Privacy Policy.
How Zulti handles personal data here on zulti.com.br. This page explains what we collect, why, on what legal basis, who we share it with, how long we keep it and how you can exercise your rights.
Zulti runs IT for companies, and operations involve personal data: our clients', that of people who use the systems we look after, and that of people who visit this site. This policy explains how we handle data here on zulti.com.br.
If you're looking for how Zulti handles data within a specific contract, that's in the contract and the Data Processing Agreement (DPA) we sign with each client. This policy covers the public website.
Who the controller is
Zulti is the controller of the personal data processed on this site.
Zulti
Brazilian company ID (CNPJ) 29.292.546/0001-45
Piracicaba, SP, Brazil
contato@zulti.com.br
Data Protection Officer (DPO)
Mauricio Zambretti is Zulti's Data Protection Officer, certified as an EXIN Data Protection Officer.
For any question about your personal data, write to:
privacidade@zulti.com.br
Response time: up to 15 business days.
What data we collect
When you visit the site, we automatically collect: IP address, browser type, language, device, pages visited, time on page and traffic source. If you accept measurement and advertising cookies, we also record some on-page interactions, such as the topic chosen in the cost simulator.
Site simulators. The numbers you enter in the simulators (salaries, hours, amounts) are calculated in your own browser and are not sent to Zulti. They only reach us if you send the simulation yourself through the contact form.
When you contact us (email, WhatsApp or another channel), we collect what you tell us: name, email, phone, company, job title and message content.
We don't collect sensitive data. There's no purpose for it on this site.
What we use it for and on what legal basis
| Data | Purpose | Legal basis (LGPD) |
|---|---|---|
| IP, browser, device, technical logs | Site security and abuse prevention | Legitimate interest (Art. 7, IX) |
| Aggregate analytics (Cloudflare, cookieless) | Understanding site use to improve content and navigation | Legitimate interest (Art. 7, IX) |
| Measurement and advertising cookies (Google Analytics, Google Ads and Meta Pixel) | Measuring whether ads led to contact, understanding which pages and topics interest people most, and showing Zulti ads to people who have visited the site | Data subject consent (Art. 7, I) |
| Name, email, phone, message | Replying to you and assessing whether Zulti is a fit | Pre-contractual procedures (Art. 7, V) |
| Conversation history | Following the progress of the commercial conversation | Legitimate interest (Art. 7, IX) |
| Name, email and photo from the Google account | Authenticating access to PSA and the Client Portal and identifying who performed each action | Performance of a contract (Art. 7, V) |
| Google Drive document content and calendar events | Optional PSA integrations: bringing in the text of documents selected by the user and mirroring tasks in the owner's calendar | Data subject consent (Art. 7, I) |
Google sign-in on Zulti's platforms
Two Zulti platforms let you sign in with a Google account: PSA (psa.zulti.com.br), used by the internal team, and the Client Portal (cliente.zulti.com.br), used by clients with access granted by invitation.
What we receive at sign-in: name, email address and profile picture. That's all. These are the basic identification scopes: openid, email e profile.
What we use it for: authenticating your access, identifying who performed each action within the platform (ticket history, tasks, comments and approvals) and showing your name and photo to other participants in your project.
We don't access your mailbox. No Gmail permission is requested on either platform: Zulti doesn't read, send or delete messages in your account.
What we don't do: we don't sell this data, don't use it for advertising, don't do profiling and don't share it with third parties for their own purposes.
Where it's stored: in the infrastructure behind the platform (a managed database with restricted and logged access), for as long as your account exists.
Optional Google connections in PSA
Besides sign-in, PSA users can connect two Google integrations. Both are optional, authorized separately from sign-in, and apply only to the account of whoever turns them on:
- Google Drive (scope
drive.readonly, read-only) — used to bring into a ticket the content of Google documents the user selects. Zulti doesn't change or delete files in your Drive. - Google Calendar (scope
calendar.events) — creating and updating events in your calendar, to mirror the project tasks you're responsible for.
Content read from Drive is used only within the ticket or task it was added to, and follows the same retention periods as the record it belongs to. Users who don't connect these integrations are not affected in any way.
