PRIVACY POLICY

Questions or concerns? Reading this privacy notice will help you understand your rights and choices regarding privacy and the processing of your data. If you do not agree with our policies and practices, you must refrain from using our Services. If you have questions or concerns, contact us at privacidad@zapia.com

If you are a resident of Brazil, you may exercise your rights under the Brazilian General Data Protection Law (LGPD or Lei Geral de Proteção de Dados Pessoais) by contacting our Data Protection Officer (DPO Brazil) at the following email: privacidade-brasil@zapia.com.

This privacy notice for Brainlogic AI SAS ("we", "us", "our" “Zapia”), describes how and why we may collect, access, store, use or otherwise process your information when you use our services ("Services"), including, without limitation:

• You use our mobile application, or any of our services or features provided by Zapia, Zapia.com or any other application, site or service of ours that links to this privacy notice.
• You interact with us in other related ways, including business interactions, sales, marketing or events.

KEY POINTS

This summary provides key points from our privacy notice, but you can find more detail on any of these topics by clicking on the link below each key point or using our table of contents below.

What personal information do we process?

When you visit, use or browse our Services, we may process personal information depending on how you interact with us and the Services, the choices you make and the products and features you use. Learn more about the personal information you provide to us.

Zapia does not intend to request or deliberately collect sensitive personal information through the Services provided. Therefore, we ask that you do not enter, share or submit sensitive personal information through the Services, unless the User considers it strictly necessary and under their own responsibility.

Likewise, we recommend that you do not enter payment card details or other sensitive financial information through free-text chat; Zapia does not request this type of information through the chat and is not designed to process or store this type of information through this mechanism. If, notwithstanding the foregoing, you decide to include sensitive personal information, financial information or other confidential information in the content you submit, such information may be processed as part of the content provided by you, in accordance with this Privacy Policy and to the extent necessary to provide the functionality or Service you requested. We do not use it to make decisions about you or to build profiles based on such information.

How do we process your information?

• To provide, improve and administer our Services.
• To communicate with you.
• To ensure the security of the Services and to detect, prevent and address fraud, abuse and misuse.
• To comply with the law.
• To provide personalized product recommendations based on your preferences, interaction history and specific needs.
• To improve the accuracy and relevance of our product recommendations by analyzing search patterns and shopping preferences.
• To process and track transactions made through affiliate links.
• To measure and optimize the effectiveness of our product recommendations.
• To keep records of commissions generated through affiliate programs.

We may also process your information for other purposes where you have given your consent. We process your information when we have a valid legal reason to do so. The applicable legal basis will depend on the type of information, the purpose of the processing and the applicable law.

In what situations and with what types of parties do we share personal information?

We may share personal information in specific situations and with specific categories of third parties, although we do not sell or share personal data with third parties for advertising or marketing purposes.

How do we keep your information secure?

We have reasonable and appropriate technical and organizational processes and procedures to protect your personal information. However, no electronic transmission over the Internet or information storage technology can be guaranteed to be 100% secure, so we cannot promise or warrant that hackers, cybercriminals or other unauthorized third parties will not be able to circumvent the security measures implemented and, eventually, collect, access, obtain, alter or misuse your information.

What are your rights?

Depending on where you are located geographically, applicable privacy law may grant you certain rights with respect to your personal information.

How do you exercise your rights?

The easiest way to exercise your rights is to contact us through the app. We will consider and act on any request in accordance with applicable data protection laws, and we may request additional information where necessary to verify your identity and properly process your request.

Want to learn more about what we do with the information we collect?

TABLE OF CONTENTS

1. WHAT INFORMATION DO WE COLLECT?
2. HOW DO WE PROCESS YOUR INFORMATION?
3. ON WHAT LEGAL BASIS DO WE PROCESS YOUR PERSONAL INFORMATION?
4. WHEN AND WITH WHOM DO WE SHARE YOUR PERSONAL INFORMATION?
5. TRANSPARENCY IN PRODUCT RECOMMENDATIONS
6. DO WE USE COOKIES AND OTHER TRACKING TECHNOLOGIES?
7. IS YOUR INFORMATION TRANSFERRED INTERNATIONALLY?
8. HOW LONG DO WE KEEP YOUR INFORMATION?
9. HOW DO WE KEEP YOUR INFORMATION SECURE?
10. WHAT ARE YOUR PRIVACY RIGHTS?
11. CONTROLS FOR DO-NOT-TRACK FEATURES.
12. DO WE MAKE UPDATES TO THIS NOTICE?
13. HOW CAN YOU CONTACT US ABOUT THIS NOTICE?

