1. Scope and acceptance
This Policy applies to the wisedatachat.com website, to the WiseData Chat platform and to communications related to those services.
By using any of these services, you declare that you are aware of the practices described here. This Policy is part of the Terms of Use.
2. Audience and minimum age
The Platform is intended for professional use by companies and self-employed professionals. It is not intended for people under 18, and we do not knowingly collect data from children or teenagers.
If we identify a registration that breaks this rule, the account may be closed and the data erased.
3. Roles under the LGPD
We are controllers of the data of those who subscribe to or show interest in the Platform: account registration data, billing data, access logs and support interactions.
We are processors of the data the Customer processes in the Platform in the course of its own business: data of the users it invites and of the Contacts it talks to over WhatsApp — the messages, the media, the contact record and the customer service and sales history. In that case, the Customer is the controller and defines the purposes of processing.
As processors, we handle that data solely according to the Customer's instructions and as needed to deliver the contracted service.
4. What data we collect
Registration data: name, e-mail, password in encrypted form, preferred language and, where applicable, phone number.
Tax and billing data: legal or full name, tax ID, address and the data required to issue a tax document. Full credit card data is not stored by us — processing is handled by third-party payment processors.
Customer Content: conversations with Contacts — text, audio, image, video and documents —, the audio transcriptions and image descriptions generated by the Platform, translations, internal notes, Contacts' data (name, phone, WhatsApp identifier, username, e-mail, company and custom fields), the sales pipeline, meetings, form responses, broadcasts and the material provided for the AI Agent.
Data received from Meta: when the Customer connects its number through Meta's official sign-up, we receive the identifiers of the WhatsApp Business account, the number and the business portfolio, the number's display name and quality rating, the sending limit, the status of templates, the messages received and their delivery and read statuses, Contacts' profile names and WhatsApp identifiers and, when the conversation starts from an ad, the data of that ad, campaign, ad set and ad account, with the spend. The access credential granted by Meta is stored encrypted.
Data received from Google: when a user connects Google Calendar, we receive the e-mail of the connected Google account, the list of its calendars, the busy periods of the chosen calendar and, to display the Calendar screen to that user, the title, start, end and link of the events in the period being viewed. Those events are read at display time and are not stored in the Platform. The access credential is stored encrypted.
Technical and security data: IP address, browser and device type, date and time of access, session history and logs of security-relevant events.
Error reports: when a technical failure occurs, we automatically collect error and performance diagnostics with the technical data from the moment of the failure, solely to fix the problem.
Website browsing data: pages visited, visit source and campaign parameters, collected as described in section 6.
Communication data: messages exchanged with support, including those exchanged with the artificial intelligence assistant, and the content of contact forms.
5. Purposes and legal bases
Performance of contract: creating and maintaining the account, providing the contracted features, processing payments, issuing tax documents and providing support.
Compliance with legal or regulatory obligations: retention of access logs under article 15 of the Brazilian Civil Rights Framework for the Internet, and tax and accounting obligations.
Legitimate interest: Platform security, fraud and abuse prevention, performance measurement and product improvement, always with an assessment of the impact on data subject rights.
Consent: sending marketing communications and using non-essential cookies. Consent may be withdrawn at any time, with no effect on the contracted service.
Institutional promotion: use of the Customer's business name, brand and voluntary testimonials to publicly identify the relationship, as authorized in the Terms of Use. A company name is not personal data, but a testimonial signed by a person is — in that case the basis is consent, revocable at any time.
We do not use the data Customers enter into the Platform to train artificial intelligence models, nor do we sell it, under any circumstances.
7. Data sharing
We share data only with processors necessary to deliver the service, always under contract and bound by confidentiality, listed in section 8.
Meta: the Contact's number and the content of each message sent are transmitted to Meta at the time of sending, so that the message is delivered over WhatsApp. When the Customer turns on conversion event sending, each lead or purchase recorded in the pipeline is sent to the dataset of the Customer's own Meta account: with the click identifier when the conversation came from an ad or, in other cases, with the Contact's phone, e-mail, name and country converted into an irreversible code (SHA-256) before sending. Meta processes this information under its own terms and privacy policy.
