Privacy Policy

The Platform is operated by LO SOLUCOES DIGITAIS LTDA, Brazilian company registration (CNPJ) 45.535.063/0001-80, doing business as Agência Datta ("Datta", "we"). Data Protection Officer (DPO): [email protected].

Address: Avenida João Batista, nº 451 – 2º Andar, Bairro Centro, Martins Soares/MG, CEP 36.972-000, Brazil.

Datta CRM is a multi-company tool. It is essential to distinguish two scenarios:

• Data about your account and organization (registration, billing, use of the Platform): Datta acts as the Controller.
• Data about your leads that you enter, import or receive through integrations: your organization is the Controller of that data and Datta acts as the Processor, processing it solely to run the Platform and under your instructions. You are responsible for having an adequate legal basis (e.g. consent, performance of a contract or legitimate interest) to process the third-party data you load into the Platform.

• Registration and account data: name, email, organization name, invited team members and access credentials (managed by Supabase's authentication service).
• Data you enter: leads, deals, lists, tags, conversations, sales, email campaigns and any other information you create, import or receive on the Platform.
• Native form data: answers submitted through forms published by your organization (including partial answers to conversational forms), a record of the consent given in the form and visit source data (UTMs, fbclid, gclid and similar).
• Tracking and lead journey data: when your organization installs the Datta CRM tracking script on its websites, we record pages visited, visit source, events, a visitor identifier and, when the visitor identifies themselves (for example, by submitting a form), email, name and phone number, to link the browsing history to the lead.
• Technical and usage data: IP address, device/browser identifiers, access logs, actions performed and error reports (for security and product improvement).
• Data from integrations you connect: WhatsApp (via Evolution API), Instagram (messages, comments and public profile of people who interact with the connected account), Meta (Conversions API), Google Analytics 4, TikTok and external systems connected through inbound and outbound webhooks.

• Providing and operating the Platform (including sending system emails and the campaigns you configure) — basis: performance of a contract.
• Authentication, security and prevention of fraud and abuse (including anti-bot verification on public forms and rate limiting) — basis: legitimate interest and compliance with a legal obligation.
• Artificial intelligence features (for example, the email creation studio), which send to the AI provider the content you provide in the conversation and, when you point to a website, that website's public content — basis: performance of a contract.
• Source attribution, analytics and lead journey on your organization's websites — basis defined by your organization as the Controller (as a rule, the visitor's consent or legitimate interest).
• Sending events and conversions to advertising and analytics platforms (Meta, Google Analytics 4, TikTok), when you enable these integrations — basis: consent and/or the Controller's (your organization's) legitimate interest.
• Support, communication and product improvement (usage metrics and error monitoring) — basis: legitimate interest.
• Compliance with legal and regulatory obligations — basis: legal obligation.

We do not sell personal data. We share data only with providers that make the Platform possible (sub-processors), which process the data according to our instructions and security standards:

• Supabase — user authentication, file storage and, during the transition to each account's own database, the database (Postgres) of accounts not yet transferred (eu-central-1 region, Frankfurt, Germany).
• Hetzner Online GmbH — application server, managed with Coolify, running the web application, the background workers and each account's database (Postgres), one separate database per account (Falkenstein, Germany).
• Amazon Web Services (Amazon SES) — sending campaign and system e-mails.
• Resend — sending authentication e-mails (sign-up and sign-in confirmation).
• Cloudflare — bot protection (Turnstile) on public forms, storage of database backups (R2) and, when enabled, reading the Customer's website for the e-mail studio (backups: European Union).
• Anthropic — e-mail generation in the AI studio (Claude models), based on the User's request and the campaign and website information.
• OpenRouter — transcribing the voice request in the AI studio; the audio is not stored.
• Upstash — request rate limiting, for security.
• Sentry — error monitoring.
• PostHog — product usage analytics.
• Meta Platforms — delivering the replies and messages of Instagram Flows and, when the Customer enables it, receiving events through the Conversions API.
• Evolution API — connection to the Customer's WhatsApp number.
• Google (Google Analytics 4 and Google Ads) — receiving events and conversions, when the Customer enables these tools in Tracking.
• TikTok — receiving events and conversions, when the Customer enables this tool in Tracking.
• External systems you designate — outbound webhook destinations and inbound webhook sources configured by your organization.

We may also share data to comply with court orders or legal requirements.

The Platform is hosted by cloud providers located outside Brazil (currently in the European Union and the United States), and several of the providers above may process data outside Brazil, including in the United States. In those cases, the transfer relies on the grounds of LGPD art. 33, such as contractual clauses adopted by the providers and the need to perform the contract with you.

On the Platform, we use strictly necessary cookies for authentication (session) and usage metrics cookies (PostHog). You can manage them in your browser settings; disabling essential cookies may prevent sign-in.

On the websites of client organizations that install the tracking script, cookies and local storage may be written to identify the visitor (_dtv, up to 365 days), store the visit source (_dtc, up to 90 days), store data the visitor provided themselves (email, name and phone number, up to 365 days) and read or create identifiers of the enabled advertising platforms (for example, _fbp, _fbc, _ga and _ttp). The client organization is responsible for informing its visitors and obtaining any required consent.

• Account data and data entered by the organization: while the account is active;
• Detailed browsing records (analytics): about 90 days; visit sessions: about 13 months;
• Automation execution history: about 90 days;
• Technical and error logs: for the period set by the respective providers and as needed for security.

Deletion of the organization's account is requested on the Platform and confirmed by the account owner by email. After confirmation, the organization's data is deleted or anonymized, except where retention is required by law. After deletion, a backup copy of the account may be kept for up to 30 days, only for recovery in case of error, and is then erased; the periodic backups also expire within 30 days. When a person asks for their data to be deleted, the organization can delete the lead and notify connected systems using only the lead's code.

As a data subject, you may at any time request:

• Confirmation that processing exists and access to the data;
• Correction of incomplete, inaccurate or outdated data;
• Anonymization, blocking or deletion of unnecessary data or data processed in breach of the law;
• Portability of the data to another provider;
• Deletion of data processed on the basis of consent;
• Information about sharing and withdrawal of consent;
• Review of decisions made solely on the basis of automated processing.

To exercise your rights, write to [email protected]. If your request concerns data processed by a client organization (which is the Controller), we may forward it to that organization. Instagram users can also request deletion through Facebook/Instagram itself, and the request reaches the Platform automatically.

We adopt technical and organizational measures to protect data, including per-organization isolation (multi-tenant), access control, Row-Level Security in the database, encryption of integration credentials and tokens (AES-256-GCM), anti-bot verification and rate limiting on public endpoints. No system is completely immune to incidents; in the event of a relevant incident, we will take the measures and make the notifications required by the LGPD.

We may update this Policy from time to time. The current version will always be available on this page, with the date of the last update. Relevant changes may be communicated through the Platform's channels.

This Policy is governed by the laws of the Federative Republic of Brazil, in particular the LGPD (Law No. 13,709/2018). The courts of the data subject's domicile are chosen to settle any disputes, where applicable.