1 · Who we are and what this covers
Bzzip is operated by Preduzetnik Georgii Tcamaladze pr Beograd, Studentski trg 4, 7th floor, 11158 Belgrade (Stari Grad), Serbia, registration number 68347114, tax ID (PIB) 115413497 ("Bzzip", "we"). This policy explains how we handle personal data when you visit bzzip.com, create an account, or use the Bzzip service to talk to your customers on WhatsApp and Instagram.
We play two roles. For your account, your team, our website and our own sales and support, Bzzip is the controller. For the conversations your business has with its customers through Bzzip, your business is the controller and Bzzip processes that data on your behalf and on your instructions, under the data processing terms in section 9 of our Terms of Service. If you are a customer of a business that uses Bzzip, please contact that business first; we will help it answer you.
Our contact for data protection matters, including the LGPD's encarregado role, is privacy@bzzip.com.
2 · Data about you and your team
Account data: your name, email address, a password stored only as a one-way hash, your business name, your role, your language and time zone, and, if you give them, your phone number and whether you agree to be contacted on WhatsApp.
Usage and device data: the IP address and browser of each signed-in session, the times you were active, and server logs. When you first arrive we keep a cookie with the advertising campaign that brought you (UTM parameters, the Google click ID and the landing page) and copy it onto your account when you sign up.
Billing data: your plan, subscription status, invoices and payment history. Payments are processed by Paddle.com, our reseller and Merchant of Record: card and payment details are entered in Paddle's checkout and held by Paddle, never by us. We receive the plan, the amounts, the subscription status and a customer reference.
Requests you send us: demo and contact forms, support tickets and access requests (such as asking for Instagram), with the details you type into them.
3 · Data about your customers (the conversations)
When you connect a channel, we receive and store what your customers send to it and what your business sends back: their name or handle as the channel reports it, their phone number or account identifier, profile pictures where available, message text, photos, videos, voice notes and files, reactions, and delivery and read status. Voice notes may be transcribed so the AI Agent can read them.
Your team may add internal notes, assignments and tags. If you use the AI Agent, we also store the knowledge you give it (texts, question-and-answer pairs, prices, website pages and documents you point it at), the drafts and replies it writes, a short memory per conversation (for example the customer's name, the service they asked for, a time or an address), and a record of each decision it took.
The raw deliveries we receive from channel providers are kept for a short time to prevent duplicates and to investigate problems (see section 7).
4 · Why we use it and on what legal basis
To provide the service you signed up for: showing and sending your messages, running the AI Agent you configure, notifying your team, and billing you. The legal basis is the performance of our contract with you.
To keep the service secure and working, to understand how it is used and to improve it, and to measure our own advertising. The legal basis is our legitimate interest, balanced against your rights; you can object at any time (section 10).
To contact you on WhatsApp about your account or a request you made, only if you agreed to it. The legal basis is your consent, which you can withdraw at any time.
To meet legal obligations, such as keeping billing records and answering lawful requests from authorities.
We do not sell personal data. We do not use your conversations or your customers' data to train AI models, and we do not use them for advertising.
5 · The AI Agent
If you turn on the AI Agent, customer messages, your knowledge and the conversation memory are sent to an AI model to classify the message and write a reply. Depending on your settings, the reply is sent automatically, left as a draft for your team, or handed to a person.
With your own key ("bring your own key"), requests go to the provider you chose (Anthropic or OpenAI) under your own agreement with that provider. With Bzzip's managed AI, requests go through OpenRouter to the model providers listed in section 6, with a setting that asks them not to store or train on the data.
The AI Agent does not make decisions that produce legal effects on your customers. It answers questions from the knowledge you give it and hands over to a person when your rules say so.
6 · Who else processes data
We use the following providers, each only for the purpose shown. Hosting: Hetzner Online (servers in Helsinki, Finland), where our database, files and self-hosted services run. Email: Resend (account and notification emails). Payments: Paddle.com (Paddle.com Market Ltd and its affiliates), our reseller and Merchant of Record, which processes your payment and billing details as an independent controller under its own privacy policy; Mercado Pago and Stripe, where enabled.
Analytics and advertising: Google Analytics and Google Ads (visits, events and conversions) and PostHog, hosted in the EU (product analytics and session recordings of our website and app). Session recordings hide every form input and the areas of the app that show conversations, but other text on screen can be recorded; when you are signed in we tell PostHog your name, email and business so we can help you. Fonts are loaded from Google Fonts and Fontshare, which see your IP address.
