Privacy Policy

Zau ("Zau", "we", "us") is a personal-assistant service operated by Universe Vision Marketing Management LLC, Dubai, United Arab Emirates. Zau helps you manage reminders, tasks, notes, expenses, appointments and document renewals through a chat interface (WhatsApp and web). This policy explains what we collect, how we use it, and the choices you have.

Information we collect

• Your messages. The text and voice notes you send Zau, so we can understand and act on them.
• Your identifier. Your WhatsApp number, used to keep your data separate and to send you replies and reminders.
• The items you ask Zau to remember. Reminders, tasks, notes, expense amounts and renewal dates that you choose to save.
• Optional Google Calendar link. If you connect Google Calendar, we store a secure token so Zau can add your appointments to your calendar. We only create and manage events you ask for; we do not read your existing calendar for any other purpose.

How we use it

• To understand your requests and carry them out (set a reminder, log an expense, and so on).
• To send you the replies, reminders and morning briefings you asked for.
• To personalize your experience and understand, in aggregate, how Zau is used — so we can keep making it better for you.
• To operate, secure and grow the service.

We never sell or rent your personal data. We do not share it with anyone outside the trusted service providers listed below who help us run Zau, and we never use your message content for advertising.

Service providers we share data with

To run Zau we rely on a small number of trusted processors, who receive only what is needed to perform their function:

• Meta Platforms (WhatsApp Business Platform) — to send and receive your WhatsApp messages.
• Anthropic — to understand the meaning of your messages (AI processing).
• OpenAI — to transcribe voice notes into text.
• Google — only if you connect Google Calendar, to create your events.
• Supabase — secure database hosting for your saved items.
• Vercel — application hosting.

How we protect your data (data security)

We apply industry-standard safeguards to protect your information — including sensitive data such as the content of your messages and any Google Calendar data you authorize:

• Encryption in transit. All data exchanged between you, Zau and our providers travels over encrypted connections (HTTPS/TLS). We never place personal data in plain URLs.
• Encryption at rest. Your saved items are held in a managed database (Supabase/PostgreSQL) that encrypts data at rest.
• Strict access control & data isolation. Our database enforces Row-Level Security with a default deny-all rule for public access. Only our backend service — using a secret key kept in a protected environment — can read or write your data, and each person's data is isolated by their own identifier so users cannot access one another's information.
• Secret management. API keys and access tokens — including your Google authorization token — are stored only as encrypted secrets on our hosting platform (Vercel), never in our source code.
• Authenticated requests. Incoming webhook messages are cryptographically verified (HMAC-SHA256 signatures) so only legitimate traffic is processed.
• Abuse protection. Per-user rate limiting protects the service against automated abuse.
• Payment security. Payments are processed by Stripe (a PCI-DSS Level 1 provider); we never see or store your full card details.
• Least privilege. We request only the minimum permissions we need to provide the feature — for Google, the single calendar.events scope, and nothing broader.

Access to production data and systems is limited to authorized personnel on a need-to-know basis, and we review our security practices regularly. No method of transmission or storage is ever 100% secure, but we work continuously to safeguard your data using the measures above.

Google user data & Limited Use

When you connect Google Calendar, Zau requests only the calendar.events permission, which lets it create and manage the events you ask for. Zau does not read your existing calendar for any other purpose, and never uses Google user data for advertising, for building user profiles, or for training AI/ML models.

The data-protection mechanisms described in “How we protect your data” above apply fully to Google user data. In particular, your Google authorization token is transmitted over TLS, stored encrypted and access-restricted under Row-Level Security, and used solely to create and manage the calendar events you request. You can revoke Zau's access at any time in your Google Account, and you may ask us to delete your stored token (see below).

Zau's use and transfer of information received from Google APIs to any other app will adhere to the Google API Services User Data Policy, including the Limited Use requirements.

Data retention & deletion

We keep your data for as long as you use Zau. You can ask us to delete your account and all associated data at any time — see below.

How to delete your data

To delete your Zau data, send a message with the word DELETE to Zau, or email us at the address below with the subject "Delete my data". We will remove your account and all saved items (reminders, tasks, notes, expenses, renewals and any Google token) within 30 days.

Your rights

You can request access to, correction of, or deletion of your personal data. If you connected Google Calendar, you can also revoke Zau's access at any time in your Google Account security settings, and Zau will stop syncing.

Children

Zau is intended for adults and is not directed to children under 16.

Changes

We may update this policy from time to time. The "last updated" date above reflects the latest version.

Contact

Universe Vision Marketing Management LLC — Dubai, UAE
Email: contatowallacemagal@gmail.com