1. WHAT INFORMATION DO WE COLLECT?

Personal information you disclose to us

In short: We collect personal information that you provide to us.

We collect personal information that you provide to us, information collected automatically when you use our Services, and information we receive from third-party applications you connect to your account and from our service providers.

Personal Information Provided by You. The personal information we collect depends on the context of your interactions with us and the Services, the choices you make, and the products and features you use. The personal information we collect may include the following categories, among others:

• names
• telephone numbers
• email addresses
• postal addresses
• information you provide to Zapia services.
• product search history
• purchasing preferences
• interactions related to product recommendations
• information on purchases made through our recommendations
• product selection criteria shared during consultations
• feedback and survey responses
• the content of support requests and communications with us
• any other information you choose to provide to us or that is necessary to provide the features and Services you request.

App Data. If you use our application(s)/service(s), we may also collect the following information:

• Mobile Device Data. We automatically collect device information (such as your mobile device ID, model and manufacturer), operating system, system version and configuration information, device and application identification numbers, browser type and version, hardware model, Internet service provider and/or mobile operator, and Internet Protocol (IP) address (or proxy server). If you are using our application(s), we may also collect information about the telephone network associated with your mobile device, the operating system or platform of your mobile device, the type of mobile device you use, your mobile device’s unique ID and information about the features of our application(s) that you accessed.
• Push Notifications. We may request to send you push notifications regarding your account or certain features of the application(s). If you wish to opt out of receiving these types of communications, you can disable them in your device's settings.

This information is primarily necessary to maintain the security and operation of our application(s), for troubleshooting and for our internal analytics and reporting purposes.

All personal information you provide to us must be true, complete and accurate, and you must notify us of any changes to such personal information.

Third-party information. When using the Services, you may provide us with personal information of third parties (for example, contacts, message recipients, calendar invitees or participants in individual or group conversations). The User is responsible for obtaining, where applicable, the authorizations or consents necessary to provide us with such information and allow its processing.

Automatically collected information

In short: Some information, such as your Internet Protocol (IP) address and/or browser and device characteristics, is automatically collected when you visit our Services.

We automatically collect certain information when you visit, use or browse the Services. This information does not allow you to be directly identified by your name or contact information, nor does it reveal your specific identity, but may include device and usage information, such as your IP address, browser and device characteristics, operating system, language preferences, referring URLs, device name, country, location, information about how and when you use our Services, and technical information. This information is necessary primarily to maintain the security and operation of our Services and for our internal analysis and reporting purposes.

We also collect information through cookies and similar technologies.

The information we may collect, depending on how you use Zapia, includes:

• Log and Usage Data. Log and usage data is service-related, diagnostic, usage and performance information that our servers automatically collect when you access or use our Services and that we record in log files. Depending on how you interact with us, this log data may include your IP address, device information, browser type and settings and information about your activity on the Services (such as date/time stamps associated with your usage, pages and files viewed, searches and other actions you take, such as the features you use), device event information (such as system activity, error reports (sometimes called "memory dumps") and hardware configurations).
• Device Data. We collect device data, such as information about your computer, phone, tablet or other device you use to access the Services. Depending on the device used, this device data may include information such as your IP address (or proxy server), device and application identification numbers, location, browser type, hardware model, Internet service provider and/or mobile operator, operating system and system configuration information.
• Location Data. We collect location data, such as information about the location of your device, which may be accurate or inaccurate. The amount of information we collect depends on the type and configuration of the device you use to access the Services. For example, we may use GPS and other technologies to collect geolocation data that tells us your current location (based on your IP address). You can opt out of allowing us to collect this information by refusing access to the information or by turning off the Location setting on your device. However, if you choose to disable this feature, you may not be able to use certain features or functionalities of the Services that depend on such information.

2. HOW DO WE PROCESS YOUR INFORMATION?

In short: We process your information to provide, improve and administer our Services, communicate with you, protect our Services, prevent fraud and comply with our legal obligations. We may also process your information for other purposes with your consent or where there is a valid legal basis to do so under applicable law.

