Skip to content
BAZI

official document

Privacy policy

Here we explain, without legalese, which personal data BAZI collects, why it collects it, who it shares it with and how you exercise the rights the LGPD gives you.

Last updated: October 19, 2026

3. What we use it for, and on what legal basis

  • Performing the contract (art. 7, V of the LGPD): creating your account, processing payments, issuing and validating tickets, providing support.
  • Complying with legal obligations (art. 7, II): keeping access logs for the period required by the Marco Civil, Brazil's internet civil framework, and preventing fraud and money laundering. Tax invoicing of the ticket is not covered here: BAZI intermediates the sale, and the ticket invoice is the organizer's.
  • Legitimate interest (art. 7, IX): platform security, aggregate usage metrics and product improvement, always with an impact assessment and the possibility of objecting.
  • Ticket limit per person (art. 7, IX): when the organizer limits the purchase, we generate and keep a scrambled code derived from your CPF — never the number. It's what allows us to apply the limit and prevent the same person from using several accounts to get around it. Without that code there's no way to tell ten new accounts from ten different people.
  • Consent (art. 7, I): marketing communications, promotional push notifications, use of location and advertising cookies. You can withdraw your consent at any time.

4. Who we share it with

  • Event organizers: when you buy a ticket, the organizer of that event starts to see your name, your @ and your account email, along with the ticket type, the purchase date and the check-in status. They can also export that list to check entry outside the app. It's the ticketing market standard, and it's what allows them to run the door and talk to the people going to their event.
    What the organizer does not receive: your CPF, your phone, your date of birth and your ticket code — the last one is your entry credential and never leaves your app.
    The legal basis is performance of the purchase contract: without knowing who bought, there's no way to let you in. From the moment they receive that data, the organizer acts as an independent controller — whatever use they make of it, including promoting future events, is their responsibility, and it's with them that you ask to be taken off the list.
  • Payment processors: Asaas (ticket purchases and payouts to organizers), Stripe (Clube BAZI and organizer plan subscriptions) and Apple or Google, when the subscription is purchased inside the app.
  • Infrastructure: Supabase (database and authentication), Vercel (hosting), Google Firebase (push notifications).
  • Usage analytics: PostHog, in the United States. We record which screens you open, which purchases you complete and the errors you hit, along with your IP address — which the service uses to infer your region. We never send your name, your email or the contents of your messages. The legal basis is legitimate interest (art. 7, IX of the LGPD) in understanding and improving the product, and you can object at any time, losing nothing: in the app, under Settings → Privacy → Usage data. Crash reports are a separate thing and keep going out even with this off, without name or email — they are what fixes the app when it breaks. On this website it is different: PostHog only loads with your consent (art. 7, I), given in the cookie banner and revocable at any time under “Cookie preferences”, in the footer (see section 9).
  • Meta Platforms (Facebook/Instagram), with your consent: the Meta Pixel records the pages you visit on this site and the purchase confirmation (amount, currency and event bought) so we can measure the results of our ads. We don't send your name, email or CPF.
  • Meta (WhatsApp): when you receive the organizer guide or talk to our support over WhatsApp (see item 4.3).
  • OpenAI: when you use the support assistant in the Help center (see item 4.1) or Zaia, the app's discovery assistant (see item 4.2). What you write or say is sent so that the answer can be generated.
  • Authorities: upon a court order or valid legal request.

We never sell your personal data.

4.1. Support assistant

In the Help center there's an assistant that answers your questions on the spot. It's optional: the list of frequently asked questions and email support keep working without it. To answer, what you write is sent to OpenAI, which operates in the United States — an international transfer supported by art. 33 of the LGPD, with contractual safeguards.

  • What we send: the message you wrote and the previous ones in the same conversation. When the question depends on a purchase of yours, we also send a summary of your latest orders — event, date, status, quantity and amount. We don't send your name, email, phone, CPF, card details or your ticket code.
  • What is kept: from the use of the assistant, our servers record only counts, cost and response time — the content of your messages is not stored there. The conversation stays on your screen and disappears when you leave the page.
  • If a support request is opened: then yes, what you wrote is kept, because it becomes the support history our team will read and reply to. You follow that history in “My support requests”.
  • Decisions: the assistant doesn't decide refunds, cancellations or anything that affects your order. It answers questions and, when the case needs a person, opens a support request for our team.

Since you write freely, avoid including sensitive data or third-party data in the conversation — describe the problem; there's no need to repeat card numbers or passwords (we never ask for those).

4.2. Zaia, the app's discovery assistant

In the app, Zaia finds events based on what you ask, by text or by voice. It's optional: search and the map work without it. To answer, the text of your question — or, when you speak, the recorded audio — is sent to OpenAI, which operates in the United States, in an international transfer supported by art. 33 of the LGPD, with contractual safeguards.

