Legal
Privacy Policy
Last updated: 20 September 2026
This Privacy Policy explains how RobotiZap, a platform operated by PK Systems (CNPJ 43.456.936/0001-34, with its registered office in Lajeado-RS, Brazil), collects, uses, stores and shares personal data. We comply with the Brazilian General Data Protection Law (Lei nº 13.709/2018 — LGPD).
1. Who we are and our role regarding your data
RobotiZap acts in two distinct roles under the LGPD:
• Controller of the personal data of the business owner who subscribes to the platform (you, our customer): name, email, telephone number, CPF/CNPJ (Brazilian tax ID), payment details and platform usage data.
• Processor of the personal data that your business collects from its end customers (patients, salon or barbershop clients, etc.) when using RobotiZap. In this case, your business is the Controller of that data, and we process it solely to deliver the contracted service.
2. What data we collect
2.1. From the business owner (our customer)
• Registration data: name, email, telephone number, password (stored in encrypted form), business name.
• Tax/payment data: CPF or CNPJ, billing details and transaction identifiers (Pix or card). Full card details are processed directly by our payment processor and are not stored on our servers.
• Usage data: pages visited, actions taken in the dashboard, access logs, IP address and browser type.
2.2. From your business's end customers
When your end customer chats with your WhatsApp through RobotiZap, we may process:
• Name, WhatsApp number and, if provided, email address.
• Messages exchanged in the booking flow (text and audio).
• Booking data: service, professional, date, time, price, status, rating.
• Deposit/service payment data, where applicable.
This data belongs to your business (the Controller). RobotiZap only processes what is necessary to provide the contracted service.
2.3. From visitors to our website
• IP address, browser type and version, device and operating system.
• Pages visited and on-page actions, via cookies and analytics tools.
• Campaign identifiers (UTM, click ID).
3. Legal bases and purposes
We process your personal data on the grounds set out in Articles 7 and 11 of the LGPD:
• Performance of a contract (Art. 7, V): to create and maintain your account, process payments, provide support and operate the platform.
• Legal or regulatory obligation (Art. 7, II): to issue tax documents, respond to requests from authorities and comply with statutory deadlines.
• Legitimate interest (Art. 7, IX): to prevent fraud, keep the platform secure, improve the product and analyse aggregate usage.
• Consent (Art. 7, I): to send marketing communications, use non-essential cookies and for any other purposes not covered by the grounds above.
4. Who we share data with
We share data strictly with suppliers that help us operate the platform, always under a confidentiality agreement and within the limits of this policy:
• Meta Platforms: as a certified Tech Provider, the processing of WhatsApp messages is governed by Meta's policy and the Official WhatsApp Business API.
• Cloud infrastructure providers: for hosting, databases and backups.
• Payment processors: to charge for the subscription, credit packs and booking deposits.
• Artificial intelligence providers: when your business uses the AI assistant, the content of conversations (including audio transcriptions) is sent to these providers solely to generate the assistant's replies.
• Analytics and marketing tools: Google Analytics and Google Ads (via gtag), Meta Pixel and Microsoft Clarity (session recording and heatmaps).
• Public authorities: when required by law, court order or legitimate request.
We do not sell your personal data. We do not share data about your business's end customers with third parties for their own marketing purposes.
5. Cookies and similar technologies
We use our own and third-party cookies to make the website work, remember preferences and understand how it is used. You can block or delete cookies at any time in your browser settings — some features may stop working.
• Essential: required for login, security and the operation of the platform.
• Analytics: measure how visitors interact with the website (Google Analytics, Microsoft Clarity). They help us improve the product.
• Marketing: identify visitors in advertising campaigns (Google Ads via gtag, Meta Pixel).
6. How long we keep your data
• Your account data: for as long as your subscription is active and for up to 90 days after cancellation, to allow reactivation. After this period, the data is deleted or anonymised, except where there is a legal obligation to retain it (e.g. tax documents for 5 years).
• Data about your business's end customers: retained for as long as your account is active. After your subscription is cancelled, it follows the same 90-day period before deletion.
• Access and security logs: up to 6 months, in accordance with Art. 15 of the Marco Civil da Internet (Brazilian Internet Civil Framework).
• Backups: cycles of up to 30 additional days after the deletion of active data.
7. Your rights as a data subject
The LGPD (Art. 18) guarantees you, at any time and free of charge:
• Confirmation that processing takes place and access to your data.
• Correction of incomplete, inaccurate or outdated data.
• Anonymisation, blocking or deletion of data that is unnecessary, excessive or processed in breach of the law.