We process your personal information for a variety of reasons, depending on how you interact with our Services, including, without limitation, the following:

• To facilitate account creation and authentication and manage user accounts. We may process your information so that you can create and log in to your account, as well as maintain your account in operation.
• To deliver and facilitate the delivery of services to you. We may process your information to provide you with the requested service.
• To respond to user inquiries/provide user support. We may process your information to respond to your inquiries and resolve any potential problems you may have with the requested service.
• To solicit feedback. We may process your information as necessary to solicit feedback and contact you about your use of our Services.
• To send you marketing and promotional communications. By default, we may process the personal information you submit to us for marketing purposes, in accordance with your marketing preferences. If you do not wish to receive these communications, you may change your marketing preferences or unsubscribe at any time. For more information, please see "WHAT ARE YOUR PRIVACY RIGHTS?" below.
• To protect our Services. We may process your information as part of our efforts to keep our Services secure, including fraud monitoring and prevention.
• To identify usage trends. We may process information about how you use our Services to better understand how they are being used so we can improve them.
• To determine the effectiveness of our marketing and promotional campaigns. We may process your information to better understand how to provide marketing and promotional campaigns that are more relevant to the User.
• To protect the safety or vital interests of an individual. We may process your information when necessary to protect such interests, prevent harm or respond to emergency situations.
• To comply with legal obligations. We may process your information to comply with applicable laws and regulations, respond to requests from public and government authorities, enforce our terms and conditions, and establish, exercise or defend legal claims.
• To manage reminders and recurring tasks. We process the content, date, time, and frequency of the reminders and recurring tasks you configure in order to execute them properly. The content of such reminders may include personal data and remains under the control of the user.
• To generate content summaries. We temporarily process news articles, videos, PDFs, or other files shared by the user for the purpose of producing summaries.
• To transcribe audios. We process voice messages sent by the user for the purpose of converting them into text. The content of the audio may include personal data, and the user is responsible for the information shared.
• To execute interactions on behalf of the user. We process the information provided by the user in order to interact with third parties on their behalf (for example, booking an appointment or making business inquiries). Zapia acts as a technical intermediary and is not responsible for the quality, accuracy, or outcomes of such interactions.
• To integrate external calendars. When the user connects their calendar, we process event data such as titles, dates, descriptions, and attendees for managing the schedule.
• To schedule messages to third parties. We process the message content and the contact details provided by the user to send messages on their behalf at the specified date and time. The user is solely responsible for the content sent and for ensuring that they have the consent of the third-party recipients.
• To improve our Services. We may analyze content and usage information in an anonymized or pseudonymized manner, in a way that does not allow the User to be identified, in order to improve the software, the Services, and their features and capabilities, as provided in the Terms and Conditions.
• In the case of paid subscriptions, payment and billing data are processed by external providers, such as app distributors or enabled payment platforms. Brainlogic AI SAS does not collect or store the User’s payment method information.

The User is responsible for the content of the messages sent through this functionality, as well as for obtaining the recipients’ consent and complying with the policies and terms of the third-party services involved.

Use of third-party services and integrations. When Zapia connects with third-party services, we process the information strictly necessary to perform the requested actions. Zapia does not control or take responsibility for the privacy policies, security, or availability of such external services. The user is responsible for reviewing and accepting the privacy policies of those third parties before using such integrations.

Limitation on advice and recommendations. Zapia may generate responses, suggestions, or recommendations based on the information provided by the user. However, Zapia does not provide professional advice of any kind, including —without limitation— medical, psychological, financial, legal, or emotional advice. Any decision made based on the information generated by Zapia is the responsibility of the user.

Transparency in the use of Artificial Intelligence. Zapia’s responses are automatically generated by Artificial Intelligence systems. This may result in errors, omissions, or inaccuracies. The user must verify the information before making important or professional decisions, as the generated content is purely informative and intended for general assistance, and does not replace the advice of a qualified professional where necessary.

3. ON WHAT LEGAL BASIS DO WE PROCESS YOUR INFORMATION?

In summary: We process your personal information when we have a valid legal basis under applicable law, such as your consent, where necessary; compliance with legal obligations; to provide you with the Services, the performance of our contractual obligations, the regular exercise of our rights; the protection of your rights and, where applicable, our legitimate business interests.

