Leia em português → · How to request deletion of your data →
This is a translation provided for convenience. In case of any divergence, the Portuguese version prevails.
This Policy explains, in plain terms, what personal data the MobiVendas+ platform processes, how, for what purpose, with whom it shares it, how long it keeps it and how you can request its deletion. It follows the LGPD (Brazilian General Data Protection Law, Law No. 13,709/2018), the Brazilian Internet Civil Framework (Law No. 12,965/2014) and the Meta Platform Terms.
- MobiVendas+ is a CRM that brings together companies’ customer service over WhatsApp and Instagram. Radar is our ad conversion measurement product. This Policy applies to both.
- The messages and contacts of the customers of the companies that hire us belong to those companies. We process them on their behalf and according to their instructions — they are the controllers; we are processors.
- The data we receive from Meta (WhatsApp Business Platform and Instagram) is used solely to operate the customer service of the company that connected it. We do not sell it, do not use it for advertising, do not build profiles and do not use it to train artificial intelligence. The only exception is Radar, when contracted: the ad click identifier and the hashed phone number are sent only to the customer’s own dataset at Meta, through the Conversions API, to measure the customer’s ads (section 5).
- Anyone, in any country, can request the deletion of their data. See how in section 13.
The Platform consists of:
crm.mobivendasplus.com.br;radar.mobivendasplus.com.br, which can be contracted together with the CRM or separately;This Policy applies to:
| You are… | What this Policy covers |
|---|---|
| Customer — a company that contracts the Platform | Registration, contract, billing and usage data |
| User — a person on the customer’s team who accesses the dashboard | Access, profile and activity data on the Platform |
| Contact — a person who talks to a customer via WhatsApp or Instagram | Data processed by us on behalf of the customer |
| Visitor to our public pages | Cookies and forms |
It applies to everyone who uses or is reached by the Platform, regardless of the country they are in. The data is processed in Brazil and by the providers listed in section 9.
The LGPD distinguishes between who decides about the data (controller, art. 5, VI) and who processes it on behalf of another (processor, art. 5, VII). We play both roles, in relation to different data.
In these cases the customer is the controller: it is the customer who decides what the data is used for, for how long and under which legal basis, and who maintains the relationship with the contact.
If you talked to a company that uses MobiVendas+ and want to access, correct or delete your data, the fastest way is to ask that company directly. If you contact us, we will apply art. 18, § 4, I of the LGPD: we will inform you that we are not the controller, identify the responsible company whenever possible and give it full technical support to fulfil your request.
| Agent | Is responsible for |
|---|---|
| We, as controller | Legal bases and lawfulness of the processing in section 6, data security, handling data subject requests, and notifying incidents to the Brazilian National Data Protection Authority (ANPD) and to data subjects |
| We, as processor | Processing the data only according to the customer’s lawful instructions, keeping it secure and isolated from other customers’ data, notifying the customer of incidents and helping it respond to data subjects. We are jointly and severally liable if we breach the law or those instructions (art. 42, § 1, I) |
| Customer, as controller | Legal basis, lawful origin of the contact base, content of the messages, informing contacts and fulfilling their rights |
| Meta and other recipients | The processing they carry out for their own purposes, as independent controllers, under their own policies |
This section describes specifically the data we receive from Meta’s platforms through the MobiVendas app, when a customer connects its WhatsApp Business or Instagram account to the Platform through Meta’s official login and signup flow.
The customer starts the connection within the dashboard. Meta opens its own authorization screen, where the customer chooses the accounts it wants to connect, sees the list of requested permissions and decides whether or not to grant them. Without this authorization, we do not receive any data from Meta. The customer can revoke access at any time (section 13).
| Meta permission or feature | Data we receive | What we use it for |
|---|---|---|
| Login and embedded signup (Facebook Login for Business / Embedded Signup) | Identifiers of the business portfolio, of the WhatsApp Business account and of the phone number; access token granted by the customer | Link the customer’s account to the Platform and act on its behalf |
whatsapp_business_management |
WhatsApp Business account and phone number data: display name, status, quality rating and messaging limits; the customer’s message templates: content, category, language and approval status | Display and manage the customer’s account and message templates in the dashboard |
whatsapp_business_messaging |
Messages sent and received by the customer’s number — text, audio, image, video, document, location and other content the contact chooses to send; the contact’s WhatsApp number and profile name; sent, delivered and read status; date and time; and, when the conversation starts from a click-to-WhatsApp ad, the ad referral data | Display the conversations in the CRM, allow the customer’s team to reply, keep the service history and run the automations the customer configures; and, if the customer contracts Radar, record the leads coming from ads and send the conversions to the customer’s dataset (section 5) |
instagram_business_basic |
Identifier, username and profile picture of the customer’s Instagram professional account | Identify the connected account |
instagram_business_manage_messages |
Direct messages sent and received by the customer’s account; the sender’s identifier, username and, when available, name and profile picture; date and time | Display the conversations in the CRM, allow the customer’s team to reply and run the automations the customer configures |
Meta, as the provider of the WhatsApp Business Platform and of Instagram, also processes these messages on its own infrastructure, under the terms and privacy policy that the customer accepts directly with Meta: Meta Privacy Policy.