• Portability of your data to another provider of a service or product.
• Deletion of data processed on the basis of consent.
• Information about who we share your data with.
• Withdrawal of consent at any time.
• Objection to processing carried out on the basis of legitimate interest.
To exercise any of these rights, send an email to email@robotizap.com. We respond within 15 days.
8. Data security
We adopt reasonable technical and organisational measures to protect your data: encryption in transit (TLS), role-based access control, audit logging and periodic backups. Passwords are stored with a cryptographic hash — not even our team can read them.
Despite all our efforts, no system is 100% secure. In the event of an incident that may pose a significant risk or harm to data subjects, we will notify those affected and the Brazilian National Data Protection Authority (ANPD) within the statutory deadlines.
9. International transfers
Some of our suppliers (cloud providers, Meta, Google and artificial intelligence providers) may store and process data outside Brazil. These transfers only take place to countries with an adequate level of protection or under specific contractual clauses, in accordance with Art. 33 of the LGPD.
10. Children and adolescents
RobotiZap is not directed at people under 18. We do not knowingly collect data from children or adolescents. If your business serves minors (e.g. a paediatric or paediatric dental practice), consent to and responsibility for the processing of that data lie with their parents or legal guardians, through your establishment.
11. Contact and Data Protection Officer (DPO)
Under Art. 41 of the LGPD, we have appointed the following Data Protection Officer. Use this channel for questions about this policy, to exercise your rights or to report incidents:
• Data Protection Officer (DPO): Paulo Kramer
• Email: email@robotizap.com
• Address: Lajeado-RS, Brazil
12. Users in the EU/EEA and the UK
This section applies when the business customer or the data subject is in the European Union or the European Economic Area (EU/EEA) or in the United Kingdom. In these cases, the General Data Protection Regulation (Regulation (EU) 2016/679, “GDPR”) and the UK GDPR apply alongside the LGPD.
12.1. Our role
• Controller: PK Systems is the controller of the business customer's account data (section 2.1).
• Processor: for the data of the business's end customers (section 2.2), the business is the controller and RobotiZap is the processor. We process that data only on the business's instructions and only to provide the service. The Terms of Use and this Privacy Policy form the data processing agreement between us. A separate data processing agreement (DPA) can be requested at email@robotizap.com.
12.2. Legal bases
Under Article 6(1) of the GDPR, we process personal data on the following bases:
• Contract (Art. 6(1)(b)): to create and maintain the account, process payments, provide support and operate the platform.
• Legal obligation (Art. 6(1)(c)): to issue tax documents and respond to requests from authorities.
• Legitimate interests (Art. 6(1)(f)): to prevent fraud, keep the platform secure and improve the product.
• Consent (Art. 6(1)(a)): for marketing communications and non-essential cookies. You may withdraw your consent at any time; this does not affect processing carried out before the withdrawal.
12.3. Your rights
You have the right to:
• Access your personal data.
• Have inaccurate or incomplete data rectified.
• Have your data erased.
• Restrict processing.
• Receive your data in a portable format (portability).
• Object to processing, including processing based on legitimate interests.
• Withdraw consent at any time.
• Not be subject to a decision based solely on automated processing that produces legal effects concerning you or similarly significantly affects you.
To exercise any of these rights, send an email to email@robotizap.com. We respond within one month of receiving the request. If you are an end customer of a business that uses RobotiZap, you can also contact the business directly, as it is the controller of your data.
12.4. Complaints
You have the right to lodge a complaint with the data protection supervisory authority where you live or work, or where the alleged infringement took place — for example, the Data Protection Commission (DPC) in Ireland, the Information Commissioner's Office (ICO) in the United Kingdom, the Comissão Nacional de Proteção de Dados (CNPD) in Portugal or the Agencia Española de Protección de Datos (AEPD) in Spain.
12.5. International transfers
Data is processed in Brazil and by providers in other countries (sections 4 and 9). Transfers of personal data from the EU/EEA or the UK rely on the standard contractual clauses approved by the European Commission (with the UK Addendum or the UK International Data Transfer Agreement for transfers from the UK) or on another appropriate safeguard under Article 46 of the GDPR. You can request a copy of these safeguards at email@robotizap.com.
12.6. Retention
We keep personal data for the periods set out in section 6.
13. Changes to this policy
We may update this Privacy Policy to reflect changes in the service, in legislation or in market practice. Where there are material changes, we will let you know through the admin dashboard or by email. The version in force is always the one published at this address, with the date of the last update at the top.