Privacy Policy

1. Who the controller is

The controller of the data processed here is o operador desta instalação — whoever installed and operates this system. The software's authors have no access to this server or the data stored on it, and are neither controllers nor processors of that data.

2. What data is processed

• About the person being served: name, phone, e-mail when provided, conversation content, uploaded files (images, audio, documents) and the deal history.
• About the person using the system: name, e-mail, access role and a record of the actions taken.

3. What they are used for

To serve, reply, record how the conversation is progressing and organize the commercial relationship — including by artificial intelligence agents acting under the rules configured by the operator. Action records are kept for auditing and security.

4. Who they are shared with

The data stays on the operator's server. To work, the system communicates with third parties chosen and contracted by the operator:

• the messaging platform used to talk to the customer;
• the artificial intelligence provider contracted by the operator, which receives the portion of the conversation needed to generate the reply;
• the infrastructure provider hosting the server.

The data is not sold or handed over for third-party advertising.

5. For how long

Conversations and deal records are kept for as long as there is a customer relationship or a legal retention obligation. Media files have their own retention period, set by the operator. Audit records are kept longer, because they are evidence of who did what.

6. Your rights

The LGPD guarantees you the right to confirm whether processing takes place, access your data, correct incomplete or outdated data, request anonymization or deletion, know who it was shared with, and withdraw consent.

The system handles these requests through its own flow: the export gathers what exists about the person, and anonymization removes the identification while preserving the service history — which is why it cannot be undone.

7. Security

Access is controlled by account, password and role, with two-step verification mandatory for administrators. Each hosted organization sees only its own data, and integration keys are stored encrypted.

8. Data officer and contact

The operator has not yet published a data officer contact address on this installation. Requests should be made through the organization's own service channels.