Privacy Policy
This policy explains which personal data Voza processes, why, for how long and with whom it is shared. It follows Brazil's General Data Protection Law (LGPD, Law No. 13,709/2018) and the other data protection laws that apply to customers and to the people whose data Voza processes.
Two kinds of data, two roles
- Data of Voza's customers, such as sign-up and billing details: here Voza decides how the data is processed and is the controller.
- Data of the messages and calls of customers' numbers, including the data of the contacts they talk to: here the customer decides, and Voza processes the data on the customer's behalf, as a processor, under the Data Processing Agreement. To exercise your rights over that data, contact the company that talked to you; Voza helps that company respond.
Which data we process
From your account
- Sign-up: name, email, company and password (stored only as a hash).
- Billing: plan, subscription status and Stripe identifiers. Card details go straight to Stripe; Voza neither sees nor stores them.
- Usage: API keys (stored only as a hash), access logs with IP address and browser, connected numbers, webhook settings and usage counters.
From the messages and calls of your numbers
- Contacts' phone numbers and profile names, the content of messages and media, and call metadata (who called, when, for how long and how the call ended).
- The audio of calls answered in the browser travels encrypted between the browser and WhatsApp; Voza does not record it.
What we use the data for
- Providing the service: delivering messages and calls, the webhooks and the dashboard (performance of a contract).
- Charging subscriptions and meeting tax and legal obligations (performance of a contract and legal obligation).
- Keeping Voza secure, preventing fraud and abuse and investigating incidents (legitimate interest).
- Sending account notices, such as email confirmation, the end of the trial and payment failures (performance of a contract).
Voza does not sell personal data, does not use it for advertising and does not read customers' messages, except when needed to investigate a reported abuse or by order of an authority.
How long we keep it
- Messages and events: Voza does not store conversations. Each event is kept encrypted only until it is delivered to the customer's webhook, for at most 24 hours of retries (or the period agreed in writing with the customer, of up to 7 days); after that the content is deleted, and only the technical delivery record remains, for 7 days.
- Media received: available for download for 24 hours, then deleted.
- Web phone events: 1 hour.
- Call log and usage counters: while the account exists.
- Sign-up and billing: while the account exists; after it is closed, only what the law requires us to keep, for the legal period.
- Access logs: for the period the law requires and for as long as needed to keep the service secure.
Who we share it with
Only with the providers that make Voza work, each limited to what it needs:
| Provider | Purpose | Where |
|---|---|---|
| Railway | Voza's servers and database | European Union (Amsterdam) |
| Meta Platforms (WhatsApp) | Delivery of messages and calls, through the channel the customer chooses | Global |
| Cloudflare | Encrypted relay of the audio of calls in the browser | Global |
| Stripe | Subscription payments | United States and European Union |
| Resend | System emails, such as account confirmation and new password | European Union and United States |
We also share data when the law or an order from a competent authority requires it.
International transfers
Voza's servers are in the European Union, and some providers process data in other countries. These transfers take place with the safeguards required by the LGPD and the other applicable laws, such as data protection clauses in the contracts with providers.
Security
- All public traffic uses HTTPS, and Voza's services talk to each other over a private network.
- Passwords and API keys are stored only as hashes; secrets and events in transit are encrypted.
- Webhooks are signed, and Voza refuses private network addresses, so that no one can use it to reach internal systems.
- Access to accounts requires a strong password and may require a second factor.
Your rights
You may ask for confirmation that we process your data, access to it, correction, portability, anonymization or deletion, information about sharing, and the withdrawal of a consent. Many of these actions are in the dashboard itself, such as correcting data, exporting or deleting the account. For anything else, write to the contact below; we reply within 15 days. You may also file a complaint with the data protection authority of your country (in Brazil, the ANPD).
Cookies
Voza only uses the cookies needed for sign-in, form security and the language you choose. We do not use advertising cookies or third-party analytics cookies.
Minors
Voza is a service for businesses and is not intended for anyone under 18.
Changes
We may update this policy. When a change is material, we give notice by email or in the dashboard before it takes effect.
Contact
Voza. Questions about this document or about your data: through the support channel in the dashboard.
Last updated: 10/23/2026.