How to revoke: you can remove Zulti's access to your Google account at any time at myaccount.google.com/permissions. This ends Google sign-in and the connections above, but doesn't delete your account on the platform; for deletion, contact the DPO.
Limited use of Google data
Use and transfer to any other app of information received from Google APIs by PSA and the Client Portal will adhere to the Google API Services User Data Policy, including the Limited Use requirements.
In particular: data obtained from Google APIs is used only for the functions described above; it is not sold, not used for advertising, not read by Zulti staff beyond what the user asked for (or when required by law or for security), and is not used to develop, improve or train artificial intelligence models.
Who we share it with
Zulti doesn't sell personal data, doesn't use it for third-party marketing and doesn't allow secondary use.
We share it with:
- Technical processors that keep the site running (hosting provider, email provider, analytics tools). All under data protection agreements.
- Google and Meta, only if you accept measurement and advertising cookies, for the purposes described under Cookies. These companies may process data outside Brazil, with the safeguards set out in Art. 33 of the LGPD and each platform's terms.
- Authorities, when required by law (ANPD, Brazil's Federal Revenue Service, courts).
- You, when you exercise your right of access.
How long we keep it
- Technical browsing logs: 6 months.
- Data from people who contacted us and became clients: for the duration of the contract, plus 5 years after it ends (tax and audit obligations).
- Data from people who contacted us and didn't become clients: 12 months.
- Records of data subject requests: 3 years after the request is handled, to prove compliance.
After these periods, data is deleted or anonymized.
Cookies
Essential cookies. We use technical security and session cookies, and our own cookie (zlt_consent, 12 months) that stores your choice about measurement cookies. These don't require consent: without them the site doesn't work, or we couldn't respect your decision.
Site usage measurement. Done through Cloudflare Web Analytics, which works with aggregate data, without identifying individual visitors and without setting cookies.
Measurement and advertising cookies. When we invest in ads, we need to know whether they actually led to contact. For that, the site may load, only after you consent, Google Tag Manager and, through it, Google Analytics, Google Ads and the Meta Pixel (Facebook and Instagram).
Before consent, nothing from third parties loads on the page. The site uses Google Consent Mode v2 with every category denied by default: ad storage, analytics storage, user data and personalization. If you choose "Essential only", none of these services are loaded.
What is measured: pages visited, contact events (form submission, call booking, WhatsApp click and phone click) and simulator use (topic chosen and click to compare). With the Meta Pixel, Meta may link the visit to your Facebook or Instagram account, which lets us measure ads and show Zulti ads to people who have visited the site. The pixel doesn't receive what you type in the form or the simulators. We don't sell this data or use it for any other purpose.
You can also control the ads you see in the ad settings of your Meta and Google accounts.
Changing your mind. Your choice lasts 12 months, and you can change it whenever you want: use the Cookies link in the footer of any page to reopen the consent window. Clearing your browser cookies has the same effect.
Your rights as a data subject
The LGPD gives you the right to:
- Confirm that we process your data.
- Access a copy.
- Correct incomplete, inaccurate or outdated data.
- Request deletion of your data (with exceptions provided by law).
- Request portability of your data to another provider.
- Know who we share it with.
- Withdraw consent previously given.
- Object to processing based on legitimate interest.
To exercise any right, write to privacidade@zulti.com.br. We respond within 15 business days. There's no charge.
If the response isn't satisfactory, you can file a complaint with the Brazilian National Data Protection Authority (ANPD).
Security
This site's data runs on infrastructure encrypted in transit (HTTPS / TLS 1.3) and at rest. Access is restricted by role: only those who need it can see it. Logs are audited periodically.
In the event of a security incident that could cause relevant harm to data subjects, we notify the ANPD and the affected data subjects within the deadlines set by the LGPD.
Changes to this policy
When we change this policy, we update the date below. Relevant changes are announced on the site with a banner. Previous versions are archived and can be requested from the DPO.
Contact
Data Protection Officer
Mauricio Zambretti
privacidade@zulti.com.br
Controller
Zulti
Brazilian company ID (CNPJ) 29.292.546/0001-45
Piracicaba, SP, Brazil
contato@zulti.com.br
Version 1.3 — updated October 28, 2026. This English version is a translation provided for convenience; if there is any discrepancy, the Portuguese version prevails.