Privacy policy

This policy applies to zensavvy.com, navvy-ai.com, the NavvyAI platform and the projects we build and operate for our clients. It explains what data we process, why, who we share it with, where and for how long it is stored, how we protect it and how you can exercise your rights.

1. Who is responsible for your data

ZenSavvy, a company incorporated in Mexico that operates the ZenSavvy and NavvyAI brands, is the controller of the personal data described in this policy, in accordance with the Mexican Federal Law on the Protection of Personal Data Held by Private Parties (LFPDPPP), its Regulations and other applicable provisions. For any privacy matter, write to ventas@zensavvy.com.

2. The two ways we process data

• As controller: the data you give us directly (contact form, sales meetings, contracting, billing, NavvyAI account) and browsing data on our sites. This policy governs it in full.
• As processor: the data we process on behalf of a client when we build, host or operate a platform for them (for example, a registration site for a corporate event), or when a client loads its own contacts' data into NavvyAI. In those cases the client is the controller, its privacy notice applies, and so does section 7.

3. Data we collect directly

We do not ask for sensitive personal data. If you include it on your own initiative in a message, we will use it only to handle your request and with the safeguards in section 15.

4. Primary purposes

These are necessary for your relationship with us:

• Reply to your requests and follow up commercially.
• Prepare proposals, quotes and contracts.
• Provide, operate, maintain, support and secure the contracted services, including the NavvyAI platform.
• Create and manage your account, authenticate you and protect your access.
• Invoice, collect payment and meet tax, accounting and legal obligations.
• Prevent fraud, abuse and attacks, and investigate security incidents.
• Respond to requests from competent authorities.

5. Secondary purposes and how to opt out

These are not necessary for the service, but help us improve it:

• Send you information about new ZenSavvy and NavvyAI services, content and events.
• Produce aggregated internal usage statistics and studies.
• Evaluate, improve and train NavvyAI's AI features with de-identified data, with the exclusions in section 11.

6. Sensitive data and official identification

Some services may involve data that requires heightened care:

• Official IDs (Mexican INE voter card, passport) and travel documents, when a client commissions a platform that requires them.
• Voice: voice recordings and cloned voices in NavvyAI. Cloning only happens with express confirmation that the voice is your own or that you have the express permission of its owner.
• Emergency contacts and, where applicable, health information a client decides to collect for an event.

This data is processed only for the purpose it was collected for, with the express consent the law requires (obtained by the relevant controller); it is kept in private storage with no public access, delivered only through short-lived signed links, access to it is logged, and it is deleted when the purpose ends or at the end of the period set by the controller.

7. Client projects: ZenSavvy as processor

When we build or operate a platform for a client, or when a client uses NavvyAI with its contacts' data, the client is the controller and we are its processor. In that role we commit to:

• Process the data only on the client's instructions and for the project's purpose; never for our own purposes.
• Not use it to train AI models or for advertising, and not disclose it to third parties other than the necessary sub-processors (section 12), on whom we impose equivalent obligations.
• Keep it confidential, including after the relationship ends.
• Apply the security measures in section 15 and any additional ones agreed with the client.
• Notify the client without delay of any security breach affecting its data.
• When the project ends, return or delete the data as the client instructs, except what must be kept by law.
• Forward to the client any rights request we receive about that data, and help it respond.

If your data reached us through a client's platform (for example, registration for your employer's event), please refer to that client's privacy notice and address your rights requests to it.

8. NavvyAI: data the platform processes

NavvyAI is ZenSavvy's AI agent platform: bots that answer messaging channels, voice agents that make and take calls, an email assistant, automations, a content studio and a meeting note-taker. Depending on the modules you enable, it processes:

• Messaging channels (WhatsApp Business, Instagram, Facebook Messenger, TikTok and the chat widget on your site): the messages, comments, contacts and files needed to reply. Their use is also governed by each platform's policies.
• Voice agents: phone number, transcript, summary, details the person provides (name, interest, preferred time) and, only if you enable recording, the call audio (section 10).
• Email (Gmail): if you connect a mailbox, the emails that enter the NavvyAI inbox according to your rules, their summaries and drafts (section 9).
• Meetings (Google Meet and Zoom): transcript, participant names and generated notes.
• Studio: prompts, reference files, brand kit, voices and generated pieces.
• Scheduling and follow-up: appointments, tasks and reminders.

NavvyAI's privacy policy, at navvy-ai.com/en/privacy, details each module. If they differ, whichever protects you more prevails.

