This page exists because the question comes up in every negotiation, and it deserves a direct answer rather than a line buried in an agreement. It does not replace the Privacy Policy, which is the formal document. This is the practical version.
1. Who answers for the data
The conversations the platform analyses are conversations between the contracting company and its own customers. The data belongs to the company, and it is the company that decides what to do with it. Bizu processes that content under its instruction, to deliver the contracted service.
| Role | Who it is | Responsibility |
|---|---|---|
| Controller | The company that hires Bizu | Setting the legal basis, informing its customers and its team, and answering data subject requests |
| Processor | Bizu | Processing only as instructed and per the agreement, protecting the data and reporting incidents |
2. What falls to the contracting company
- Having a legal basis to process its customers' conversation data, whether performance of a contract, legitimate interest or consent.
- Informing the sales team that conversations on the company number are analysed. Transparency with the team is the company's obligation and prevents the worst possible side effect, which is the team believing it is under surveillance.
- Keeping its own privacy policy up to date with its own customers.
- Deciding which numbers to connect, which groups to monitor and which contacts to block.
- Receiving and answering data subject requests. Bizu provides technical support.
3. What Bizu does
- Processes content solely for the purpose of the agreement, with no purpose of its own.
- Separates each client's data, with a search index physically separated per organisation.
- Anchors every analysis finding to the real message that produced it, which makes any presented conclusion auditable.
- Keeps access and operation logs.
- Notifies the contracting company of any security incident involving personal data.
- Deletes data after the agreement ends, subject to the 30-day export window.
4. What Bizu does not do
- Does not sell personal data and does not hand it over for third-party advertising.
- Does not use one client's conversation content to train its own artificial intelligence models.
- Does not cross-reference data between different clients.
- Is not an employee surveillance tool: it does not measure breaks, does not record screens, does not track location and does not follow activity outside the connected WhatsApp.
- Does not capture personal conversations. Only what passes through the numbers the company connected is included.
- Does not analyse groups by default. A group is included only when explicitly chosen.
5. How to tell your team
The simplest wording that works, and that avoids noise, states what the tool does and what it does not do in the same breath:
Conversations on our business WhatsApp go through a tool that organises what was negotiated and flags what stalled. It is there so we do not lose sales, not to measure anyone. It reads the conversation with the customer, not your personal WhatsApp.
6. If you are a customer of a company that uses Bizu
To request access, correction or deletion of data from a conversation you had over WhatsApp, contact the company you spoke with. They control that data and they are the ones who can decide about it.
If you prefer to write to Bizu at 01.lexandre@bizu.ai, we forward the request to the company responsible and provide the necessary technical support.
7. Security incidents
In the event of an incident that may pose relevant risk to data subjects, Bizu notifies the contracting company within a reasonable time, with what is known about the nature of the incident, the data involved and the measures taken. Notifying the Brazilian Data Protection Authority and the data subjects falls to the Controller, with Bizu's support.
8. Contact
Data protection matters, including data subject requests and security due diligence: 01.lexandre@bizu.ai.