Google: when the Customer connects Google Calendar, each meeting booked by the Platform is created in the chosen calendar, with the title, time, summary of the subject, the Contact's name, phone and e-mail and the guests provided, plus the Google Meet link when that option is on. Google processes this information under its own terms and privacy policy.
We may share data to comply with a legal obligation, court order or request from a competent authority, and to exercise our rights.
We do not sell personal data and do not transfer it to third parties for advertising.
8. Subprocessors
The providers below process personal data on our behalf, each limited to the stated purpose. The list is kept current on this page; a new subprocessor is reflected here before it goes into operation.
Internal administrative tools that do not receive Licensee Content are not part of this list.
| Subprocessor | Purpose | Location |
|---|---|---|
| Hostinger | Hosting of the application and the database | Brazil and European Union |
| Amazon Web Services | Encrypted database backups | Brazil |
| Cloudflare | Storage of media and files, PDF report generation, anti-bot verification at login and the click-tracking domain for broadcasts | United States and global network |
| Meta Platforms | Sending and receiving messages through the WhatsApp Business Platform, templates, ad data and conversion events | United States |
| OpenAI | AI Agent, copilot, translation, audio transcription, image description, search in the agent's material, moderation and conversation summaries | United States |
| Cohere | Ranking, by relevance, the passages of the agent's material that answer the Contact's question | United States and Canada |
| LlamaIndex | Extracting text from the files provided as the agent's material | United States |
| Google Calendar, when connected by the Customer, and, on the website, audience measurement and tag management | United States | |
| Sentry | Error monitoring and failure diagnosis | United States |
9. Sharing within the WiseData group
WiseData Business LTDA runs other products under the WiseData brand. Registration and contact data may be shared among the group's companies for unified customer service, fraud prevention, management of the commercial relationship and offering the group's own products.
Licensee Content — the data you enter in your operation — is not shared between group products, except where you subscribe to an integration that requires that flow, and only to its extent.
Two group services support the Platform: WiseData Mail sends the Platform's e-mails, such as invitations and account notices, and keeps the account owner's record for the communications in section 21; and WiseData Leads looks up the public data of a CNPJ when you ask for the tax details to be filled in automatically.
Offering other group products through marketing communications depends on consent and may be cancelled at any time.
In case of corporate reorganization, merger, spin-off, acquisition or sale of assets, data may be transferred to the successor under the conditions of this Policy, with prior notice to data subjects.
10. International transfer
Some of the subprocessors in section 8 maintain infrastructure outside Brazil, which constitutes an international transfer of data. This includes the messages themselves: delivery through the WhatsApp Business Platform goes through Meta's infrastructure abroad.
Those transfers comply with article 33 of the LGPD and are supported by contractual clauses ensuring a level of protection compatible with Brazilian law, as provided by the International Data Transfer Regulation approved by ANPD Resolution 19/2024.
Where an equivalent alternative with infrastructure in Brazil exists, it is preferred.
11. Artificial intelligence and data
The Platform uses artificial intelligence for the AI Agent, which replies to Contacts on the Customer's behalf, for the team member's copilot, for conversation translation, to transcribe audio and describe images received, and to summarize and analyze conversations. The model providers are identified in section 8.
To generate each response, the model receives only what is necessary: the recent messages of the conversation, the Contact's name and registration data, the Customer's instructions and the passages of the Customer's material that address the question. The Contact's messages also go through a moderation service before reaching the AI Agent.
The artificial intelligence providers do not use this content to train their models, and we do not use it for that purpose either.
Real conversations are only used as examples of how to serve customers when the Customer itself imports them into its AI Agent. Before any analysis, the Contact's name, the company name, phone numbers, e-mails, documents and card numbers are replaced with placeholders, and each example only takes effect after it is approved by a person on the Customer's team.
Data received from Google: WiseData Chat uses the information received from Google APIs only for the calendar features described in this Policy and visible to the user. The use and transfer of that information to any other app adheres to the Google API Services User Data Policy, including the Limited Use requirements. From Google Calendar, the AI Agent receives only the free time slots calculated from the calendar — never the title, description or guests of the events —, to offer times to the Contact.