In addition to the data in section 3, the CRM stores what the customer and its team record, always on behalf of the customer:
| Data | Source |
|---|---|
| Contact records: name, phone number, email, company and custom fields | Entered or imported by the customer |
| Deals, amounts, pipeline stages, tags, tasks and notes | Recorded by the customer’s team |
| Messages and media from messaging channels connected by the customer through other connection methods made available on the Platform | The customer’s conversations with its contacts |
| Group conversations, when the customer connects groups to the CRM | Groups in which the customer’s number participates |
| Service records: assignee, timestamps and response times | Generated by the customer’s operations |
What we do not do: we do not use this data for our own purposes, we do not cross-reference it between customers, we do not sell it and we do not use it to train artificial intelligence models.
When the customer connects groups, the CRM also receives messages from participants who are not its direct contacts. It is up to the customer to decide which groups to connect and to inform the participants, as controller of this data.
Conversations may contain, without the Platform requesting it, information that the LGPD considers sensitive (art. 5, II), such as health data or religious beliefs. The legal basis for processing it (art. 11) lies with the customer, as controller; we advise customers not to request this type of information through messaging channels.
Radar shows the customer how many conversations and sales came from its ads and reports these results to Meta, so that the customer’s campaigns are measured and optimized with real data.
ctwa_clid) and ad referral data. Radar records this contact as a lead from that ad.LeadSubmitted for the lead and Purchase for the sale) to the customer’s own dataset (pixel), through Meta’s Conversions API.For each lead: phone number, profile name, click identifier, ad identification and title, date of the first contact and of the first reply, and message count. For each conversion: date, event type, value, currency, product name and transaction identifier, as well as a record of Meta’s response to each submission.
Messages that do not come from ads and that do not contain confirmation phrases are not stored by Radar. They pass only through the temporary technical processing logs described in section 10.
The event type, the date and time, the click identifier, the page identifier, the contact’s phone number with a cryptographic hash (SHA-256) and, for sales, the value, currency, product name and transaction identifier.
We do not send Meta the text of conversations, audio, images, documents or contact lists.
About the hash. Hashing the phone number is a security measure, not anonymization. The data remains personal data under the LGPD (arts. 5, III; 12; and 13, § 4), because Meta is able to match it against its own database. We do not claim that this data is anonymous.
Radar operates at the customer’s request and according to its instructions: it is the customer who contracts the service, defines the confirmation phrases and how the value is captured, and authorizes access to the dataset of its own ad account. The technical setup is done by our team, at the customer’s request and according to those instructions. Events are sent only to the customer’s own dataset; we do not use them for our own purposes.
Sending events uses the authorization that the customer grants to the dataset of its ad account — it does not use the permissions in section 3.2. The corresponding access token is kept in an area restricted to the system, is never displayed in the dashboard and is deleted when Radar is terminated.
Therefore, for Radar data, the customer is the controller and we are processors. Meta, upon receiving the events, also processes them for its own measurement and optimization purposes, as an independent controller.
The customer may request to pause or terminate the sending at any time, effective within 1 business day.
| Data | Purpose | Legal basis (LGPD) |
|---|---|---|
| Corporate name, CNPJ, address, name, email and phone number of the contracting customer | Create and maintain the account, provide the service and support, send operational notices | Performance of a contract — art. 7, V |
| Name, email, access profile and activity logs of the users designated by the customer | Create individual credentials, control permissions and maintain account security | Legitimate interest — art. 7, IX (art. 7, V when the customer is a natural person and is the user themself) |
| Payment data and invoice history | Billing, issuing tax invoices and tax obligations | Performance of a contract and legal obligation — art. 7, V and II |
| Application access logs: date, time and IP | Mandatory retention of access logs | Legal obligation — art. 7, II, combined with art. 15 of the Internet Civil Framework |
| Usage and security logs | Prevent fraud and abuse, investigate incidents and protect the Platform | Legitimate interest — art. 7, IX |
| Dashboard usage metrics (features accessed, performance), without using the content of conversations or data obtained from Meta | Improve the product | Legitimate interest — art. 7, IX |
| Name, email and message of people who talk to our sales team | Respond and present a proposal | Pre-contractual steps — art. 7, V |
| Customers’ email and relationship history | Announcements about Platform updates, with an unsubscribe option in every message | Legitimate interest — art. 7, IX |
| Data necessary for defense in legal proceedings | Regular exercise of rights in legal proceedings | art. 7, VI |
You may object to processing based on legitimate interest (section 12).
