Privacy Policy

1. Who we are

Zerc ("Zerc", "we") builds business-aware AI. Polaris is a customer-facing AI concierge that answers and routes conversations for businesses. Workbench is an internal intelligence layer that lets a company's team search, create and automate over its own knowledge.

Zerc is the controller of the personal data described in sections 2.1 and 2.3. For conversations that Polaris handles on behalf of a business (section 2.2), that business is the controller and Zerc acts as its processor (the operator, in the terms of the Brazilian data protection law, LGPD).

The controller is Zerc AI, CNPJ 54.089.074/0001-75, Rua Girassol 571, apt 72, Vila Madalena, São Paulo, SP, 05433-001, Brazil. Data protection contact: privacy@zerc.ai.

2. What data we collect

2.1 Visitors of zerc.ai

When you visit the site we keep standard server logs: IP address, browser type, pages requested and timestamps. We use them to keep the site secure and running. The site sets a single cookie, NEXT_LOCALE, to remember your language. We do not run advertising trackers or third-party analytics.

When you write to us, we keep your name, email address and the content of your message so we can reply.

2.2 People who talk to a business through Polaris

If you contact a business that uses Polaris, or that business contacts you, we process the data needed to run the conversation:

• Your phone number, messaging handle or email address, and your name if you share it.
• The content of your messages and attachments.
• Voice recordings and transcripts, when the business has enabled voice and informed you that calls are recorded.
• Conversation metadata: channel, timestamps, delivery status, and which topics were handled by AI or by a person.
• Information the business already holds about you and connects to Polaris, such as order history, appointments or account status.

This data reaches us through the channel providers the business uses, mainly Meta's WhatsApp Business Platform and Twilio, and it is visible to the business you are talking to.

2.3 Business users of Polaris and Workbench

• Account data: name, work email, role and company.
• Content you connect or upload to the workspace: documents, CRM records, inbox, files and integrations you authorize.
• Prompts, generated outputs, approvals and usage logs, which form the audit trail of the workspace.
• Billing details, handled by our payment provider. Zerc does not store full card numbers.

3. Why we use it

We process personal data for the purposes below, each on the legal basis shown:

We do not sell personal data. We do not use your content or your customers' conversations to train models that serve other customers.

4. Messaging: WhatsApp, SMS and voice

Businesses that use Polaris are responsible for obtaining your opt-in before messaging you, and messages come from that business's number or account. Zerc operates the software behind the conversation.

• You can opt out at any time by replying STOP, or PARAR or SAIR in Portuguese, or by asking the business directly. After you opt out, you receive one confirmation and no further messages from that business through Polaris.
• Message frequency varies with the conversation. Message and data rates from your carrier may apply.
• For help, reply HELP or write to the business or to us.
• Mobile phone numbers and messaging opt-in data are never shared with third parties or affiliates for their own marketing or promotional purposes.
• Use of WhatsApp is also subject to Meta's terms and privacy policy.

5. Who we share data with

We share personal data only with the parties needed to deliver the service, under contracts that limit what they can do with it:

• Channel providers: Meta Platforms (WhatsApp Business Platform) and Twilio (messaging and voice).
• Cloud hosting and storage providers.
• AI model providers, under agreements that prohibit training on your data.
• Payment and invoicing providers.
• The business you are talking to through Polaris, which is the controller of that conversation.
• Public authorities, when the law requires it.
• A successor company in a merger or acquisition, with prior notice to you.

6. How long we keep it

• Website logs: up to 12 months.
• Conversations, transcripts, recordings and workspace content: for the duration of the business customer's contract, or the shorter retention period the customer sets. Deleted within 30 days after the contract ends or the retention period expires.
• Account and billing records: for as long as the law requires, typically 5 years under Brazilian tax rules.
• Copies in encrypted backups expire within 90 days.

After these periods, data is deleted or anonymized so it can no longer identify you.

7. Security

Data is encrypted in transit and at rest. Access inside Zerc follows least privilege and is logged. Workbench mirrors the permissions our customers already have, and every action leaves an audit trail. No method is perfect. If an incident affects your data, we notify affected customers and the competent authority as the law requires.

8. International transfers

Zerc is based in Brazil. Some of our providers process data in other countries, including the United States and the European Union. Transfers follow the safeguards of the LGPD (chapter V), including standard contractual clauses, and, for data from the European Economic Area, the mechanisms of the GDPR. Business customers can choose to keep their data in their region.

9. Your rights

Under the LGPD, the GDPR and similar laws you can:

• Confirm whether we process your data and access it.
• Correct incomplete, inaccurate or outdated data.
• Request anonymization, blocking or deletion of unnecessary or excessive data.
• Request portability of your data to another provider.
• Know with whom we share your data.
• Withdraw consent and object to processing based on legitimate interest.

To exercise them, write to privacy@zerc.ai. If you spoke with a business through Polaris, you can also ask that business directly; when you write to us we forward the request to it. We answer within 15 days. To delete your data, follow the steps on the Data deletion page. You can also file a complaint with the Brazilian data protection authority (ANPD) or the authority in your country.

10. Other sites and services

Zerc's site and products may link to or run inside services we do not operate, such as WhatsApp, the CRM or inbox a business connects, or the website that embeds a Polaris chat. Those services have their own privacy policies, and this policy does not cover what they collect. When a business uses Polaris, that business's privacy policy also applies to your relationship with it.

11. Children

Zerc's products are built for businesses and are not directed at anyone under 18. We do not knowingly collect data from minors, and businesses using Polaris may not direct it at them. If you believe a minor has provided us data, write to us and we will delete it.

12. Changes to this policy

We may update this policy as the products and the law change. The date at the top shows the current version. For material changes we notify business customers by email and post a notice on this page.

13. Contact

Zerc AI, CNPJ 54.089.074/0001-75, Rua Girassol 571, apt 72, Vila Madalena, São Paulo, SP, 05433-001, Brazil. Data protection officer: privacy@zerc.ai. General contact: hello@zerc.ai. Website: https://zerc.ai.