The applicable legal basis will depend on the type of information we process, the purpose of the processing and the circumstances in which you interact with our Services. Below we explain the main legal bases on which we may rely to process your personal information:

• Consent. We may process your information insofar as, by creating an account and/or using the Services, you have given us your consent to use/process your personal information for the specific purposes described in this Privacy Policy. You may withdraw your consent at any time, free of charge. To withdraw your consent please write to us at privacidad@zapia.com.
• Performance of a contract. We may process your personal information when necessary to perform our contractual obligations to you, including the provision of our Services or to take steps at your request prior to entering into a contract with you.
• Legitimate Interests. We may process your information when we have a legal basis to do so and it is necessary to achieve our legitimate business interests, after having carried out the required assessment and determined that those interests do not override your interests, rights and fundamental freedoms. For example, we may process your personal information to provide and operate our Services, to improve them and develop new features, to understand how our Services are used, to diagnose problems and prevent fraudulent or abusive activity, to communicate with users about our Services, and to enforce our Terms and Conditions.
• Legal Obligations. We may process your information when necessary to comply with our legal or regulatory obligations, such as cooperating with a law enforcement or regulatory agency, exercising or defending our legal rights, or disclosing your information as evidence in litigation in which we are involved.
• Vital Interests. We may process your information when necessary and permitted by applicable law to protect your vital interests or the vital interests of a third party, such as in situations involving potential threats to the safety of any person.

4. WHEN AND WITH WHOM DO WE SHARE YOUR PERSONAL INFORMATION?

In summary: We may share information in specific situations described in this section and/or with the following categories of third parties.

Vendors, Consultants and Other Third Party Service Providers. We may share your information with third-party vendors, service providers, contractors or agents ("third parties") who perform services for us or on our behalf and require access to such information to perform that work. We have contracts with our third parties to help protect your personal information. These contracts include obligations designed to ensure that your personal information is shared, stored, protected and deleted in accordance with applicable law. The categories of third parties with whom we may share personal information include, among others, the following:

• Affiliate Marketing Programs
• Cloud Computing Services
• Communication and Collaboration Tools
• Data Analysis Services
• Data Storage Service Providers
• Government Entities
• Sales and Marketing Tools
• Testing Tools
• User Account Registration and Authentication Services
• Web Hosting Service Providers

Legal requirements, safety and enforcement. We reserve the right to disclose your information to governmental authorities, law enforcement, or other third parties, in accordance with applicable law and where legally required or permitted, when we have a good-faith belief that disclosure is reasonably necessary to: (i) comply with applicable law or an enforceable governmental request; (ii) prevent serious harm to any person or property; (iii) detect or prevent fraud or illegal activity; or (iv) enforce our Terms and Conditions or protect the rights, property or safety of Brainlogic AI SAS, our users, or others.

We may also need to share your personal information in the following situations:

• Business Transfers. We may share or transfer your information in connection with, or during negotiations of, any merger, sale of company assets, financing or acquisition of all or a portion of our business by another company, including in the context of a corporate reorganization, restructuring or similar transaction.
• Affiliates. We may share your information with our affiliates, in which case we will require those affiliates to abide by this privacy notice. Affiliates include our parent company and any branch, subsidiary, joint venture partners or other companies that we control or that are under common control with us.
• Affiliate Programs and Business Partners. We participate in affiliate programs and collaborate with business partners to provide product recommendations. In this context:
• We share anonymous and/or pseudonymized aggregated data about product interactions and sales conversions with our affiliate program partners.
• We use affiliate links that may transmit basic transaction information (such as purchase identifiers) to partner e-commerce platforms.
• We do not share personally identifiable information with affiliate programs beyond what is strictly necessary to process transactions.
• Data shared with affiliate programs is limited to:
• Anonymous transaction identifiers
• Products purchased
• Transaction values
• Conversion information

Use of Third-Party Artificial Intelligence Providers

To provide Zapia’s core functionalities — including generating responses, summaries, transcriptions, automations, task execution, calendar scheduling, and content analysis — user content may be processed by third-party artificial intelligence service providers with whom we have contractual relationships for the provision of these services.