The Platform offers features that use artificial intelligence models, such as the CRM’s AI agent, configured by the customer itself, and the automatic identification of value and product in Radar confirmation messages.
| Recipient | What for |
|---|---|
| Meta Platforms, Inc. and WhatsApp LLC | Send and receive messages on behalf of the customer; receive Radar conversion events in the customer’s dataset |
| Cloud infrastructure and database — Supabase Inc. and Hostinger International Ltd. | Host the Platform and store the data |
| Messaging channel connectivity providers | Connect the channels chosen by the customer |
| Artificial intelligence model providers — OpenAI, L.L.C. | Run the AI features described in section 7 |
| Payment provider — Asaas Gestão Financeira S.A. | Process subscription charges |
| Support and operations tools | Serve customers and operate the service |
| Meta (as a platform) | List of our customers, when required by the Meta Platform Terms |
| Authorities | Comply with a court order or legal request. Content of private communications and access logs only upon a court order (Internet Civil Framework, arts. 10 and 15) |
| Successors | In a corporate reorganization, merger or acquisition, with the same obligations maintained |
The named, up-to-date list of all suppliers that process personal data may be requested at any time by email at privacidade@mobivendasplus.com.br (art. 18, VII). All of them are contractually bound to protect the data and to use it only according to our instructions.
We do not sell personal data.
Some of the recipients are located outside Brazil (arts. 33 to 36 of the LGPD):
| Recipient | Country | Basis |
|---|---|---|
| WhatsApp LLC (WhatsApp Business Platform) | United States | Standard contractual clauses of ANPD Resolution CD/ANPD No. 19/2024, incorporated into the WhatsApp Data Transfer Addendum accepted by the customer |
| Meta Platforms, Inc. (Instagram and Conversions API) | United States | Data transfer terms adopted by Meta, accepted by the customer directly with Meta |
| OpenAI, L.L.C. (artificial intelligence models) | United States | Standard contractual clauses of ANPD Resolution CD/ANPD No. 19/2024 — formalization with the provider in progress |
| Supabase Inc. (database, with data hosted in São Paulo) | United States | Standard contractual clauses of ANPD Resolution CD/ANPD No. 19/2024 — formalization with the provider in progress |
| Hostinger International Ltd. (servers in São Paulo) | Cyprus — European Union | Adequate level of protection recognized by ANPD Resolution CD/ANPD No. 32/2026 |
When we act as processor, transfers follow the instructions of the controller customer, recorded in the contract with the customer (Terms of Use, in Portuguese). You may request, free of charge, a copy of the applicable clauses, subject to commercial and industrial secrets, by email at privacidade@mobivendasplus.com.br.
| Data | Period |
|---|---|
| CRM conversations, contacts and records | While the contract is in force — the history is part of the service. Deletion after termination, as set out in section 13 |
| Access token and identifiers obtained from Meta | While the connection is active; up to 30 days after disconnection |
| Radar leads and conversions | While the Radar contract is in force; deletion after termination, as set out in section 13 |
| Temporary technical logs and copies kept by the channel integration and message processing systems | Up to 14 days |
| Application access logs (date, time and IP) | 6 months — Internet Civil Framework, art. 15 |
| Customer registration, contract and invoices | Term of the contract and 5 years after its end — Civil Code, art. 206, § 5, I |
| Tax documents | 5 years — tax legislation |
| Security incident records | 5 years — ANPD Resolution CD/ANPD No. 15/2024, art. 10 |
| Sales contacts with no active relationship | 24 months without interaction |
| Database backup copies (backups) | Automatic rotation within 7 days |
Backup copies do not allow the deletion of an individual record: data deleted from the active database leaves the backups at the next rotation and, until then, is blocked from any use other than disaster recovery. When the law requires us to retain any data, we also keep a record of the legal basis for that retention.
We adopt technical and administrative measures consistent with art. 46 of the LGPD, including:
Incidents. When we act as controller and an incident may cause relevant risk or damage, we notify the ANPD and the affected data subjects within 3 business days of becoming aware of it, with the content set out in arts. 6 and 9 of ANPD Resolution CD/ANPD No. 15/2024 — a period that is doubled if we qualify as a small-sized processing agent. When we act as processor, we notify the controller customer within 24 hours, with the information necessary for it to fulfil its own duty to notify.
You may, free of charge and at any time, exercise the rights under art. 18 of the LGPD: confirmation that we process your data, access, correction, anonymization, blocking or deletion of data that is unnecessary or processed in non-compliance with the law, portability, deletion of data processed with consent, information about with whom we share data, information about the possibility of not consenting, revocation of consent and objection to processing based on legitimate interest.
