Privacy Policy

Last updated: October 2, 2026 · Version 2.0. This is the reference version. A Portuguese translation is available.

1. Who is responsible

For data about our customers (account holders), CONECTEAI SOLUÇÕES EM TECNOLOGIA LTDA is the controller. For personal data of our customers' contacts processed inside the Service, the customer is the controller and we act as processor, following the customer's instructions and these policies. Data protection contact (DPO): contato@conecte.ai.

2. Data we process

• Account data: name, email, password (stored only as a salted PBKDF2-SHA256 hash), plan, language and billing status. Card details are collected by Paddle and never reach our servers.
• Contact data (on behalf of the customer): phone number, name when available, conversation history with the agents, tags and custom fields set by the customer, and message status.
• Configuration data: agent settings, knowledge base content, encrypted connection credentials and API keys, privacy settings.
• Usage and security data: system logs, sending records used for auditing and duplicate prevention, IP address and device data.
• Website data: cookies and analytics (Google Tag Manager with consent mode, Microsoft Clarity) and, if you chat with the demo agent on our homepage, the messages you type.

3. Purposes and legal bases

• Providing the Service and billing: performance of contract.
• Security, fraud prevention, abuse detection and enforcement of the Acceptable Use rules: legitimate interest and legal obligation.
• Product analytics and website improvement: consent (cookies) or legitimate interest.
• Improving the agents with irreversibly anonymized conversation data: legitimate interest, with the right to object at any time through the Help section or by email.

We do not sell or rent personal data, and we do not use customer data for advertising.

4. Sub-processors and sharing

We may also disclose data when required by law or by a competent authority.

5. International transfers

Some providers above process data outside Brazil (for example in the United States or the European Union). We rely on the transfer mechanisms permitted by the LGPD and, where applicable, the GDPR, such as standard contractual clauses offered by these providers.

6. Retention and deletion

We keep data while the account is active. Customers can permanently delete conversations, contacts, knowledge bases or the entire account from the dashboard at any time. After an account is closed, data is deleted within 30 days, except records we must keep by law (such as access logs under Brazil's Marco Civil da Internet and billing records).

7. Security

Encryption of credentials and API keys, salted password hashing, HTTPS on all traffic, logical isolation of data per customer and per WhatsApp number, and daily backups. If a security incident creates relevant risk to data subjects, we will notify the affected customers and the authorities as required by law.

8. Your rights

Under the LGPD (art. 18) and, where applicable, the GDPR, you may request confirmation, access, correction, anonymization, portability, deletion, information about sharing, and withdraw consent or object to processing. Contacts of our customers should contact the customer (the controller) first; we will assist the customer and may also answer you directly. Write to contato@conecte.ai. You may also complain to the Brazilian data protection authority (ANPD) or your local authority.

9. Cookies

Our website uses essential cookies (session and login) and, only after you accept the cookie banner, analytics cookies. You can withdraw consent by clearing your browser storage.

10. Children

The Service is not intended for children, and we do not knowingly collect data from people under 18.

11. Changes

We will post updates on this page and notify customers of material changes in advance.