Abrazo for Business Privacy Policy

Abrazo for Business is the mobile and web operations service from Abrazo Software LLC. It lets authorized organization staff manage events, attendance, students, private lessons, ticket and payout summaries, live streams, private event-video access, and Festival Concierge attendee support. The shared sign-in identity is also covered by the Abrazo Account Privacy Policy.

• Account and organization data: your name, email, account identifier, organization memberships, roles, and active organization.
• Operations data: events, classes, rosters, attendance, check-ins, students, competition details, private lesson bookings, live-stream settings, and private event-video access requests that you view or manage.
• Financial summaries: ticket sales, revenue, refunds, payment status, and payout status made available to your organization. The app does not collect full payment-card or bank credentials.
• Device and security data: session tokens stored in secure device storage, a device identifier used for kiosk controls, app and operating-system details, IP address, request logs, and diagnostic information.
• Camera and notification data: camera access when you scan an event code, notification permission, and an Expo push token when you enable notifications. Camera frames are used for scanning and are not saved as photos by the app.
• Artist media: portraits and logos that an authorized artist or manager chooses from the system photo picker and uploads to the artist profile.
• Zo conversations: questions, replies, conversation history, and relevant organization, event, studio, artist, roster, booking, profile, or financial-summary context used to answer the request. We ask for permission before the first Zo request is sent to Anthropic. You can decline and keep using every non-Zo feature.
• Zo voice data: microphone recordings that you choose to send for transcription through ElevenLabs, plus spoken answer audio returned to your device. Text entry remains available without microphone access.
• Festival Concierge messages:when an attendee sends a supported WhatsApp text message to a dedicated Concierge number, we receive the sender's WhatsApp phone number, the message text, message and reply identifiers, timestamps, the receiving business account and phone-number route, and delivery states such as sent, delivered, read, or failed. The current service discards profile names, media, contacts, and provider error details from the inbound webhook instead of importing them into Festival Concierge.

We use this data to authenticate you, enforce organization roles, provide the tools you request, synchronize event operations, deliver notifications, prevent abuse, investigate errors, keep the service secure, route attendee questions to the correct event, let authorized staff respond, record WhatsApp delivery status, and meet legal obligations. We do not sell personal data or use Business app data for third-party advertising. Zo uses Anthropic to generate answers and ElevenLabs for optional voice transcription and spoken audio. We send only the question and app context needed for the requested task. Zo proposes sensitive changes for confirmation before the app submits them.

The current release keeps automatic answers off and uses authorized staff replies. If a later release sends an attendee question to an artificial-intelligence provider, Abrazo will update this notice and its provider disclosures before enabling that processing. Abrazo does not use WhatsApp Business Solution Data to train or improve a shared artificial-intelligence model, build cross-customer profiles, or target advertising.

Data is visible to authorized members of the organization that owns or manages the relevant records. We also use service providers for hosting and databases, authentication, email, push notifications, payment processing, video streaming, storage, security monitoring, and customer support. These providers receive only the data needed to perform their work and are bound by contract or their published data terms. Meta provides the WhatsApp Business Platform that receives and delivers Festival Concierge messages. Festival Concierge message data may be processed by Fly.io for API hosting, Neon for database hosting, and Vercel for the authorized staff web interface. Current providers for other Abrazo for Business features include Anthropic for Zo answers, ElevenLabs for optional Zo voice, Cloudflare for media storage and delivery, Mux for video, Stripe for payment processing, Sentry for diagnostics, PostHog for consent-based analytics and service events, Expo and Google Firebase Cloud Messaging for optional push delivery, Neon for database hosting, Fly.io for API hosting, and Vercel for web hosting. We may disclose data when required by law, to protect people or the service, or as part of a corporate transaction with appropriate safeguards.

Your organization controls its event, customer, staff, attendance, financial, media-management, and Festival Concierge records. Abrazo processes those records to provide the service. Each dedicated Concierge number is routed to one authorized organization and event activation. Your organization is responsible for deciding which staff may access its records and for handling requests about records it controls. Contact the organization first if your request concerns one of its events, rosters, or Concierge conversations. You can also email us if you need help reaching the right organization.

We use encrypted network connections, secure token storage, role-based access controls, audit records, and operational monitoring. No online service can guarantee absolute security. Abrazo Software LLC is based in the United States, so data may be processed there and in other countries where our service providers operate. Where required, we use an approved transfer mechanism such as Standard Contractual Clauses or a provider’s current certification under an applicable data privacy framework.

We keep account and operations data while the account or organization uses Abrazo for Business, then for the period needed for security, dispute resolution, tax, accounting, and legal obligations. Retention depends on the type of record and who controls it. Signed-in users can schedule deletion directly from Account and data in the app. The same request covers the shared Abrazo identity, personal Zo conversations and memory, device and notification identifiers, provider records, and analytics identifiers. You do not need to send a second email. A request to delete your personal account may not delete records controlled by an organization or financial records that must be retained, but we remove or limit your identifying details where possible. For the controlled Festival Concierge pilot, WhatsApp phone numbers and message content are encrypted and retained through the event's configured support window, then for no more than seven additional days. The organizer can redact a conversation earlier. When retention expires, Abrazo removes the direct address and message content. Minimal content-free audit, security, delivery, and duplicate prevention records may remain for their documented operational or legal retention periods. The public account deletion page provides an alternative if you cannot sign in.

You can decline camera or notification permission in device settings. A Festival Concierge attendee can ask the event organizer to redact a conversation or email Abrazo for help with that request. Depending on where you live, you may ask to access, correct, export, restrict, object to, or delete personal data. Email privacy@abrazo.dev. We may verify your identity and may direct organization-record requests to the organization that controls them. You may also complain to your local data-protection authority.

Abrazo for Business is intended for authorized business users and is not directed to children. We may update this policy as the app or law changes. We will revise the effective date and provide additional notice when a material change requires it.

Abrazo Software LLC
Email: privacy@abrazo.dev