Privacy Policy

1. Who is the controller

The controller of the data processed here is o operador desta instalação — whoever installed and operates this system. The software authors have no access to this server or its data, and are neither controllers nor operators of that data.

2. What data is processed

• Of those served: name, phone, email when provided, conversation content, files sent (images, audio, documents), and deal history.
• Of those who use the system: name, email, access role, and a log of actions performed.

3. What they are used for

To serve, respond, record service progress, and organize the business relationship — including through AI agents operating under the operator's rules. Action logs are kept for auditing and security.

4. Who they are shared with

The data stays on the operator's server. To work, the system communicates with third parties chosen and contracted by the operator:

• the messaging platform used to talk with customers;
• the AI provider contracted by the operator, which receives the conversation excerpt needed to generate the reply or evaluate the conversation;
• when the operator turns on Jev (off by default), TypeSafe AI, in the United States, which receives each customer message, on its own and already stripped of tax ID, phone, and email, to assess whether the customer is annoyed, whether the message tries to manipulate the automatic service, which company area it's meant for, whether it asks to talk to a human or to stop receiving messages and, when it replies to a follow-up, which of the flow's outputs it fits into;
• when the operator registers a Maps key (off by default), Google, which receives the coordinates of the location the customer shared, to return the approximate street and city;
• the infrastructure provider where the server is hosted.

The data is not sold or provided for third-party advertising.

5. How long

Conversations and business records are kept while there is a customer relationship or legal retention obligation. Media files have their own operator-configured period. Audit logs are kept longer as evidence of who did what.

6. Your rights

The LGPD guarantees your right to confirm processing, access your data, correct incomplete or outdated data, request anonymization or deletion, know who it was shared with, and revoke consent.

The system handles these requests through its own flow: export gathers what exists about the person, and anonymization removes identification while preserving service history — that is why it cannot be undone.

7. Security

Access is controlled by account, password, and role. Two-step verification is optional for everyone and can only be required of admins. Each hosted organization only sees its own data, and integration keys are stored encrypted.

8. Data officer and contact

The operator has not yet published a contact address for the data officer in this installation. Requests must be made through the organization's own service channels.

9. Google data (Calendar, Meet, and Google Ads)

When an authorized person in the organization connects a Google account to this system, data received from Google is used only for the function they requested:

• Google Calendar: show calendar availability; create, update, and cancel bookings made by the user themselves; and prevent scheduling conflicts. The system stores event titles and times on the operator's server to calculate availability, and free-time calculation uses only each event's start, end, and status. The system does not read emails.
• Google Meet: create Google Meet meeting spaces when the organization turns on Meet with open access; only the generated link is returned by Google and stored on the operator's server for the invitation.
• Google Ads: send to Google Ads the sales an ad brought in so it can learn from them; create and list conversion actions; and read the metrics of the campaigns in the ad account itself.

Google data stays on the operator's server, is never sold, is not used for advertising, and is not used to train AI models. Use and transfer of information received from Google APIs follows the Google API Services User Data Policy, including the Limited Use requirements.

The Calendar connection can be removed anytime under Calendar → Disconnect, and the Google Ads one is removed by the operator, on request. In either case, the person can also revoke access directly at myaccount.google.com/permissions.