9. NavvyAI and Google APIs

The Google connection is optional and always initiated by you: nothing described here happens until you authorize it on Google's consent screen, and it stops as soon as you disconnect. Calendar and Meet are connected from Integrations and Gmail, separately, from Channels. These are all the permissions we request:

Permissions we request

• calendar.events.readonly — read the events in your calendar so we know which meeting the assistant should join and when. It is read-only: it cannot create, modify or delete anything. We only query your primary calendar and the next hour's window. From each event we use the title, start time, video call link, whether you accepted, how many people are invited and the domains of their email addresses (for example client.com), not the addresses themselves. We do not store a copy of your calendar.
• meetings.space.readonly — read Google Meet conference information: the meeting code, participant names and, when your Workspace generates it, the native meeting transcript. This is read-only as well.
• calendar.app.created — create a dedicated calendar named "Navvy AI" and manage only the events the application creates inside it: appointments you book from the app or that the voice agent closes, and dated action items from your meetings. It grants no access to the rest of your calendar.
• gmail.modify — only if you connect Gmail as a channel: read new emails in your inbox, classify them according to your rules (with the help of an Anthropic model when needed), apply Navvy/… labels in your own Gmail, prepare reply drafts and send replies from your account in the same thread. Only emails in the categories you mark as important are stored in NavvyAI; the rest stay only in your Gmail. Automatic sending only happens in the categories where you enable it. We never delete emails or move them to the trash.
• openid, userinfo.email and userinfo.profile — identify the connected account (Google identifier, email address and display name), so we know whose calendar or mailbox it is and can show you which account is linked.

Google access credentials (like those for Zoom and Meta) are stored encrypted with AES-256-GCM.

Limited Use of Google user data

• We do not sell data obtained from Google APIs or transfer it to data brokers.
• We do not use it for advertising, ours or third parties', or for targeting or profiling.
• We do not use Gmail, Google Calendar or Google Meet data to develop, improve or train generalized artificial intelligence models, and neither do our providers.
• We use it only to provide the features you enabled, as described in this policy.
• No one at ZenSavvy reads it unless you expressly authorize it (for example, to resolve a support issue), it is necessary for security or to comply with the law, or it is aggregated and anonymized.

How to disconnect your Google account

• From NavvyAI, under Integrations → Google → Disconnect and, for email, under Channels → Gmail → Disconnect.
• From your Google account, at myaccount.google.com/permissions, by removing access for NavvyAI.

On disconnection we cancel the Google Meet notification subscription, revoke the token with Google and delete the credentials and the connected account's details (identifier, email address and name). Emails that entered NavvyAI are automatically deleted after 30 days. Transcripts and notes already processed remain in your account until you delete them or request account deletion.

10. Meeting and call recordings

• Meeting note-taker: it joins the video call as an additional participant, visible in the attendee list, under an identifiable name (by default "Navvy AI (note-taker)"); someone in the meeting has to admit it, and its microphone and camera stay off. It records audio only, for a single purpose: transcribing it with Google Gemini so an Anthropic (Claude) model can write the notes. We do not keep the recording: it is destroyed with the temporary container when processing ends, and the copy sent to Google for transcription is automatically deleted after 48 hours. What is stored is the text and the notes.
• Voice agents: if you enable recording, the agent announces at the start that the call is recorded and why; if the person objects, it stops recording and what was recorded is deleted. Recordings are automatically deleted after 90 days.
• Meetings with ZenSavvy: in our own sales and project meetings we may use the NavvyAI note-taker, always visible and announced. If you prefer we don't, tell us and it will not join.
• ZenSavvy AI agents: part of our sales follow-up (calls, emails and messages) may be handled by an AI agent. It identifies itself as such and you can always ask to speak with a person.

11. Artificial intelligence

• We use providers' models (section 12) to transcribe, summarize, classify, draft, converse and generate content. Providers process the data only to return the result to us and, by contract or under their business terms, do not train their models on it.
• AI output may contain errors. Features that act on your behalf (sending an email, booking an appointment) can be set to require human approval.
• To improve NavvyAI we use de-identified data (without names, phone numbers, emails or other identifiers) and never data from Google, WhatsApp, Instagram, Messenger, TikTok, Zoom, payments or the projects we operate as processor. You can opt out as described in section 5.
• We do not make decisions with legal or similarly significant effects on people based solely on automated processing.

12. Processors and providers

We share data only with the providers needed to deliver the service, which act as processors and handle it solely on our behalf:

We choose providers with recognized security measures and keep an up-to-date register that we share with business clients on request.

13. Transfers

We do not sell your data or transfer it to third parties for their own marketing. We may transfer it without your consent only in the cases the LFPDPPP allows, to:

• Competent authorities, when required by law or a lawful order.
• Companies in the ZenSavvy group operating under the same privacy policies, for the purposes of this policy.
• Any acquirer or successor of ZenSavvy in a merger, spin-off or sale of the business, which will be bound by this policy.
• Third parties, when necessary to defend a right in legal proceedings or to protect the security of people or systems against fraudulent use.

