization's settings and instructions. If you are a contact of a customer organization, please reach that organization first; if you write to us, we'll forward your request to it.

2. Data we process

• Account: name, email, preferred language and, when you sign in with Google, Microsoft or Apple, the account identifier the provider sends. With email sign-in we store only a hash of your password. The browser session uses an essential cookie valid for up to 30 days.
• Organization: name, members, roles, invitations (invitee email, expiry and token hash) and settings.
• Connected WhatsApp numbers: the phone number of each linked device and the connection status. Linked-device credentials stay only on the organization's sync server.
• Conversation and contact list: names and numbers of the chats, contacts and groups WhatsApp reports to the linked device, so the organization can choose what to sync.
• Messages: only from conversations with sync turned on (the ones the organization picks or, when an owner or admin turns on "Sync all conversations", all of them except WhatsApp system feeds). We keep the text, captions, sender, date and time, reactions, edits, deleted-message marks and send status. Groups are synced only when the plan allows it and the organization includes them.
• Media: images, audio, video and documents stay on the phone. SyncZap keeps only each attachment's technical descriptor (type, declared size, hashes and the data WhatsApp requires to fetch the file). When someone opens the file in the panel, asks the AI to read it, or automatic transcription receives a voice note, SyncZap downloads a temporary copy that is deleted from the server 24 hours after the download.
• AI transcripts and readings: the text produced from audio, images and documents is kept as text with the message, even after the temporary copy of the file is deleted.
• Integrations: authorizations granted to AI assistants over OAuth, API keys and webhooks. Tokens and keys are stored only as hashes; the full key is shown only when created. Webhook secrets are stored encrypted.
• Subscription: plan, status, amounts, period and Stripe identifiers. Card and billing details are collected and stored by Stripe; SyncZap never receives them.
• Support: subject, messages and author of tickets opened in the panel.
• Audit log and metrics: who took each administrative action (invitations, permissions, integrations, sync settings, deletions) and when; aggregate usage counts.
• Transactional email: invitations and notices (trial, payment, support, number limit) are queued with the recipient address, the notice type and the template data (organization name, dates and links, never WhatsApp content). Template data is wiped as soon as the email is sent or given up, and the remaining record is deleted after 30 days.
• Technical data: your IP address is used at request time to rate-limit sign-in attempts and prevent abuse, without being written to the database; the server logs technical errors for troubleshooting.

We don't use advertising cookies or third-party analytics in the panel.

3. Data received from Google, Microsoft and Apple

For social sign-in we request only the openid, email and profile scopes (name and email on Apple). We use your name, email and account identifier solely to create and authenticate your SyncZap access. We do not access email, files, contacts, calendars or any other data in those accounts.

SyncZap's use and transfer of information received from Google APIs adheres to the Google API Services User Data Policy, including the Limited Use requirements. We don't sell this data, use it for advertising, or use it to train AI models.

4. Purposes and legal bases (LGPD, art. 7)

• Providing the contracted service (syncing, displaying, searching and replying to conversations; serving authorized assistants; transcribing and reading media on request): performance of a contract (art. 7, V). For synced conversations, the legal basis is set by the controlling organization.
• Authenticating users and enforcing permissions: performance of a contract (art. 7, V) and legitimate interest in keeping the service secure (art. 7, IX).
• Billing the subscription and sending payment notices: performance of a contract (art. 7, V) and compliance with legal obligations (art. 7, II).
• Handling support tickets and sending transactional email: performance of a contract (art. 7, V).
• Preventing fraud and abuse, keeping an audit trail and diagnosing failures: legitimate interest (art. 7, IX).
• Complying with authorities and defending rights: legal obligation (art. 7, II) and regular exercise of rights (art. 7, VI).

We don't use conversation content for advertising, to profile contacts or to train AI models.

5. AI assistants connected by the organization

The organization can connect ChatGPT (OpenAI), Claude (Anthropic) or another MCP client over OAuth, or use an API key. SyncZap never pushes data to these assistants on its own: an assistant receives only what the tools return to each request it makes, within the granted scopes, and only from conversations with sync turned on. That can include contact names and numbers, message text, transcripts and AI readings; WhatsApp credentials are never sent. Sending, editing, deleting and pinning messages require explicit confirmation; marking as read and reacting do not.

What the assistant does with the data it receives is governed by the assistant provider's terms and privacy policy and by the organization's account settings in that service, including use for model training. The organization can revoke the authorization at any time in the panel.

6. AI for audio, images and documents

On plans that include media AI, when someone asks for a file to be transcribed or read (or automatic transcription is on and a voice note arrives), the file is sent to Google (Gemini API) or, alternatively, to OpenAI (API), which return the text. We use these services through their APIs, under terms that do not use the data to train models. Their keys stay only on the sync server; the file, the key and the response are not written to logs.

