Privacy policy

The data controller is {razaoSocial} (Zinn Transportes), CNPJ 20.916.222/0001-66, located at Rua Chuva de Ouro (lot jd Anchieta) 37, São José, Sapucaia do Sul, RS, Brasil, 93218-660.

Data Protection Officer (encarregado): Juan Carlos Coffi da silva, at [email protected].

Other companies on the platform. The Zinn platform may also be used by other transport companies, each with its own clients and drivers. If you use another company's app, that company is the controller of your data and Zinn processes it on its behalf, as a processor, only to keep the platform running. One company's data is not visible to the others.

From all users

If you are a client (Zinn App)

Saved passengers stay on your phone. The passenger list you save in the Zinn App (name, phone, e-mail and relationship) is kept only on your device and is not sent to our servers. When you book a ride for one of these people, only their name and phone go into the ride, so the driver can contact the person boarding.

If you are a driver (Zinn Motorista)

If you are a manager or work on the dashboard

Name, e-mail, team role and the company you belong to. Important administrative actions (for example, exporting or deleting someone's data) are logged, with who did it and when.

We do not sell your data, we do not use it for advertising and we do not build marketing profiles.

International transfers

Our application servers are in Brazil (Google Cloud's São Paulo region). Some of the providers above process data outside Brazil, such as Google, Expo, Brevo, Anthropic and the IP location services, in the United States and the European Union. These transfers follow article 33 of the LGPD, with providers that adopt contractual clauses and data protection safeguards.

Drivers can choose to connect their Google account so that accepted rides appear in their calendar. It is optional: the app works the same without it.

• Permission requested: only calendar.events (view and edit calendar events). We do not request access to e-mail, contacts, files or calendars other than the primary one.
• What we do: we create one event for each accepted ride, with the passenger's name, the pickup and destination addresses and the time. When connecting, we create and immediately delete a test event to confirm the calendar works.
• What we don't do: we do not read, copy or analyze the events already in your calendar. The only data read from the Google account is the e-mail address.
• Where access is kept: we store an access code (refresh token) and your e-mail in a server area the apps cannot read. It is only used to write your ride events.
• How to disconnect: in Settings, under the calendar section of the driver app. When you disconnect, we delete the access code and ask Google to revoke it. You can also revoke it at any time at myaccount.google.com/permissions. Events already created stay in your calendar, and you can delete them.
• Alternative without sign-in: the driver can instead share the calendar with the service address shown in the app. In that case we only store the calendar's address.

Limited Use. Zinn's use and transfer to any other app of information received from Google APIs will adhere to the Google API Services User Data Policy, including the Limited Use requirements. Calendar data is used only to show the driver's rides in their own calendar. It is not sold, not used for advertising, not used to train artificial intelligence models and not read by humans, except with the driver's permission, for security purposes (such as investigating abuse) or to comply with the law.

When the company turns this feature on, clients can tap the microphone and say the ride they want. It only works when you tap the microphone; you can always type instead.

• Speech is turned into text by the phone's own speech recognition (Apple on iPhone, Google on Android), which may process the audio on their servers.
• The text, the time, the approximate city and the names of saved passengers (up to 40, never phone numbers) are sent to an artificial intelligence service (Anthropic or Google Gemini), only to understand the request and fill in the ride.
• We do not record the audio. Before booking, you review and confirm the ride on screen.

You can deny or withdraw any permission in your phone settings. Some features stop working without it: for example, drivers do not receive requests without location.

The apps keep some information on the phone or browser itself to work better: saved passengers, last location used, frequent routes, the last digits and brand of the saved card, light or dark theme and navigation preferences. This is not sent to our servers and is deleted when you uninstall the app or clear the browser data.

We do not use advertising cookies or third-party tracking or analytics tools.

The LGPD (art. 18) lets you request, at any time:

• confirmation that we process your data and access to it: we send a copy with your data and the documents you uploaded;
• correction of incomplete, wrong or outdated data (you can fix much of it yourself in the app);
• anonymization, blocking or deletion of unnecessary data or data processed unlawfully;
• portability of your data to another provider;
• deletion of your account and of data processed with your consent;
• information about who we share your data with and about the option not to consent;
• withdrawal of consent, such as disconnecting Google Calendar;
• review of decisions made solely by automated means.

How to ask: write to [email protected]. We reply within 15 days. To protect you, we may ask you to confirm your identity first.

Account deletion: when you delete your account, we delete your profile, documents, photos, notification tokens and notices. We only keep the records the law requires (completed rides, payments and tax data), for the periods in section 9. If you are a driver, your payment sub-account is closed once the balance is withdrawn.

If you feel we have not resolved your request, you can also complain to Brazil's National Data Protection Authority (ANPD).

• Connections are always encrypted (HTTPS/TLS).
• Access rules prevent one user from seeing another's data, and one company from seeing another's.
• CPF, PIX key, date of birth and documents are kept in restricted-access areas.
• The card number and security code pass through our servers only to be sent to Asaas, encrypted, and are not stored.
• Logging of administrative actions, limits against abusive automated use and automatic deletion of expired data.

No system is completely immune. If a security incident poses a relevant risk, we will notify you and the ANPD within the legal deadlines.

The apps are not intended for people under 18. A minor may travel as a passenger, but the account and the ride request always belong to a responsible adult.

We may update this policy when the service changes. Relevant changes will be announced in the app before they take effect. The date at the top shows the version in force.

CLEBER MARCELO ZINN 91877342068 (Zinn Transportes), CNPJ 20.916.222/0001-66, Rua Chuva de Ouro (lot jd Anchieta) 37, São José, Sapucaia do Sul, RS, Brasil, 93218-660. Data Protection Officer: Juan Carlos Coffi da silva, [email protected]. WhatsApp: +55 51 99885-2595.