Privacy policy

Zimmo is the controller of personal data collected on its institutional website, and the processor of personal data handled on behalf of the customers who use the platform. This policy describes how we handle data in both roles.

For purposes of Brazil's LGPD (Law No. 13,709/2018), our data protection officer (DPO) can be reached through the contact form available on this site.

Registration data: name, email, phone number, company, and role, provided directly by you when creating an account or requesting contact.

Usage data: technical access logs, IP address, device identifiers, interface preferences, and aggregated usage metrics, collected automatically to operate and improve the service.

Operational data: information uploaded by customers while using the platform, including contacts, messages, contracts, payments, and content associated with workflows. In these cases we act as processor, following the instructions of the customer (controller).

Delivering the contracted service, including authentication, transaction processing, transactional communications, and features such as automations and recurring billing.

Customer support, incident resolution, and handling account-related requests.

Product improvement, security, fraud prevention, and compliance with legal, regulatory, and contractual obligations.

Commercial communications about Zimmo, only on an adequate legal basis and with the ability to unsubscribe at any time.

When you connect a Google account (Gmail, Contacts, or Calendar) to Zimmo, we request only the gmail.readonly scope, used exclusively to read incoming messages for features you turn on yourself, such as the AI sales agent and AI reply suggestions. Zimmo never sends email on behalf of your Google account, and never reads data beyond what those features require.

Data obtained through Google APIs is never used to train a generalized or third-party AI model. When an AI feature is active, the relevant content (email subject and body, or contact details) is sent to OpenAI, our only large-language-model provider, under a standard API plan, without a Zero Data Retention contract. OpenAI does not use this content to train its own models.

Zimmo's use of information received from Google APIs adheres to the Google API Services User Data Policy, including the Limited Use requirements (developers.google.com/terms/api-services-user-data-policy).

You can revoke Zimmo's access to your Google account at any time, either from your Google account's own security settings or by disconnecting the integration inside Zimmo. Disconnecting deletes messages, attachments, and email conversations imported from that account from our systems.

We process personal data based on: contract performance (when necessary to deliver the service); legitimate interest (for security, continuous improvement, and operational analytics); consent (when explicit, such as for marketing communications); and compliance with a legal or regulatory obligation.

When we act as processor, the legal basis is defined by the controlling customer. We recommend customers maintain their own record of legal bases for the processing they carry out.

We may share data with subprocessors strictly necessary for operation: cloud infrastructure providers, payment gateways, transactional email providers, the Meta/WhatsApp Business API, and observability and analytics tools. We select partners that maintain robust security and data protection standards.

We may disclose data to competent authorities when required by law, court order, or a legitimate regulatory request. We do not sell personal data to third parties.

Some subprocessors process data outside Brazil. When that happens, we adopt adequate safeguards, such as standard contractual clauses and security requirements equivalent to the level of protection required under Brazilian law.

We keep personal data for as long as necessary to fulfill the purposes described above, unless a different period is required by law. Billing data and technical access logs may be kept for additional periods for tax, accounting, and security purposes.

After the relationship ends, a customer's operational data is anonymized or deleted within a reasonable period, with backup copies preserved under standard technical retention windows.

Under the LGPD, you may request: confirmation that processing exists; access to your data; correction of incomplete, inaccurate, or outdated information; anonymization, blocking, or deletion of unnecessary data; portability; information about sharing; and withdrawal of consent.

Requests can be sent through this site's contact form, identified as a data subject request. We will respond within the legal deadlines, and may request additional information to confirm the requester's identity.

We adopt technical and organizational measures appropriate to the nature of the data processed, including encryption in transit and at rest, access controls based on least-privilege principles, environment segregation, continuous monitoring, and incident response routines.

No method of transmission or storage is completely secure. In the event of a security incident that creates material risk to data subjects, we will notify affected individuals and competent authorities as required by law.

On zimmo.io we use first-party and third-party cookies for three purposes: keeping the site working (essential cookies), measuring how pages are used (analytics) and, if you allow it, showing more relevant ads (advertising). The last two are only enabled after your choice in the cookie notice, which you can change at any time under “Cookie preferences” in the site footer.

Analytics and advertising are operated by Google Tag Manager, Google Analytics 4 and the Meta Pixel. When you accept, these services may set cookies such as _ga and _fbp on the zimmo.io domain. When you decline, Google Analytics runs without cookies and only in aggregate (Consent Mode), and the Meta Pixel is not loaded.

Zimmo's own cookies: zmo_consent stores your choice for 180 days; zmo_attr records, for 90 days, the origin of the visit (campaign, landing page and click identifiers such as gclid and fbclid) so that a sign-up is correctly attributed to the campaign that originated it, based on our legitimate interest; zmo_vid is an anonymous visitor identifier, created only with your analytics consent and valid for 13 months.

When a sign-up is completed on app.zimmo.io, we may send the same partners a conversion event from our servers (Meta Conversions API and Google Analytics Measurement Protocol). These submissions respect your consent choice, and contact data is pseudonymised by hashing (SHA-256) before being sent.

On the platform (app.zimmo.io) we use essential cookies to keep sessions authenticated and remember preferences. You can also manage cookies in your browser settings; some features may be limited if essential cookies are blocked.

We may update this document to reflect changes in the product, in subprocessors, or in legal requirements. Material changes will be communicated through appropriate channels, and the update date at the top of the document always reflects the version in effect.

For any matter related to this policy or to Zimmo's processing of personal data, use the contact form available in this site's footer. We will route your request to the appropriate team.