Privacy Policy
1. Scope and roles
This Policy applies to the website, public pages, business contact and the Wellzapp platform. Its main operations are in the United States, in the state of Florida. For data relating to your account and our relationship with you, Wellzapp determines the means necessary to provide the service. For third-party data you enter, such as leads, contacts, lists and messages, you determine the purpose of use and Wellzapp processes that data to provide the service.
2. Data we process
Swipe the table sideways to see all columns.
| Category | Examples | Basis |
|---|---|---|
| Registration and account | name, email, hashed password, plan, permissions and preferences | service provision and security |
| Business contact and support | name, email, phone number, company, stated need and support history | responding to your request |
| Usage and security | IP, user-agent, access logs, security events and audit trail | operation, abuse prevention and service protection |
| Public website visit counting | page visited, referring website, approximate country and city, device type, browser and operating system | understanding website usage in aggregate numbers |
| Metrics and advertising | measurement identifiers, visit source, campaign parameters and interaction with plan CTAs | measuring campaigns and improving the website |
| Acceptances and preferences | Terms and Privacy versions, acceptance date and theme | recording choices and complying with applicable obligations |
| Customer content | leads, contacts, lists, groups, templates, messages, notes and media | providing the functions you request |
3. How we use data
We use data to provide subscribed features, authenticate users, process requests, maintain security, diagnose failures, comply with applicable obligations and send service-related communications. Official communications, including those about privacy and security, take place through our relationship via the email address contato@wellzapp.com.
4. Sharing and service providers
We may share data with providers that support hosting, infrastructure, security, visit counting, communication and payment, only to the extent necessary for the contracted activity. We may also disclose information when required by law, to protect rights and security, or in a business reorganization subject to appropriate safeguards. We do not sell lists, leads or customer content as a product.
5. Cookies, storage and measurement
On public marketing pages (home, pricing, AI, marketplace, help, activation, terms and privacy), we count visits using Vercel Web Analytics, a service from Vercel, the company that hosts the website. The count is aggregated: it shows totals, such as how many visits each page received, rather than a specific person's path. It does not use cookies or store anything on your device.
For each page opened, the count records the page visited (excluding anything after "?" or "#" in the address), the website you came from, the approximate country and city, device type, browser and operating system. It does not record your name, email, phone number or what you type, does not store your IP address and does not track you on other websites. To avoid counting the same visit twice, Vercel uses a temporary code calculated from the connection and discarded within 24 hours.
On those same public pages, we use the Meta Pixel to measure advertising, Google Analytics 4 to analyze usage and campaigns, and Microsoft Clarity to diagnose the website experience. These providers may use their own cookies or identifiers and receive technical visit information, the page viewed, the source, campaign parameters and interaction with plan CTAs. Clarity masks input fields by default. Through this implementation, we do not send names, emails, phone numbers, typed content, payment data or platform content.
After a purchase is confirmed by the payment provider, we may record the event Purchase using the Meta Conversions API to measure campaign results. The API receives the buyer's email only as a SHA-256 hash, the amount, currency and a technical charge identifier. We do not send card numbers, platform content or the email in plain text. This transmission takes place on the server after payment confirmation; it does not depend on browser trackers.
A confirmed purchase and any refund may also be recorded by the server in Google Analytics 4 when a valid technical identifier from the previous visit is available. We use the invoice identifier, amount, currency and plan to reconcile these events. We do not send names, emails or card data to Google Analytics 4 for this measurement. The payment page does not load the Google Analytics 4 tag.
The customer panel, login screens and payment pages do not use aggregate visit counting, the Meta Pixel, Google Analytics 4 or Microsoft Clarity in the browser. Necessary features may use local storage or session identifiers to retain the theme, record your pricing region, preserve authentication and protect the account.
Affiliate links use the parameter fpr in the address. When this parameter is present, it is preserved across public pages and sent to checkout as a referral reference. For campaign analysis, the link may also include UTMs. We do not store the affiliate code in a cookie.
6. International transfers
Because our main operations are in the United States and the infrastructure may involve providers in other countries, data may be processed outside your country of residence. When required by applicable law, we will adopt appropriate mechanisms and safeguards for these transfers.
7. Retention and deletion
We retain data for as long as necessary for the account, service provision, security, dispute resolution and applicable obligations. Retention periods vary by category and context. When deletion is requested and can be carried out, we remove or anonymize the data, retaining only what the law requires or permits.
8. Your rights
Depending on where you reside and the applicable law, you may request access, correction, deletion, portability, information about use, objection or withdrawal of consent. To exercise a right, write to contato@wellzapp.com. We may request reasonable information to confirm your identity and protect the account. For third-party data entered by a customer, we help the responsible customer respond when applicable.
9. Security and incidents
We use reasonable technical and administrative measures, such as authentication, password hashing, account separation, access controls, audit logs and MFA when available. No system is completely secure. If we identify a relevant incident, we will take containment measures and make the communications required by applicable law.
10. Changes and contact
We may update this Policy to reflect changes in the service, operations or legislation. The version and date will be published on this page and, when necessary, we will request renewed acceptance. For initial assistance, privacy, security or any official communication, write to contato@wellzapp.com. We aim to reply within 1 business day.
Wellzapp. Privacy Policy version 2026-09-13.
This is a translation; in case of discrepancies, the Portuguese version prevails.