Privacy Policy

This policy explains which personal data Voza processes, why, for how long and with whom it is shared. It follows Brazil's General Data Protection Law (LGPD, Law No. 13,709/2018) and the other data protection laws that apply to customers and to the people whose data Voza processes.

Two kinds of data, two roles

• Data of Voza's customers, such as sign-up and billing details: here Voza decides how the data is processed and is the controller.
• Data of the messages and calls of customers' numbers, including the data of the contacts they talk to: here the customer decides, and Voza processes the data on the customer's behalf, as a processor, under the Data Processing Agreement. To exercise your rights over that data, contact the company that talked to you; Voza helps that company respond.

Which data we process

From your account

• Sign-up: name, email and password (stored only as a hash) and, if you give it, the company's name.
• Billing: plan, subscription status and Stripe identifiers. Card details go straight to Stripe; Voza neither sees nor stores them.
• Usage: API keys (stored only as a hash), access logs with IP address and browser, connected numbers, webhook settings and usage counters.

From visits to the website

• On the public pages (home, documentation, status, sign-up, sign-in and these legal pages): the page viewed, the language, where the visit came from (the previous site or the link's ref or utm_source), the device type, the browser, the operating system and the approximate country and city.
• The country and the city come from the IP address, looked up in a location database kept by Voza itself (MaxMind's GeoLite2): the IP is not sent to anyone and is not kept in the statistics. The country also picks the currency of the prices.
• To count visitors without identifying them, we keep a code that changes every day and cannot be linked to a person. We use no cookies for this, and a browser that asks not to be tracked (Do Not Track or Global Privacy Control) is left out of the statistics.

From the messages and calls of your numbers

• Contacts' phone numbers and profile names, the content of messages and media, and call metadata (who called, when, for how long and how the call ended).
• The audio of calls answered in the browser travels encrypted between the browser and WhatsApp; Voza does not record it.

What we use the data for

• Providing the service: delivering messages and calls, the webhooks and the dashboard (performance of a contract).
• Charging subscriptions and meeting tax and legal obligations (performance of a contract and legal obligation).
• Keeping Voza secure, preventing fraud and abuse and investigating incidents (legitimate interest).
• Sending account notices, such as email confirmation, the end of the trial and payment failures (performance of a contract).
• Knowing how many people visit the website, where they come from and what they read, and showing prices in the currency of the visitor's country (legitimate interest).

Voza does not sell personal data, does not use it for advertising and does not read customers' messages, except when needed to investigate a reported abuse or by order of an authority.

How long we keep it

• Messages and events: Voza does not store conversations. Each event is kept encrypted only until it is delivered to the customer's webhook, for at most 24 hours of retries (or the period agreed in writing with the customer, of up to 7 days); after that the content is deleted, and only the technical delivery record remains, for 7 days.
• Media received: available for download for 24 hours, then deleted.
• Web phone events: 1 hour.
• Call log and usage counters: while the account exists.
• Sign-up and billing: while the account exists; after it is closed, only what the law requires us to keep, for the legal period.
• Access logs: for the period the law requires and for as long as needed to keep the service secure.
• Website visit statistics: 12 months.

Who we share it with

Only with the providers that make Voza work, each limited to what it needs:

We also share data when the law or an order from a competent authority requires it.

International transfers

Voza's servers are in the European Union, and some providers process data in other countries. These transfers take place with the safeguards required by the LGPD and the other applicable laws, such as data protection clauses in the contracts with providers.

Security

• All public traffic uses HTTPS, and Voza's services talk to each other over a private network.
• Passwords and API keys are stored only as hashes; secrets and events in transit are encrypted.
• Webhooks are signed, and Voza refuses private network addresses, so that no one can use it to reach internal systems.
• Access to accounts requires a strong password and may require a second factor.

Your rights

You may ask for confirmation that we process your data, access to it, correction, portability, anonymization or deletion, information about sharing, and the withdrawal of a consent. Many of these actions are in the dashboard itself, such as correcting data, exporting or deleting the account. For anything else, write to the contact below; we reply within 15 days. You may also file a complaint with the data protection authority of your country (in Brazil, the ANPD).

Cookies

Voza only uses the cookies needed for sign-in, form security and the language you choose. We do not use advertising cookies or third-party analytics cookies, and Voza's own visit statistics use no cookies.

Minors

Voza is a service for businesses and is not intended for anyone under 18.

Changes

We may update this policy. When a change is material, we give notice by email or in the dashboard before it takes effect.

Contact

Voza. Questions about this document or about your data: suporte@vozaapi.com.

Last updated: 11/06/2026.