ZitasPrivacy Policy
1. Who we are
Data controller: Zitas, Mexico.
Privacy contact: contacto@zitas.net
“Zitas” is the trade name under which the service is provided. If you need the controller's full legal and tax identification details, or its registered address — for instance to file a formal request or a complaint with the authority — you may request them at the contact address above and they will be provided.
2. What Zitas does
Zitas is appointment-scheduling and customer-service software for small businesses in Mexico that already handle enquiries over WhatsApp — medical and dental practices, clinics, salons and similar appointment-based businesses. On behalf of the business, Zitas answers incoming messages about services, hours, pricing and location; books, reschedules and cancels appointments in the business's calendar; sends appointment confirmations and reminders; and hands the conversation over to the business's staff when a person is needed.
3. Our two roles
| Whose data | Our role |
|---|---|
| Business owners and staff who subscribe to Zitas, and people who contact us through this website. | Controller. We determine how this data is processed. |
| The business's own customers or patients, who message that business's WhatsApp number to book. | Processor. The business is the controller. We process this data solely on that business's behalf and instructions, in order to provide the service, and never for our own purposes. |
4. Data we process
- End customers of a business: the name they provide, their WhatsApp phone number, the content of their messages with that business, and appointment details (service, date, time, status and change history).
- Business owners and staff: name, email address, contact phone, and business configuration (trade name, address, services, hours and policies). Account passwords are never stored in readable form.
We do not request financial or payment data, or government identification, in order to book an appointment.
5. Sensitive data
Zitas exists to schedule appointments. It does not ask for health data: no diagnoses, conditions, medications or medical history, none of which are required to book. A person may nonetheless mention, on their own initiative, the reason they are seeking an appointment. When that happens, the mention stays within that business's conversation history, is treated with the same confidentiality as any other message, is not used for any purpose other than providing the scheduling service, and is never combined with other sources to build health profiles.
6. Purposes
Primary (necessary to provide the service): answering messages sent to the business's WhatsApp number; checking real availability and booking, rescheduling or cancelling appointments; sending confirmations and reminders; escalating to the business's staff when human attention is required; displaying the business's own agenda, customer history and conversations in its dashboard; support, abuse prevention and legal compliance.
Secondary (optional): aggregated, anonymised statistics used to improve the product. You may opt out by writing to us; doing so does not affect the service or your appointment.
We do not sell, rent or share personal data with third parties for advertising purposes, and we do not build profiles of individuals beyond the history needed to handle their appointments. We do not use message content to train or improve machine learning models.
7. Subprocessors and international transfers
| Provider | Purpose |
|---|---|
| Meta Platforms, Inc. | Sending and receiving WhatsApp messages |
| Google LLC | Appointment calendar and text processing of incoming messages |
| Supabase | Database storing appointments and conversations |
| Railway | Application server |
| Vercel | Business dashboard and this website |
These providers operate servers outside Mexico, primarily in the United States, so data may be stored and processed outside Mexican territory under their own contractual security and confidentiality commitments. Apart from the above, we do not transfer personal data to third parties, except where required by law or by a competent authority.
8. Your rights
Under Mexican data protection law you may access, rectify, cancel or object to the processing of your personal data (known as ARCO rights), and limit its use or disclosure. Write to contacto@zitas.net with your name, a means of contacting you, the WhatsApp number you messaged from or the business you booked with, a clear description of your request, and proof of identity.
We answer within 20 business days and, where the request is well founded, act on it within the following 15 business days. Exercising these rights is free of charge. If you believe your rights have been infringed, you may file a complaint with the competent Mexican data protection authority.
9. Deleting your data
See Data deletion for how to request deletion and what is removed.
10. Security and retention
We apply reasonable administrative, technical and physical safeguards: encryption of traffic in transit, restricted database access, per-business access control, and omission of personal data from system operation logs. Data is retained for as long as the business relationship lasts, plus any additional period required by law, after which it is deleted or anonymised.
11. This website
This site is informational and uses no advertising or third-party tracking cookies. Our hosting provider may log ordinary technical connection data such as IP address and browser type for security and operational purposes. The site loads fonts from a Google service, which involves a connection to Google's servers.
12. Changes
We may update this policy to reflect changes in the service or in applicable law. New versions are published at this same address with an updated date.