Data received from Google APIs is not used to develop, improve or train generalized artificial intelligence or machine learning models, is not sold, is not used for advertising, is not transferred to third parties beyond what is necessary to provide the features above, and is not read by humans, except with the user's authorization, when necessary for security, investigating abuse or complying with the law.
Data received from Meta: we use the data received through the WhatsApp Business Platform and Meta's advertising APIs only to provide the Customer itself with the features described in this Policy. That data is not sold, is not used for advertising, is not combined with that of other Customers and is not used to train artificial intelligence models.
Generated responses are suggestions and do not replace human analysis. Section 12 deals with automated decisions.
12. Automated decisions
Article 20 of the LGPD grants data subjects the right to request review of decisions made solely on the basis of automated processing that affect their interests, including those intended to define a personal, professional, consumer or credit profile.
The Platform does not make solely automated decisions that produce legal effects on data subjects or otherwise significantly affect them. The calculations, indicators, classifications and suggestions presented are inputs to a human decision — the Customer decides.
In automated security and anti-fraud controls, such as a preventive block due to suspicious activity, the measure is always reviewable by a person upon request through the support channels.
In customer service, the AI Agent and the automatic classification of messages may transfer the conversation to the team, close it, move it in the sales pipeline or record that the Contact no longer wants to receive messages. These are customer service measures configured and monitored by the Customer, who can review them at any time — and the Contact can ask for a review directly from the company they talked to.
Restrictions applied by Meta to the Customer's number — sending limit, quality drop or block — are Meta's decisions, made under its own criteria. We have no means of reversing them, and review requests must be addressed to Meta.
Should a feature come to produce a solely automated decision with relevant effect, we will state here the criteria and procedures used and make the review request available, subject to commercial and industrial secrecy.
13. Information security
We adopt technical and administrative measures to protect data, including encrypted traffic, passwords stored with a key derivation algorithm, Meta and Google integration credentials stored encrypted, private files delivered only through the server to authenticated users, access control by role and by WhatsApp number, isolation between different customers' accounts and logging of security events.
Access by the Licensor's personnel to customer data is restricted to what is necessary for support and maintenance, logged and subject to a confidentiality commitment.
No system is completely immune to incidents, and no security measure eliminates risk entirely.
14. Security incidents
Should a security incident occur that may cause relevant risk or damage to data subjects, we will notify those affected and the Brazilian Data Protection Authority as provided in article 48 of the LGPD, describing the data involved, the risks and the measures taken.
Where we act as processors, we will notify the controlling Customer as soon as we become aware, so that it can fulfil its own notification duties.
15. Retention and storage periods
We keep data for as long as the contractual relationship lasts and, after it ends, only for the periods below. Once those periods are met, data is erased or anonymized.
| Data | Period | Basis |
|---|---|---|
| Account and Licensee Content, including conversations and Contacts' data | During the relationship. After account deletion, up to 30 days for erasure from backups | Performance of contract |
| Access credentials for Meta and Google | Until the integration is disconnected or the account is deleted | Performance of contract |
| Application access logs | 6 months | Article 15 of the Brazilian Civil Rights Framework for the Internet |
| Tax documents and billing records | 5 years | Tax legislation |
| Account deletion request record (date, requester and confirmation of ownership) | 5 years | Exercise of rights and proof of proper handling |
| Contact data for marketing | Until consent is withdrawn | Consent |
| Support and service history | 5 years after the account is closed | Exercise of rights |
16. Account and data deletion
Account deletion is carried out at the request of the account owner, through the channels in section 18, after confirmation of ownership, and is irreversible. The full procedure is on the account deletion page.
Removal reaches the records created during use — conversations, media, Contacts, pipeline, the agent's material and settings —, not just the main registration. Only data whose retention is required by law or necessary to exercise rights remains, as set out in section 15.
Before deleting, the Customer may export Contacts and conversations using the Platform's features.
Without deleting the account, the Customer may disconnect the WhatsApp number and Google Calendar in Settings at any time. Once Google Calendar is disconnected, the credential is revoked with Google; access can also be removed directly in the Google account's permissions. Access to Meta can also be removed in the business account settings at Meta.
