Privacy Policy — iNTELIGENCIA VIVA

Draft — pending external legal review. This document sets out the product requirements and decisions that the final text must reflect; it has not been reviewed by a lawyer. It does not constitute legal advice and is not a publishable final version.

Last updated: [EFFECTIVE DATE]

1. Scope and data controller

This Privacy Policy describes how ZARZA CORP, S.A. ("we", "us"), operator of iNTELIGENCIA VIVA, with its registered address at Concepción de San Rafael, Heredia, Costa Rica, collects, uses, and protects personal data across the product's three layers: the free Directory, the free WordPress Plugin, and the paid platform (including the agent mobile app and the public API).

We act in two distinct roles depending on whose data is involved:

Data controller with respect to the data of people who create or administer a Workspace, visitors to our own website, and users of the agent mobile app acting as agents.
Data processor with respect to the data of Contacts — the end people who write to a Workspace through a channel that Workspace configured. In that role, we process that data only on the Workspace's instructions, as detailed in the Data Processing Agreement.

2. What data we collect

a) Account data. When creating a Workspace or signing in (email and password, or Google), we collect name, email address, and account metadata (plan, language, role).

b) Contact data. When a Contact writes to a Workspace through a channel (web widget, WhatsApp, Telegram, email, etc.), we process their channel identifier (phone number, username, email address), the content of their messages, and conversation metadata (timestamp, channel, AI-generated summary). This data belongs to the Workspace that receives it; we host and process it on its behalf.

c) Free Directory and WordPress Plugin. These two layers never send visitor or configuration data to our infrastructure — see the dedicated Legal Notice for those components. Any analytics (GA4, Meta Pixel) run under the Customer's own account and privacy policy, not under ours.

d) Website data. Aggregate usage analytics for inteligenciaviva.com and strictly necessary or language-preference cookies.

e) Agent mobile app data. The app processes data belonging to two kinds of people: (i) the agent who signs in with their Workspace credentials, and (ii) — indirectly but explicitly — the Contacts whose conversations the agent handles from the app. The app does not collect Contact data for its own purposes; it displays and relays it under the same processor role described in Section 1.

f) Billing data. Processed by Stripe on our behalf; we do not store full card numbers.

3. Legal bases for processing

We process personal data on the basis of: (i) performance of a contract (providing the Service the Workspace has contracted for), (ii) our legitimate interest in operating, securing, and improving the Service, (iii) compliance with legal obligations, and (iv) consent, where required by applicable law (for example, non-essential cookies or marketing communications).

4. How we use the data

We use the data to: provide the Service (conversation routing, AI response generation, handoff to human agents); run semantic search over the knowledge sources a Workspace uploads (RAG); bill usage through Stripe; provide support; detect abuse and protect the Service's security; and, on an aggregated, non-identifiable basis, improve the product.

5. Use of artificial intelligence

The Service uses a provider-agnostic AI model router: some traffic is processed with Workers AI and some with third-party frontier model APIs, depending on the active configuration. When a message is sent to an external model provider, that provider acts as our sub-processor, subject to its own contractual data-protection commitments, and the data is not used by default to train those providers' models unless the Workspace expressly authorizes it.

6. Who we share data with

We share data with providers that let us operate the Service, all of them acting as sub-processors: cloud infrastructure (currently Cloudflare, Inc. — compute, database, file storage, and vector storage), payment processing (Stripe, Inc.), and transactional email delivery (a configurable provider, with Resend as the default option). We do not sell personal data to third parties or share it for our own advertising purposes.

7. International transfers

iNTELIGENCIA VIVA operates across eight language markets (English, Spanish, Portuguese, French, German, Italian, Japanese, and Arabic), and our infrastructure may process data in data centers located outside a data subject's country of residence. Where applicable, we apply the safeguards required by applicable law for international transfers of personal data (for example, standard contractual clauses or other equivalent mechanisms recognized by the competent data protection authority).

8. Retention and deletion

Retention of conversation data is configurable by each Workspace. Once the configured period elapses, or the contractual relationship ends and any applicable grace period passes, data is deleted for real — not merely soft-deleted — from our production systems and from backups according to their own lifecycle. Billing data is kept for as long as applicable tax and accounting rules require.

9. Data security

We apply encryption in transit across all surfaces (site, API, WebSocket) and at rest in our databases and file storage. API keys have a configurable permission scope and can be revoked individually. Outbound webhook deliveries are signed with HMAC. Each Workspace's data is isolated at the query level across every storage layer, so that one Workspace cannot access another's data.

10. Data subject rights

Depending on the law applicable in your jurisdiction, you may have the right to: access your personal data, request its rectification, request its erasure, request portability of your data to another provider, object to certain processing, and withdraw consent without affecting the lawfulness of prior processing. If you are a Contact and wish to exercise these rights, we ask that you first contact the Workspace you communicated with, since it is the controller of your data; we will cooperate with that Workspace to address your request. If you are a Workspace administrator or agent, you may write to privacy@inteligenciaviva.com.

11. Agent mobile app

The agent mobile app requires signing in with Workspace credentials and does not support in-app purchases. An agent's account can be deleted directly from within the app, in the account settings section; that deletion does not delete the Workspace or its Contact data, which continues to follow the retention rules in Section 8.

12. Cookies and local storage

The website uses strictly necessary cookies and language-preference cookies. The free Directory widget stores acceptance of its own privacy notice in the visitor's browser localStorage, under the domain of the Customer's site where it is embedded — that data never reaches our infrastructure.

13. Children

The Service is not directed at children, and we do not knowingly collect data from minors as Workspace or agent account holders.

14. Changes to this policy

We may update this Privacy Policy to reflect changes in the Service or in applicable regulation. Material changes will be communicated with reasonable advance notice through the site or by email.

15. Contact and data protection

For privacy inquiries, to exercise your rights, or to contact our data protection officer/lead: privacy@inteligenciaviva.com. Registered address: Concepción de San Rafael, Heredia, Costa Rica.