Data Processing Agreement
This agreement is part of the Terms of Use and applies between Voza's customer ("customer") and Voza to the personal data that Voza processes on the customer's behalf when providing the service. Voza is operated by Voza. It complies with the LGPD (Brazil) and the other data protection laws that apply to the processing. If the customer needs a signed version, just ask through the contact below.
1. Roles
The customer is the controller of the data of the messages and calls of its numbers. Voza is the processor: it processes that data only to provide the service, following the customer's instructions. The instructions are the customer's use of the API and the dashboard (for example, sending a message or setting up a webhook), these terms and anything else agreed in writing.
2. Which data, whose and for how long
- Data subjects: the contacts that the customer's numbers talk to, and the people on the customer's team who use Voza.
- Data: phone numbers, profile names, the content of messages and media, and call metadata.
- Processing: receiving, transmitting, delivering to the customer's webhook and storing temporarily, only for the periods in the Privacy Policy.
- Duration: while the customer uses Voza, until the deletion described in section 8.
3. The customer's obligations
- Have a legal basis to process its contacts' data and to talk to them on WhatsApp, such as consent or a contract.
- Tell contacts when calls are recorded, if the applicable law requires it.
- Give lawful instructions and answer data subjects' requests about the data it controls.
4. Voza's obligations
- Process the data only following the customer's instructions, and warn the customer if an instruction seems to break the law.
- Ensure that anyone with access to the data is bound by confidentiality.
- Maintain the security measures in Annex A.
- Help the customer, as far as reasonable, answer data subjects' requests and data protection authorities.
- Give the customer the information needed to demonstrate compliance with this agreement.
5. Sub-processors
The customer authorizes Voza to use the sub-processors in Annex B. Voza gives at least 30 days' notice before adding or replacing a sub-processor; the customer may object for a reasonable reason and, if no agreement is reached, cancel the subscription at no cost for the remaining period. Voza requires from each sub-processor data protection obligations equivalent to those of this agreement.
6. Security incidents
Voza notifies the customer without undue delay, and within 48 hours of confirming it, of any security incident affecting the customer's data, with the information available about what happened, the data affected and the measures taken, so that the customer can meet its own notification duties.
7. International transfers
Voza's servers are in the European Union. When data is processed in another country, Voza ensures the protection required by the applicable law, for example with data protection clauses in its contracts.
8. End of processing
When the customer deletes a number or the account, Voza stops processing the corresponding data and deletes it within 30 days, except what the law requires it to keep. Before deleting the account, the customer can export its data in the dashboard. As Voza does not store conversations, the message history stays with the customer, in the system that receives the webhooks.
Annex A: security measures
- HTTPS on all public traffic and a private network between Voza's services.
- Passwords and API keys stored only as hashes; secrets, tokens and events in transit encrypted.
- Signed webhooks, and private network addresses refused in webhooks and media links.
- Isolation between accounts in every query, and request limits per account.
- Administrative access restricted to Voza's team, and a second factor available at sign-in.
- Short retention periods: message content only until delivery, media for 24 hours.
Annex B: sub-processors
| Sub-processor | Role | Where |
|---|---|---|
| Railway Corp. | Hosting of the servers and the database | European Union (Amsterdam) |
| Cloudflare, Inc. | Encrypted relay of the audio of calls in the browser | Global |
| Resend, Inc. | System emails to the customer's team | European Union and United States |
Meta Platforms (WhatsApp) is the channel the customer itself chooses to talk to its contacts; for official numbers, the data goes through the customer's Meta account, under the customer's contract with Meta. Stripe only processes the billing data of the customer's account, as an independent controller.
Contact
Voza. Questions about this document or about your data: suporte@vozaapi.com.
Last updated: 11/06/2026.