When an owner or admin turns on automatic transcript delivery, SyncZap sends the text over WhatsApp to the organization's own number ("Message yourself") or as a reply in the conversation of the received voice note, depending on the chosen option; in the latter case the contact sees the transcript too.

7. Who we share data with

• WhatsApp / Meta Platforms: messages sent and received travel through WhatsApp, as on any linked device. In Cloud API mode (when available, on the Business plan), messages go through Meta's official platform.
• OpenAI and Anthropic: only when the organization connects ChatGPT or Claude, and only what the tools return to the assistant's requests (section 5).
• Google (Gemini) and OpenAI: media files sent for transcription or reading (section 6).
• Stripe: payment processing and the billing portal.
• Hostinger: delivery of transactional email (SMTP).
• Hosting provider: the virtual private servers (VPS) that run the panel, the databases and the sync server.
• Google, Microsoft and Apple: only to authenticate people who choose social sign-in.
• Destinations the organization chooses: webhook URLs and systems using the organization's API keys receive the events and data the organization configured.
• Authorities: when required by law or court order.

We don't sell personal data or share it for advertising.

8. International transfers

Atlas Equities LLC is based in the United States, and the providers listed above (such as Stripe, Google, OpenAI, Anthropic and Meta) process data in the United States and other countries. The service's servers may be located outside Brazil. These transfers rely on article 33 of the LGPD, in particular when needed to perform the contract with the organization (art. 33, IX), and on the contractual safeguards those providers offer.

9. Retention and deletion

• Media copies: deleted automatically 24 hours after the download. The descriptor stays, so the file can be downloaded again while the phone still has it.
• Messages, transcripts and the conversation list: kept while the organization keeps the service, until an owner or admin uses "Erase everything" (immediately deletes the number's saved messages, attachments and files) or removes an additional number (unlinks the device and deletes that number's messages, media, session and directory). Messages a SyncZap user deletes are removed; messages deleted by the contact stay on record, marked as deleted. Turning off sync for a conversation stops saving its new messages, and those already saved are no longer shown or readable by assistants.
• Unlinking the phone ends the WhatsApp session but doesn't delete history already synced.
• End of the trial or subscription: the organization is suspended and syncing stops, but data and the session are kept so it can be reactivated. There is no automatic deletion for inactivity or suspension: to delete, use "Erase everything" or ask us.
• Email queue: template data wiped on sending; record deleted after 30 days. Webhook delivery records: deleted after 7 days.
• Account, organization, support and audit records: kept while the account or organization exists. To delete an account or an entire organization, email support@synczap.ai; deletion happens within 30 days, except data the law requires us to keep (for example tax and payment records).
• Backups: copies the team makes during service updates may hold data already deleted for an additional period, until they are replaced or discarded.

10. Security

• Per-organization isolation: each number of each organization has its own database, WhatsApp session and directory, and every request is authorized on the server against the user's membership in the organization.
• Encryption in transit (HTTPS) between browsers, assistants and the service; email sent with mandatory TLS.
• Passwords and session, OAuth, invitation and API key tokens stored only as hashes.
• Communication between the panel and the sync server authenticated with HMAC signatures and replay protection; WhatsApp credentials never leave the sync server.
• The platform console shows administrative data and counts, not conversation content. Technical access to the servers is limited to the responsible team and used only to operate the service, handle the organization's requests or comply with the law.
• An audit log of administrative actions.

No system is completely secure. If a security incident may create relevant risk or harm, we will notify the affected organizations and, when required, Brazil's data protection authority (ANPD).

11. Your rights (LGPD)

You can request confirmation that we process your data, access, correction, anonymization, blocking or deletion of unnecessary or non-compliant data, portability, information about sharing, deletion of data processed with consent and withdrawal of consent, and you can object to processing based on legitimate interest (LGPD art. 18). Email support@synczap.ai. We may ask for information to confirm your identity and will reply within 15 days. You can also file a complaint with Brazil's National Data Protection Authority (ANPD).

12. California residents (CCPA)

If you live in California, you have the right to know what personal information we collect, use and disclose (categories and purposes are in sections 2 to 7), to request access, correction and deletion, and not to be discriminated against for exercising these rights. We don't sell personal information or share it for cross-context behavioral advertising, and we don't use sensitive personal information to infer characteristics. You or an authorized agent can submit a request to support@synczap.ai.

13. Children

SyncZap is meant for businesses and people 18 or older. We don't knowingly create accounts for minors. If an organization syncs conversations with children or teenagers, it is responsible for handling them in their best interest, as the law requires.

14. Changes

We may update this policy. Material changes will be announced in the panel or by email before they take effect. The date at the top shows the latest update.

15. Contact and data protection officer