Privacy Policy

This Privacy Policy explains how Zaaz Technology and Software Ltd (“ZaazCRM”, “we”, “us”) handles personal information in the ZaazCRM service and on zaazcrm.com. It is issued under Mexico’s Federal Law on the Protection of Personal Data Held by Private Parties (LFPDPPP) and also describes the rights of people in other Latin American countries.

The mobile apps have their own policies, which remain in force for them: the ZaazCRM and ZaazCRM Chat apps, app account deletion and ZaazCRM Meet.

This distinction matters, because most of the personal information inside ZaazCRM is not ours.

Your company is responsible for its customers’ information. When a company uses ZaazCRM, it decides what it collects about its customers, prospects, employees and suppliers, why, who may see it and how long it is kept. In data-protection terms the company is the controller and we are its processor.
We are responsible for the service itself: the user accounts we issue, the billing relationship with the company, and the security of the platform its records sit on.

If you are a customer of a company that uses ZaazCRM and want to see, correct or delete your information, please contact that company directly. It holds the records and decides what happens to them. We will support it in responding, but we cannot act on its records on our own initiative.

Your company’s records. Contacts, prospects, cases, notes, quotes, invoices, payments, documents and whatever other modules your company configures. This is your company’s data; we store and process it to deliver the service and for no other purpose.
Account information. The name, work email address and role of each user your company creates, and the password they set, which is stored hashed and never in readable form.
Billing information. Your company’s details and subscription history. Card details are entered directly with our payment processor and never held on our servers.
Technical records. Our servers log ordinary request information such as IP address, browser type, the page or endpoint requested and the time, which we use to run and secure the service. ZaazCRM also keeps an audit trail inside each company’s environment recording who created, changed, uploaded or downloaded what, and when.

We do not ask for sensitive personal data to run the service. If your company records sensitive data about its own customers, it does so as the controller and under its own obligations.

ZaazCRM can connect your company’s email so that messages appear alongside the matching contact or case.

Authorisation. When you connect an Outlook, Microsoft 365 or Gmail mailbox, you sign in with Microsoft or Google directly and approve the access. We never see or store your email password; we receive only the access tokens Microsoft or Google issue, and we keep them encrypted.
What we read. Messages from the folders you choose, over a recent time window your company configures, not the whole mailbox history. For each message we store a copy in your company’s environment: sender and recipients, subject, date, body, and the names, types and sizes of attachments.
What for. To show your mail in ZaazCRM, link it to the matching contact or case, and send the messages you choose to send. Nothing else.
What we never do. We do not use the contents of your mailbox for advertising, sell it, share it beyond the providers listed below, or use it to train, fine-tune or evaluate machine-learning models.
Disconnecting. You can disconnect a mailbox at any time, which stops the synchronisation and removes the stored credentials. You can also revoke access from your Microsoft or Google account security settings. Messages already copied remain your company’s records until it deletes them.

We use personal information only for purposes necessary to our relationship with your company:

To provide, maintain and support the ZaazCRM service.
To create and manage user accounts.
To bill the subscription and collect payment.
To protect the platform, prevent abuse and respond to security incidents.
To meet our legal, tax and accounting obligations.

We do not use it for marketing, advertising or profiling, and we do not sell or rent it. There are therefore no secondary purposes. If we ever wanted to use it for a different purpose, we would ask for your consent first.

We use a small number of service providers to deliver the service. They act on our instructions and under confidentiality obligations. Under the LFPDPPP, these communications to processors do not require your consent.

OVHcloud: dedicated server hosting in Canada. Holds all application data.
SMTP2GO: delivery of email the service sends on its own behalf, such as notifications and password resets. Receives those messages’ content and recipient addresses.
Stripe: subscription payments. Receives billing details only, never customer records.
Google Firebase Cloud Messaging: delivery of Android notifications, as described above.

When you use ZaazCRM from Mexico or elsewhere, your data is transferred to and stored in Canada. We may also disclose information where the law or a competent authority requires it. We do not sell personal information.