AI: OpenRouter and, through it, Google, Anthropic, OpenAI and TypeSafe (managed AI); Anthropic or OpenAI directly when you bring your own key. Messaging: Meta (WhatsApp Cloud API and Instagram, where you connect through Meta); Unipile, for Instagram accounts connected through Unipile (it holds the Instagram session and relays messages); WhatsApp itself, which carries every WhatsApp message. Numbers connected by QR code run through our own Evolution API server on our hosting, not through a separate company.
Notifications: Telegram, which carries our internal alerts about new sign-ups, leads and support requests (including what you wrote in them) and, if you switch it on, the alerts the AI Agent sends you about conversations that need a person, which include a short excerpt of the customer's last message.
We may also disclose data when the law requires it, to protect our rights or users' safety, or to a successor if Bzzip is sold or merged, in which case this policy continues to apply.
7 · How long we keep it
Account, conversation and knowledge data are kept while your account exists. Archiving a workspace hides it but does not delete it, so that it can be restored.
Some records expire on their own: raw channel deliveries 14 days after they are processed, billing provider deliveries after 90 days, read notifications after 90 days, and signed-in sessions 7 days after they expire (sessions last 30 days, or 90 days if you chose to stay signed in).
When you ask us to delete your account or a workspace, we remove it from our production systems within 30 days of confirming the request, except what we must keep by law (such as invoices). Residual copies in backups, if any, are overwritten in the normal cycle and are never restored for use.
8 · Security
Connections to Bzzip are encrypted in transit. Passwords are stored only as hashes. The access tokens issued when you connect a channel through Meta, and any AI key you bring, are encrypted at rest. Access inside an account follows roles: admins and managers see every workspace of their business, other members only the workspaces they are assigned to.
A small number of Bzzip staff can access production systems to run and support the service, and use that access only for that purpose. No system is perfectly secure; if a breach affects your data we will tell you without undue delay and do what the law requires.
9 · International transfers
Our servers are in the European Union. Some providers above are in the United States or other countries. Where the law requires it, transfers rely on appropriate safeguards such as the European Commission's standard contractual clauses, or on the other mechanisms the LGPD allows.
10 · Your rights
Depending on where you live, you can ask us to confirm whether we process your data, to give you access to it or a copy of it, to correct it, to delete it, to anonymise or block it, to restrict or object to its use, to move it to another provider, to tell you who we share it with, and to withdraw a consent you gave. Under the LGPD and the GDPR you can also complain to your data protection authority (in Brazil, the ANPD).
There is no self-service export or deletion button yet: write to privacy@bzzip.com from the email on your account. We confirm receipt, may ask you to prove it is you, and answer within 15 days.
If your request is about a conversation a business had with you through Bzzip, that business decides; send it to them, or to us and we will pass it on.
11 · Cookies and similar technologies
Necessary: a session cookie that keeps you signed in and a short-lived cookie used during sign-in and sign-up. Measurement: a first-party cookie that remembers which campaign brought you (90 days), Google Analytics and Google Ads cookies, PostHog cookies and storage, and a small local-storage entry that stops us counting the same event twice.
A banner asks for your choice the first time you visit, and "Cookie settings" at the bottom of the site lets you change it at any time. If your browser is set to a time zone in Europe, measurement tools do not load at all until you press Accept; elsewhere they load unless you press Refuse. Refusing deletes the measurement cookies already set and stops the campaign cookie. Your choice is kept in a cookie for 180 days.
You can also block or delete cookies in your browser settings; the service needs the necessary ones to sign you in. Google offers a browser add-on to opt out of Google Analytics.
12 · Children
Bzzip is a tool for businesses and is not directed at children. Accounts are for people aged 18 or over acting for a business. If you believe a child has given us personal data, write to us and we will delete it.
13 · Changes and contact
If we change this policy we will update the date at the top. If a change is material, we will tell account admins by email or in the product before it takes effect.
Preduzetnik Georgii Tcamaladze pr Beograd, Studentski trg 4, 7th floor, 11158 Belgrade (Stari Grad), Serbia, registration number 68347114, tax ID (PIB) 115413497 — privacy@bzzip.com. The English version of this policy prevails over translations.