This policy explains how Bizu Tecnologia Inova Simples (I.S.), registered under Brazilian taxpayer ID (CNPJ) 55.122.784/0001-12 ("Bizu") handles personal data. It covers two different situations, and telling them apart is the most important point in this document: visiting bizu.ai, and the use of the Bizu platform by a contracting company.
If you are a customer of a company that uses Bizu and want to know about a WhatsApp conversation you had with them, the party responsible for that conversation is the company itself, not Bizu. Section 2 explains why, and section 10 explains how to make a request.
1. Who we are
Bizu is a Brazilian technology company based in Maringá, Paraná. Address: Av. Advogado Horácio Raccanello Filho, 5145, Edifício AV Business Center, Floor 4, Tower 01, Suite 604, Zona 07, Maringá-PR, Brazil, ZIP 87.020-035.
For anything related to personal data, including the rights granted by Brazilian Law 13.709/2018 (LGPD), write to 01.lexandre@bizu.ai.
2. Bizu's two roles
The LGPD separates the party that decides what to do with data (Controller) from the party that merely processes it under someone else's instruction (Processor). Bizu holds both roles, in different situations, and that determines who you should turn to.
| Situation | Bizu's role | Who decides about the data |
|---|---|---|
| You visit bizu.ai or contact us | Controller | Bizu itself |
| You use the platform as an employee of a contracting company | Controller of account and access data | Bizu, to maintain and protect the account |
| WhatsApp conversations analysed on the platform | Processor | The contracting company, which is the Controller |
In practice: the company that hires Bizu decides which WhatsApp numbers to connect, what it wants analysed and for how long. Bizu processes that content following those instructions and to perform the agreement, with no purpose of its own over it.
3. Data we handle as Controller
This is the data of people who visit the website, get in touch or use the platform as individuals:
- Contact details you provide yourself: name, email, phone and company, when you reach out over WhatsApp or email.
- Platform account and access data: name, work email, password in protected form, linked organisation and access logs.
- Technical server logs, generated automatically by any website: IP address, browser type, date and time of the request.
- Language preference, stored in a functional cookie. See the Cookie Policy.
The bizu.ai website uses Google Analytics for aggregated audience measurement, through Google Tag Manager. It uses no social network pixel and no advertising cookie. Each cookie and how to opt out are detailed in the Cookie Policy.
4. Data we handle as Processor
When a company connects a WhatsApp number to the platform, Bizu starts processing the content of the sales conversations on that number. This includes:
- Messages exchanged between the contracting company's team and its customers on the connected number.
- WhatsApp contact identification: number, display name and profile picture, where available.
- Files sent in the conversation: audio, image, video and documents.
- Transcription of received audio, generated automatically so the conversation can be read and analysed.
- Analysis output: intent, topic, sentiment, risk indicators, summary, products mentioned, estimated value and recommended action, always tied to the message that produced it.
The contracting company controls what comes in. It sets the capture mode for each number, can block specific contacts and individually chooses which groups are monitored. Groups are not included by default.
5. Why we use it and on what legal basis
| Purpose | Legal basis |
|---|---|
| Answering your enquiry and conducting the sales conversation | Pre-contractual steps and legitimate interest |
| Creating and maintaining your account, authenticating access and providing support | Performance of a contract |
| Processing sales conversations and returning the analysis to the contracting company | Performance of a contract, under the Controller's instruction |
| Maintaining security, access logs and fraud prevention | Legal obligation and legitimate interest |
| Billing and tax obligations | Legal obligation |
Bizu does not use one client's conversation content for any purpose other than delivering the service to that same client.
6. Who we share it with
Bizu does not sell personal data and does not hand it over for third-party advertising. Sharing happens only with the vendors required for the service to work, each limited to what it needs:
| Vendor | What for | What it receives |
|---|---|---|
| OpenAI | Analysing conversations and transcribing audio | Conversation excerpts sent for processing |
| Messaging provider | Technical integration with WhatsApp | Messages in transit between WhatsApp and the platform |
| Cloud infrastructure providers | Hosting, database, search and file storage | Data at rest, for storage |
| AI usage telemetry tool | Measuring cost and performance of analysis calls | Call metadata and processed content |
Data may also be shared with public authorities under a legal obligation or court order, and with an acquirer in the event of a corporate reorganisation, in which case this policy remains in force.
7. International transfers
Some of the vendors above process data outside Brazil, mainly in the United States. That is the case for the artificial intelligence analysis and transcription service. This transfer is necessary to perform the agreement and takes place with vendors that undertake contractual data protection commitments.
8. How long we keep it
- Contact details of people who reached out and did not become clients: while there is an ongoing commercial relationship.
- Account data and conversations processed on the platform: for as long as the agreement with the contracting company lasts. History is kept continuously because the analysis depends on comparing today's conversation with what came before.
- After the agreement ends: the contracting company has up to 30 days to request a data export in CSV or JSON. After that period, Bizu is authorised to delete it permanently.
- Backups: daily routine, with a minimum retention of 30 days. Data deleted from the live database may remain in backup until the cycle completes.
- Records the law requires us to keep, such as tax records, are kept for the statutory period.
The contracting company may request deletion before those deadlines at any time, in writing.
9. Security
Bizu applies technical and administrative measures to protect data against unauthorised access, loss and leakage. These include:
- Separation by organisation on every database query, with a search index physically separated per client.
- Platform access through individual authentication, with two-factor authentication available.
- Encrypted traffic between the browser, the platform and vendors.
- Access and operation logs for auditing.
- Daily backups.
- Controls available to the contracting company: contact blocking, capture mode per number and group monitoring only when chosen.
No system is immune. In the event of a security incident that may pose relevant risk, Bizu notifies the contracting company and, where applicable, the Brazilian Data Protection Authority.
10. Your rights and how to exercise them
The LGPD grants you confirmation of processing, access, correction, anonymisation, portability, information about sharing, withdrawal of consent and deletion. Where to send the request depends on which data it concerns:
| If the request is about | Contact |
|---|---|
| Your contact details, your account or your visit to the website | Bizu, at 01.lexandre@bizu.ai |
| A WhatsApp conversation you had with a company | The company you spoke with, which is the Controller of that data |
When a request reaches Bizu but concerns data under a contracting company's control, Bizu forwards it to them and provides the necessary technical support, without deciding alone about data that is not ours to decide on.
We respond within 15 days of receiving the request.
11. Changes to this policy
This policy may change as the product and the law evolve. The effective date at the top indicates the current version. Changes that materially affect data processing are communicated to contracting companies through the channels set out in the agreement.