14. Where data is stored and for how long

Our infrastructure runs on Google Cloud, region us-central1 (United States). When you use our services, your data is processed there with the same protections described in this policy.

When the period ends, the data is blocked and then securely deleted.

15. Security measures

We maintain administrative, technical and physical safeguards to protect data against damage, loss, alteration, destruction and unauthorized use, access or processing, including:

• Encryption in transit (HTTPS with TLS 1.2 or higher and HSTS) and at rest; integration credentials encrypted with AES-256-GCM and keys in a secrets manager.
• Data isolation per company and per project; documents in private storage, delivered through short-lived signed links.
• Web application firewall, bot and denial-of-service protection, per-IP rate limits and security headers (CSP, X-Frame-Options and others).
• Databases on a private network, with least-privilege users, auditing and continuous backups.
• Individual accounts with two-step verification, least-privilege access, same-day access removal when someone leaves a project, and periodic review of accounts and logs.
• Access logging for sensitive data, and technical logs free of passwords and credentials, with phone numbers and emails masked.
• Dependency review, security updates and availability monitoring with alerts.
• Confidentiality obligations for our staff and providers.

16. Security breaches

If a breach significantly affects your property or moral rights, we will inform you without delay: what happened, what data was compromised, what you can do to protect yourself, what actions we took and where to get more information. We will notify the authority when the law requires it. If we act as processor, we will immediately notify the client controller so it can notify the data subjects.

17. Your rights and withdrawal of consent

You or your legal representative may at any time exercise the rights of Access, Rectification, Cancellation and Objection (ARCO rights), and withdraw your consent, by writing to ventas@zensavvy.com. The request must include:

• Your name and a way to send you the response.
• A copy of a valid official ID and, if a representative acts for you, proof of representation.
• A clear description of the data and the right you want to exercise, and any document that helps locate it.
• For rectification, the changes and the supporting document.

We will respond within 20 business days of receiving the complete request and, if it is granted, carry it out within the following 15 business days. These periods may be extended once for an equal period when justified, and we will let you know. Withdrawal of consent has no retroactive effect and does not apply where we must keep the data due to a legal obligation or an active contract. If you use NavvyAI, you can also view, correct and delete much of your information directly in the platform.

18. Limiting the use or disclosure of your data

You can ask us to stop using your data for marketing communications by writing to ventas@zensavvy.com or using the unsubscribe link in our emails; we will add you to our exclusion list. In Mexico you can also register with PROFECO's Public Registry to Avoid Advertising (REPEP).

19. Cookies and tracking technologies

• zensavvy.com does not use third-party advertising or analytics cookies; only the technical ones needed for the site to work and stay secure.
• navvy-ai.com uses Google Analytics, a first-party attribution cookie (navvy_attr, 90 days) and the Meta pixel, to learn where visits come from and measure our ads.
• The NavvyAI platform uses local storage and strictly necessary cookies to keep you signed in.

You can block or delete cookies in your browser settings; analytics and advertising cookies can be disabled without affecting the service.

20. People outside Mexico

We work with clients in other countries. If you are in a jurisdiction with its own data protection law (for example, the EU GDPR or US state laws), you may exercise the rights that law grants you — including portability and restriction of processing — at the same address, and we will handle your request with the same standard. Where the law requires it, we will sign a data processing agreement with our clients.

21. Minors

Our services are intended for businesses and professionals aged 18 or over. We do not knowingly collect data from minors; if we find we have, we will delete it.

22. Our clients' responsibilities

When a client loads third-party data into NavvyAI or commissions a platform from us, it is responsible for:

• Having its own privacy notice and the legal basis or consent needed for the data it collects and gives us.
• Informing participants before recording or transcribing meetings and calls, and obtaining their consent where the law requires it.
• Complying with the policies of the channels it connects (Meta, Google, TikTok, Zoom) and the rules that apply to commercial communications.
• Cloning only its own voices or voices it has express authorization to use.

These responsibilities are detailed in the Terms and conditions and in each project's contract.

23. Changes to this policy

We may change this policy due to legal changes or changes in our services or practices. The current version will always be on this page with its update date and, if the change is substantial, we will let you know by email or within the platform before it takes effect.

24. Contact

If you have questions about this policy or your data, write to ventas@zensavvy.com. If you believe your right to personal data protection has been violated, you may contact the competent authority. In case of any discrepancy between versions, the Spanish version prevails.