Privacy Policy

Last updated: October 1, 2026.

This is a translation of the original in Brazilian Portuguese. The Portuguese (pt-BR) version prevails if the two differ.

This policy describes how ALCA SISTEMAS, registered under CNPJ 14.296.948/0001-40, processes personal data in AlcaZap, a platform for customer service over WhatsApp, Messenger and Instagram available at alcazap.com.br. Processing follows Brazilian Law No. 13.709/2018 (LGPD).

1. Who the controller is

ALCA SISTEMAS, CNPJ 14.296.948/0001-40, Rua Doutor David Pedro Hannemann, 140, Alfenas/MG, CEP 37136-024. Contact of the data protection officer: alca@sistemasalca.com.

2. What data we process

Customer company data: name, email, phone and billing details of whoever subscribes to the platform, plus the access data of each agent.
Conversation data: messages, files, phone number and profile name of the contacts served by the customer company, along with tags, notes and service history.
Messenger and Instagram data: when the customer company connects a Facebook Page or an Instagram professional account, we store the Page id and the professional account id, the account's username (@username) and the access token granted by Meta, stored encrypted. For the contacts who write through these channels, we process the id Meta assigns to each person on that Page or account, the name or the username (@username), the profile photo, and the messages and media exchanged (photos, audio, videos and files).
Technical data: access logs (date, time and IP address), required by legal obligation and for security.

This institutional website has no form, sign-up or email capture: the only action available is to open a conversation on WhatsApp.

3. What we use it for

To provide the contracted service (performance of a contract), to meet legal and regulatory obligations, and to keep the platform secure (legitimate interest). We do not sell personal data and do not use it for third-party advertising.

4. Roles in processing the conversations

In service conversations, the customer company is the controller of its contacts' data and AlcaZap acts as processor, handling that data only as instructed by the customer company.

5. Who we share it with

With Meta Platforms, Inc., unavoidably, because the messages travel through WhatsApp, Messenger and Instagram; with the cloud infrastructure provider where the platform is hosted; and with public authorities when legally required. Each provider receives only what its function needs.

6. How long we keep it

For as long as the contract lasts. Once the contract ends, conversation data is erased within 90 days, except where the law requires it to be kept — access logs, for example, are kept for six months, as required by the Marco Civil da Internet (Brazilian Internet Civil Framework).

7. Your rights

You may request confirmation, access, correction, anonymization, portability or erasure of your data, and you may withdraw consent. Write to alca@sistemasalca.com; we answer within 15 days. If you are a contact of a company that uses AlcaZap, we forward the request to that company, which is the controller.

8. Security

Access by individual login and by role, traffic encrypted in transit (TLS), isolation per account and a record of the agents' actions.

9. Changes

Changes to this policy are published on this same page, with a new update date.