  • What for: to transcribe the audio, understand what you're looking for and write the answer with the events that match the request. The legal basis is the performance of the contract: it's the service you request when you ask.
  • What we send: the question (text or audio), the previous messages in the same conversation and the public data of the events found. We don't send your name, email, phone or CPF.
  • Model training: the content Zaia sends to OpenAI is not used to train artificial intelligence models.
  • What is kept: our servers record only counts, cost and response time — the text and audio of your questions are not stored there. The conversation stays only on your device and disappears when you clear it or sign out.
  • If you report an answer: the question and the answer go along with the report and are kept for review by our moderation team.

Answers are generated by artificial intelligence and may contain mistakes. Avoid including sensitive or third-party data in your questions.

4.3. WhatsApp

BAZI uses WhatsApp Business, by Meta, in two situations: to send the organizer guide and to assist people who write to our support number. Messages go through Meta, which may process them outside Brazil, in an international transfer supported by art. 33 of the LGPD.

  • Organizer guide: when signing up in the app, people who choose to organize events can provide their phone number — it's optional — and agree to receive the organizer guide over WhatsApp. The authorization comes pre-checked, and you can uncheck it before finishing. We send a single message per person; it isn't a broadcast list or a recurring send. The legal basis is your consent (art. 7, I of the LGPD).
  • How to stop: reply SAIR, PARAR, STOP or CANCELAR in the conversation and your consent is revoked.
  • Support: when you write to the support number, we receive your number, your WhatsApp profile name and the content of the messages. The conversation stays in an internal inbox that only the support team can access. If the number belongs to a BAZI account, the conversation is linked to it so we can understand your case. Photos, audio and files are not copied to our servers. The legal basis is the performance of the contract (art. 7, V): it's the support you request when you write.
  • How long: each message is deleted 90 days after it is sent or received, and the conversation disappears along with its last message.
  • If you delete your account: the conversation stops being linked to your account right away and stays in the support inbox only until it is deleted, within the same period.

5. International transfers

Some vendors process data outside Brazil. In those cases we require contractual protection clauses compatible with the level required by the LGPD, under arts. 33 and 34.

6. How long we keep it

  • Active account: for as long as you keep the account.
  • Purchase order: the order record itself (event, amount, status) is kept for as long as it's needed for the platform's history and to comply with legal obligations.
  • Buyer data linked to the order: kept for 1 year from the transaction, because that's the window in which a charge can be disputed and we need to be able to prove and resolve the purchase. After that the order remains, without identifying you.
  • Access logs: 180 days, meeting the 6-month minimum of the Marco Civil da Internet, Brazil's internet civil framework.
  • After you delete your account: we anonymize or delete the data we don't need to keep because of a legal obligation within 30 days.

7. Your rights

The LGPD guarantees that you can, at any time:

  • confirm that processing exists and access your data;
  • correct incomplete, inaccurate or outdated data;
  • request anonymization, blocking or deletion of unnecessary data or data processed in breach of the law;
  • request portability to another provider;
  • withdraw consent and object to specific processing;
  • know which public and private entities we share your data with.

To exercise any of them, write to suporte@baziapp.co. We reply within 15 days.

8. Security

We use encryption in transit (TLS) and at rest, role-based access control, per-user data isolation in the database (RLS), audit logging and periodic permission reviews. No system is 100% infallible — if there's an incident with relevant risk, we notify you and the ANPD, Brazil's data protection authority, within the legal deadlines.

9. Cookies and similar technologies

We use cookies to:

  • Essential: keep you signed in and protect checkout. They can't be turned off.
  • Analytics: Google Analytics and PostHog, to understand which pages and events generate interest. They only load after you accept in the cookie banner. If you are logged in, PostHog links this browsing to your account by its internal identifier — the same one the app uses —, without your name, email or CPF. The legal basis is your consent (art. 7, I of the LGPD). PostHog also receives your IP address and processes the data in the United States (see section 5, International transfers).
  • Advertising: the Meta Pixel, to measure the results of our ads on Facebook and Instagram. It only loads after you accept in the cookie banner — before that, no Meta tag runs.

Your choice is stored in this browser and can be changed at any time under “Cookie preferences”, in the footer. You can also block cookies in your browser settings, bearing in mind that the essential ones are needed to buy tickets.

10. Children and teenagers

The minimum age for a BAZI account is 13, and we do not create accounts for anyone who declares less. Between 13 and 18, use assumes the awareness and supervision of a legal guardian, and buying a ticket still requires being 18 or having a guardian's assistance. We do not intentionally collect data from children under 13; if we identify such a case, we remove the data.

11. Changes to this policy

We may update this document. The update date is at the top of the page and relevant changes are communicated by email or inside the app. See also the Terms of use.