Text recognition on documents, where used, runs on our own infrastructure in Canada; documents are not sent to third-party recognition services.
Information held in ZaazCRM is not used to train, fine-tune or evaluate machine-learning models, by us or by anyone else.
ZaazCRM does not send your company’s customer data to external artificial-intelligence providers.

If we introduce a feature that would transmit data outside our infrastructure, we will say so in an updated version of this policy and, where appropriate, make it opt-in.

All application and API traffic is encrypted in transit with TLS; plain HTTP is redirected to HTTPS, and administrative interfaces are not publicly exposed.
Credentials we hold for your company (mailbox passwords, Microsoft and Google tokens, storage and telephony keys) are encrypted inside the database. Customer records themselves are not encrypted at the application layer; they are protected by the separation and access controls described here and by operating-system controls on the servers.
User passwords are stored hashed.
Permissions are assigned by role and by module, so each person sees only what their role requires. Sessions expire after inactivity and can be ended by a company administrator.
Our own administrative access is limited to named personnel, uses individual credentials, is logged, and is revoked on role change or departure.

We would rather state our current limitations than describe controls we do not have: multi-factor authentication is not yet available in ZaazCRM and is a committed roadmap item, and full-disk encryption is not applied to production hosts; sensitive data is protected at the application and database layer instead.

If we confirm a security incident affecting a company’s data, we will notify that company’s designated contact without undue delay and in any case within 72 hours of confirmation, with the facts known, the categories of data involved and the steps taken or planned. Because the company is responsible for its customers’ data, notifying affected individuals or an authority is its decision; we will give it the information it needs. If a breach significantly affects the rights of people whose data we handle in our own right, we will tell them promptly.

Retention is your company’s decision. Records are kept for as long as the company needs them. We do not impose a shorter period or delete records automatically.
Deletion. What a user deletes is removed from the active application immediately. It may persist in backups until they expire on their normal cycle. On written request we confirm deletion in writing.
Export. Your company may export its data at any time during the subscription. On termination we provide a complete export in a machine-readable format at no charge. The retrieval window is 30 days. After it, and no later than 90 days after closure, the company’s data, including any archive copy made while closing the account, is deleted from production systems, and from backups as they expire. We do not keep a long-term archive of a company’s data.

Separately from the service, zaazcrm.com collects very little:

What you send us. If you email us or message us on WhatsApp, we receive what you choose to share and use it to answer you.
Server logs. Ordinary request information, used for security and troubleshooting.
Language cookie. One functional cookie, pll_language, remembers whether you prefer Spanish or English.
External resources. Your browser connects directly to Google Fonts (Google LLC) and jsDelivr to load the site’s fonts and assets, which shares your IP address and basic browser details with them.

This website uses no analytics, advertising or tracking cookies.

You have the right to Access the personal information we hold about you, to Rectify it if it is inaccurate or incomplete, to Cancel it when you consider it is not being handled properly or is no longer needed, and to Oppose its use for specific purposes. You may also withdraw your consent or ask us to limit how we use or disclose your data. People in other countries have the same rights, plus any their local law gives them.

For information a company keeps in its ZaazCRM environment, contact that company. For information we handle in our own right, such as a user account or a billing relationship, email privacy@zaaztech.com with:

your full name and an email address for our reply;
a copy of an official ID (or, if you act for someone else, proof of representation);
a clear description of the data and the right you want to exercise; and
anything else that helps us find your data.

We will reply within 20 business days of receiving a complete request and, where it is granted, carry it out within the following 15 business days. Each period may be extended once by an equal period where justified. Exercising your rights is free; only reasonable reproduction or delivery costs may be charged.

If you believe your rights have not been respected, you may complain to the Mexican personal-data protection authority or to the data-protection authority of your country.

Who is responsible

Who decides about your customers’ data

What we handle

Connected mailboxes

App notifications

Why we use it

Where it is stored

Service providers and transfers

Document processing and artificial intelligence

How we protect it

If something goes wrong

Retention, export and deletion

This website

Your rights (ARCO)

Children

Changes to this policy

Contact us