Third-party AI providers used by Zapia include, among others:

• OpenAI
• Anthropic
• Google (including Google AI services)
• Together AI
• Tencent (hosted in the US)
• Alibaba (hosted in the US)

The information that may be shared with these providers includes:

• User messages and prompts
• Uploaded content (such as PDFs, images, documents, or links)
• Voice messages for transcription
• Calendar event data (if the user connects their calendar)
• Contact details provided by the user when scheduling messages or interactions
• Contextual information necessary to generate accurate responses

This information is transmitted and processed for the purpose of providing the functionality requested by the user.

Zapia does not sell personal data to any artificial intelligence provider.

5. TRANSPARENCY IN PRODUCT RECOMMENDATIONS

• Zapia may receive compensation through affiliate programs when users make purchases following our recommendations.
• Product recommendations are based on:
• Your preferences and needs expressed
• Product characteristics and features
• Product reviews and ratings
• Availability and current market conditions
• Information about Users' rights in relation to the processing of their personal information can be found in the WHAT ARE YOUR PRIVACY RIGHTS? Section below.

6. DO WE USE COOKIES AND OTHER TRACKING TECHNOLOGIES?

In summary: We may use cookies and other tracking technologies to collect and store your information.

We may use cookies and similar tracking technologies (such as web beacons and pixels) to access or store information. Specific information about how we use these technologies and how you can refuse certain cookies is detailed in our Cookie Notice.

7. IS YOUR INFORMATION TRANSFERRED INTERNATIONALLY?

In short: We may transfer, store and process your information in countries other than your own.

Our servers are located in the United States. If you are accessing our Services from outside the United States, please be aware that your information may be transferred to, stored and processed by us on our systems and by those third parties with whom we may share your personal information (see "WHEN AND WITH WHOM WE SHARE YOUR PERSONAL INFORMATION" above), in the United States and other countries.

If you are a resident of a country or region which regulates the international transfer of personal information, the laws of the destination country may provide a different level of protection than those of your country of origin or region of residence. However, we will take reasonable and appropriate measures to protect your personal information in accordance with this privacy notice and applicable law. We assess our international data transfers and implement additional safeguards, where necessary, to provide an adequate level of protection for the personal information we process, in accordance with applicable law.

Standard Contractual Clauses:

We have implemented measures to protect personal information, including the use of the European Commission's Standard Contractual Clauses and the applicable contractual mechanisms established by the Brazilian ANPD for transfers of personal information between our group companies and between us and our third party suppliers and partners. Our Standard Contractual Clauses can be provided upon request.

8. HOW LONG DO WE KEEP YOUR INFORMATION?

In summary: We retain your information as long as necessary to fulfill the purposes described in this privacy notice, unless otherwise required by law.

We will retain your personal information as long as necessary for the purposes set forth in this privacy notice, unless a longer retention period is required or permitted by law (such as tax, accounting or other legal requirements). In general, no purpose in this notice will require us to retain your personal information for more than thirty-six (36) months after termination of the user's account, unless a longer retention period is required or permitted by applicable law. Audios, PDF files, videos, and images processed to generate summaries, transcriptions, or analyses are stored in Zapia’s cloud infrastructure for a maximum period of 90 days.

Where we do not have an ongoing legitimate business need to process your personal information, we will delete or anonymize such information, or, if this is not possible (for example, because your personal information has been stored in back-up files), then we will securely store your personal information and isolate it from any further processing until such time as deletion is possible.

Our Services are not directed to minors under the applicable law in each country. By using the Services, the User represents that they are of legal age under the applicable law of the country in which they are located and that they meet the minimum age required to use Zapia. Zapia is not intended for persons who have not reached such legal age.

9. HOW DO WE PROTECT YOUR INFORMATION?

In summary: We seek to protect your personal information through a system of technical and organizational security measures.

We have implemented appropriate and reasonable technical and organizational security measures designed to protect the security of any personal information we process. However, despite our safeguards and efforts to secure your information, no electronic transmission over the Internet or information storage technology can be guaranteed to be 100% secure, so we cannot promise or guarantee that hackers, cyber criminals or other unauthorized third parties will not be able to defeat our security and improperly collect, access, steal or modify your information. Although we take reasonable measures to protect your personal information, no security measure can completely eliminate the risks associated with the transmission and storage of personal information. You should access the Services within a secure environment and take measures to ensure the security of your own device and credentials.