Moving to a smaller plan does not imply deletion: data that stops being displayed remains stored and becomes accessible again if the plan is resumed.
Accounts with no active subscription and no access for an extended period may be deactivated and their data erased. Keeping data nobody uses indefinitely runs against the necessity principle in article 6, III, of the LGPD. Before erasure we give notice by e-mail, in advance and with the opportunity to reactivate or export.
17. Data subject rights
Under article 18 of the LGPD, you may request: confirmation that processing exists; access to the data; correction of incomplete, inaccurate or outdated data; anonymization, blocking or erasure of unnecessary or excessive data, or data processed in breach of the law; portability to another provider; erasure of data processed with consent; information about who we share the data with; information about the possibility of withholding consent and its consequences; and withdrawal of consent.
You also have the right to request review of automated decisions, as set out in section 12.
Requests concerning data entered by a Customer into the Platform must first be addressed to that Customer, who is the controller of such data. When we receive requests of that kind, we forward them to the responsible controller and provide the necessary support.
If you talked over WhatsApp with a company that uses WiseData Chat, that company decides about your data. To stop receiving messages, reply to the conversation with PARAR, SAIR or CANCELAR. To access, correct or delete your data, ask the company directly; if the request reaches us through the form in section 18, we forward it to the company.
18. How to exercise your rights, and response times
Open a request in our public privacy form, stating the right you wish to exercise and the data that allows us to locate your record. The form requires no sign-up and no login — it also serves people who are not customers and those who have already closed their account — and returns a ticket number so you can follow its progress.
If you have an active account you may instead open the request through the service center, under the Privacy and LGPD category. It is the same flow and the same deadline.
Confirmation that processing exists and access in simplified format are provided immediately. The clear and complete statement, with the origin of the data, the criteria and the purpose of processing, is provided within 15 (fifteen) days, as required by article 19 of the LGPD.
We may request additional information to confirm the requester's identity before fulfilling the request — a protection for the data subject themselves — and the period then runs from that confirmation.
Manifestly excessive or repetitive requests may be refused with justification, and the reason explained.
19. Data protection officer and communication channel
WiseData Business LTDA qualifies as a small-scale processing agent under ANPD Resolution 2 of 27 January 2022.
Under article 11, § 1, of that Resolution, a small-scale processing agent is not required to appoint a data protection officer, provided it offers a communication channel with the data subject. Article 7 of the same Resolution allows that service to be provided by electronic means, as long as LGPD rights are ensured and access to information is made easy.
Our official channel is the public privacy request form, open to anyone, with no sign-up and no login. We chose a form over an e-mail address precisely because of that ease of access: the request gets a ticket number, stays traceable and is routed internally without depending on someone watching an inbox.
Requests received through that channel are handled by an internally designated person, who responds within the deadlines in section 18.
Should the Licensor cease to qualify as a small-scale agent, we will formally appoint a data protection officer and their identification will appear in this section.
21. Communications and anti-fraud
We send transactional communications required by the relationship, such as registration confirmation, billing notices and security notifications. These do not depend on consent and cannot be turned off while the account is active.
Marketing communications depend on consent and may be cancelled at any time through the unsubscribe link in each message.
We may analyze usage patterns to identify abuse, fraud or improper automated use, based on the legitimate interest of protecting the Platform and other customers.
To check the truthfulness of a registration and to prevent parallel accounts created to work around limits or blocks, we cross-reference signals such as tax ID, e-mail, phone, payment method, IP address and device characteristics. We may request documentary proof before releasing or reactivating access. This processing is limited to that purpose and feeds no commercial profile or advertising.
A block resulting from that check is always reviewable by a person, as set out in section 12.
22. Changes to this policy and governing law
We may update this Policy from time to time. The most recent version will always be available on this page, with a version number and date. For material changes, we will notify you by e-mail or by a notice inside the Platform.
This Policy is governed by Brazilian law. The courts of the District of Goiânia, State of Goiás, Brazil, are elected to settle any disputes, except for the courts of the domicile of an individual consumer data subject.