How to exercise them: write to privacidade@mobivendasplus.com.br. We may ask for information to confirm your identity — this is a safeguard for your benefit.
Timeframe: confirmation of existence and access are provided immediately in simplified format, or within 15 days by means of a complete statement (art. 19). Other requests are handled within 15 days, extendable once upon justification. Deletion requests follow the timeframes in section 13.
These rights, including the right to deletion, are available to anyone, in any country.
You may also file a petition with the Brazilian National Data Protection Authority (ANPD) — gov.br/anpd — and with consumer protection agencies.
Anyone may request the deletion of their data, regardless of the country they are in. Choose your case:
Send an email to privacidade@mobivendasplus.com.br from the address registered on the account, with the subject “Data deletion” (or “Exclusão de dados”), stating the corporate name and CNPJ.
| Step | Timeframe |
|---|---|
| Acknowledgment of receipt, with a reference number | within 2 business days |
| Window for you to export your data | 30 days |
| Permanent deletion from the active database | within 30 days after the window — 60 days in total |
| Removal from backup copies | at the next rotation, within 7 days |
During the window, you may request the export of your data. If you do not need to export anything, say so in your request: deletion from the active database is carried out within 30 days.
End of contract without a request. If the contract ends for any reason — cancellation, non-payment or discontinuation of the Platform — or if Meta so requests, we delete the customer’s data, including data obtained from Meta, within these same timeframes, without the need for a request.
You can revoke our access at any time, without depending on us:
When you disconnect, our access stops working immediately, we stop receiving data and delete the access token and the identifiers obtained from Meta within 30 days. The conversation history already received remains available to you until the account is closed; if you also want it deleted, request it at privacidade@mobivendasplus.com.br. Your WhatsApp Business and Instagram accounts remain yours — disconnecting only removes our access.
Ask your company’s account administrator to remove your access, or write to privacidade@mobivendasplus.com.br and we will forward the request.
The company you talked to is the controller of your data, and the fastest way is to make the request directly to it. If you prefer, write to privacidade@mobivendasplus.com.br stating the phone number or Instagram profile used and, if you know it, the company’s name. We acknowledge receipt within 2 business days, forward the request to the company and give it the technical support necessary to fulfil it (art. 18, § 4, I of the LGPD). If the company cannot be identified or is no longer our customer, we delete the data linked to your number or profile within 30 days, unless there is a legal obligation to retain it.
Even after deletion, we keep, blocked from any other use: application access logs for 6 months (Internet Civil Framework, art. 15), tax documents for 5 years (tax legislation), security incident records for 5 years (ANPD Resolution CD/ANPD No. 15/2024) and contractual documents for 5 years, for the regular exercise of rights (art. 7, VI of the LGPD). None of these records contains the content of conversations.
In the Platform dashboard we use only necessary cookies: the session cookie, which keeps you logged in and is shared between the crm. and radar. addresses of the mobivendasplus.com.br domain, and preference and security cookies. Without them, the Platform does not work; that is why they are based on legitimate interest (art. 7, IX).
We do not use advertising cookies in the dashboard. If we adopt measurement or advertising cookies on the public pages, they will only be activated after your consent, which may be refused with the same prominence as acceptance and changed at any time.
The Platform is not intended for persons under 18 years of age as customers or users. We do not knowingly collect data from children and adolescents. In compliance with art. 14, § 2 of the LGPD:
It is up to the customer, as controller, to verify the age of its contacts when the context requires it and to obtain the consent of one of the parents or the legal guardian in the cases of art. 14, § 1.
Material changes are communicated by email to customers and by a notice in the dashboard 30 days in advance, except those required by law or by an authority, which may take effect immediately. Each version is published with its date, and previous versions may be requested by email at privacidade@mobivendasplus.com.br.
Version 1.0 — October 3, 2026: first publication.
| Subject | Channel |
|---|---|
| Privacy and data subject rights — Data Protection Officer (Encarregado) Hugo Startsi de Abreu | privacidade@mobivendasplus.com.br |
| Support, issues using the Platform, reporting improper messages or abuse, and reporting security vulnerabilities | privacidade@mobivendasplus.com.br |
| Address | Avenida Jerônimo Monteiro, 1000, Edifício Trade Center, salas 1501 e 1503, Centro, Vitória/ES, CEP 29010-002, Brazil |
| Brazilian National Data Protection Authority | gov.br/anpd |
H S DE ABREU STARTSI DIGITAL — CNPJ 23.127.488/0001-18
Related documents: Terms of Use (Portuguese) · Política de Privacidade (português)
H S DE ABREU STARTSI DIGITAL — CNPJ 23.127.488/0001-18 · Data Protection Officer: Hugo Startsi de Abreu — privacidade@mobivendasplus.com.br