Security Incident Notification. In the event of a security incident that could pose a risk or relevant harm to your rights, we will notify you and the competent data protection authority as required by law, without undue delay and within the applicable legal timeframes, and we will inform you of the measures adopted to mitigate it.

10. WHAT ARE YOUR PRIVACY RIGHTS?

In summary: In some regions, you may have rights that allow you greater access to and control over your personal information. You may review, change or terminate your account at any time.

In some regions, you have certain rights under applicable data protection laws. These may include the right (i) to request access to and obtain a copy of your personal information; (ii) to request rectification or erasure; (iii) to restrict the processing of your personal information; (iv) to data portability; (v) not to be subject to certain decisions based solely on automated processing; and (vi) to object to the processing of your personal information. You may make such a request by contacting us using the contact details provided in the "HOW CAN YOU CONTACT US ABOUT THIS NOTICE?" section below.

We will consider and act on any request in accordance with, and within the timelines set out under applicable data protection laws.

You may also have the right to lodge a complaint with your local data protection authority if you believe that we have unlawfully processed personal information.

Withdrawing your consent: If we rely on your consent to process your personal information, you have the right to withdraw your consent at any time. You may withdraw your consent at any time by contacting us using the contact details provided in the "HOW CAN YOU CONTACT US ABOUT THIS NOTICE?" section below or by updating your preferences.

However, please note that this will not affect the lawfulness of the processing prior to your withdrawal nor will it affect the processing of your personal information carried out on lawful grounds of processing other than consent.

Opt out of receiving marketing and promotional communications You may unsubscribe from our marketing and promotional communications at any time by clicking the unsubscribe link in the emails we send, by replying "STOP" or "UNSUBSCRIBE" to the SMS messages we send, or by contacting us using the details provided in the "HOW CAN YOU CONTACT US ABOUT THIS NOTICE?" section below. You will then be removed from the marketing lists. However, we may still contact you, for example, to send you service-related messages necessary for the administration and use of your account, to respond to service requests, or for other non-marketing purposes.

In connection with our product advisory services, you have the right to:

• Request a record of product recommendations received. This may not be available depending on the time that has passed since the recommendation was made.
• Delete your search history and product preferences
• Disable product recommendation customization
• Opting out of affiliate conversion tracking
• Request information on what data is shared with affiliate programs

Account information

If at any time you wish to review or change your account information or terminate your account, you may contact us using the contact information provided.

Upon your request to terminate your account, we will deactivate or delete your account and information from our active databases. However, we may retain some information in our files to prevent fraud, troubleshoot problems, assist with investigations, enforce our legal terms and/or comply with applicable legal requirements.

Cookies and Similar Technologies: Most web browsers are set to accept cookies by default. If you prefer, you can generally choose to set your browser to delete cookies and to reject cookies. If you choose to delete or reject cookies, this may affect certain features or services of our Services. You may also opt out of receiving interest-based advertising from advertisers on our Services.

If you have questions or comments about your privacy rights, you can email us at privacidad@zapia.com.

11. CONTROLS FOR DO-NOT-TRACK FUNCTIONS

Most web browsers and some mobile operating systems and mobile applications include a "Do Not Track" ("DNT") feature or setting that you can enable to signal your privacy preference not to have data about your online browsing activities monitored and collected. At this stage, a uniform technology standard for recognizing and implementing DNT signals has not yet been finalized. Therefore, we do not currently respond to DNT browser signals or any other mechanism that automatically communicates your choice not to be tracked online. If a standard for online tracking is adopted in the future that we must follow, we will inform you of that practice in a revised version of this privacy notice.

12. DO WE MAKE UPDATES TO THIS NOTICE?

In summary: Yes, we will update this notice as necessary to comply with relevant laws.

We may update this privacy notice from time to time. The updated version will be indicated by an updated "Revised" date and the updated version will be effective as of the date indicated in the updated notice. If we make material changes to this privacy notice, we may notify you either by prominently posting a notice of such changes or by sending you a notice directly. We encourage you to review this privacy notice frequently to stay informed about how we are protecting your information.

13. HOW CAN YOU CONTACT US ABOUT THIS NOTICE?

If you have questions or comments about this notice, you may contact our Data Protection Officer (DPO), by email at privacidad@zapia.com, or contact us by mail at:

Brainlogic AI SAS

Luis Alberto de Herrera

1052/401

Montevideo 11300

Uruguay