Terms of Service

• Datta: LO SOLUCOES DIGITAIS LTDA, Brazilian company registration (CNPJ) 45.535.063/0001-80, headquartered at Avenida João Batista, nº 451, 2º andar, Centro, Martins Soares/MG, CEP 36.972-000, Brazil, operating under the Agência Datta brand and providing the Platform.
• Customer: the company or person that holds an organization ("account") on the Platform. Each organization's data is isolated from other organizations.
• User: an individual who accesses the Platform on behalf of the Customer, by sign-up or invitation. The same person may belong to more than one organization.
• Lead (or data subject): a person whose data the Customer records or receives on the Platform, such as leads, customers, buyers, group members and people who interact with the Customer on Instagram.
• Customer Data: everything the Customer and its Users enter, import or receive through integrations, including Lead data.

The Platform is a CRM with lead capture, communication and measurement tools. Available modules may vary by plan and by what is enabled for each organization:

• Leads and pipeline: leads, pipeline stages, deals, sales, tags, custom fields, CSV import, duplicate merging and activity history.
• Lists: grouping leads into lists used as campaign audiences.
• Forms: public forms (classic and conversational) that can be embedded on the Customer's website and create or update leads, with bot protection.
• E-mail: e-mail campaigns sent through the Platform's Amazon SES infrastructure from the Customer's own sending domain, with an unsubscribe link, a suppression list and delivery, open and click metrics. It includes an AI-assisted e-mail studio.
• Automations: flows triggered by events (form submitted, lead created, stage changed, sale paid or refunded, e-mail click or unsubscribe, group join or leave, Instagram flow completed, among others) that apply tags, move leads in the pipeline or call webhooks.
• Inbound and outbound webhooks: receiving events from sales platforms and other systems (with presets for Hotmart, Kiwify, Eduzz, Greenn and The Members, plus a generic format) and sending CRM events to endpoints configured by the Customer.
• Tracking and analytics: a script installed on the Customer's website that records visits, sources and events, attributes the journey to the lead once identified and, if the Customer configures it, sends conversions to tools such as Meta (Conversions API), Google Analytics 4 and TikTok. It includes website-to-WhatsApp click tracking and reports.
• WhatsApp groups: managing groups of the WhatsApp number the Customer connects, with join links, distribution across groups, scheduled messages to groups, launches and join/leave metrics.
• Instagram Flows: automated replies to comments on posts of the professional Instagram account the Customer connects, with a public reply and a direct-message conversation designed by the Customer.
• Organization and team: invitations, members, audit log, settings and account deletion.

Datta may add, change or discontinue features. Changes that materially reduce the contracted service will be announced with reasonable notice.

• Users must provide truthful information and keep their credentials confidential. The Customer is responsible for all activity carried out with its Users' credentials.
• Each organization has one owner. All invited members have full access to the organization's data and settings; the Customer decides whom to invite and must remove anyone who should no longer have access.
• Only the owner can transfer ownership and confirm the deletion of the organization, through a link sent to the owner's e-mail.
• Notify Datta immediately of any suspected unauthorized access.
• Anyone using the Platform on behalf of a company represents that they are authorized to accept these Terms for it.

The Customer is responsible for Customer Data and for how it uses the Platform. In particular, the Customer:

• has an appropriate legal basis under the LGPD (for example consent, performance of a contract or legitimate interest) for every Lead data it enters, imports or receives, and informs Leads about this processing;
• sends marketing e-mails only to people who opted in or with whom it has a relationship that allows it, keeps the unsubscribe link and honors unsubscribes, which the Platform records in the suppression list;
• is responsible for the content it sends or publishes through the Platform (e-mails, group messages, Instagram replies and messages, forms), including AI-assisted content, which it must review before sending;
• complies with the terms and policies of the platforms it connects (Meta/Instagram, WhatsApp, sales platforms, advertising and analytics tools);
• discloses the tracking script and cookies on its own website and obtains consent where required;
• handles data subject requests about the data it controls, with Datta's support described in section 14.

You may not use the Platform to:

• send spam, unsolicited messages, purchased lists or lists obtained without a legal basis, or messages that violate WhatsApp's or Meta's rules or the law;
• send Instagram messages outside the windows allowed by Meta, or message people who have not interacted with the Customer's account;
• distribute content that is illegal, misleading, fraudulent or discriminatory, that infringes third-party rights (privacy, image, intellectual property) or that impersonates another person or company;
• process sensitive personal data or data of children and adolescents without a specific legal basis;
• circumvent plan limits, sending limits, automatic pauses or security mechanisms, for example by creating organizations to add up quotas;
• attempt to access other organizations' data, reverse engineer the Platform, test vulnerabilities without authorization or overload the infrastructure.

To protect the sending reputation of all customers, the Platform automatically pauses an organization's e-mail sending when, over the last 7 days and with at least 200 accepted sends, the hard bounce rate reaches 4% or the spam complaint rate reaches 0.2%. Violating this section may lead to the suspension described in section 18.

Integrations are enabled by the Customer and are also subject to each provider's terms. Datta is not liable for unavailability, rule changes or blocks applied by those providers.

6.1 Meta and Instagram

• The Customer connects its own professional Instagram account through Instagram Login and grants the requested permissions. An account can be linked to only one organization at a time.
• The Platform only replies to comments that match the keyword of a flow the Customer itself created and activated, and only on the Customer's account. It does not delete, hide or edit comments and does not comment on its own initiative.
• The private conversation starts with a single private reply per comment, sent within 7 days of the comment. Follow-up messages are only sent within 24 hours of the person's last message. There is also a cap of 700 private replies per hour per connected account.
• When the person interacts in the direct message, the Platform creates or updates the Lead with that person's Instagram ID, name and username.
• Disconnecting the account on the Platform, or removing the app in Instagram's settings, erases the access token, pauses active flows and stops receiving events for that account.

6.2 E-mail (Amazon SES)

E-mails are sent through the Platform's Amazon SES account, from a Customer domain verified through DNS records. Delivery, bounce, complaint and unsubscribe events feed the organization's metrics and suppression list.

6.3 Sales platforms and webhooks

The Customer may configure sales platforms (such as Hotmart, Kiwify, Eduzz, Greenn and The Members) or other systems to send events to the Platform, and register its own endpoints to receive CRM events. Outbound deliveries can be signed with HMAC-SHA256 when the Customer sets a secret. The Customer is responsible for the destination systems and for the data it chooses to send to them.

6.4 WhatsApp

The groups module works with the WhatsApp number the Customer connects through the Evolution API, an unofficial integration that uses the WhatsApp Web protocol and is not provided by Meta. The Platform manages groups and sends messages to the Customer's groups; it does not add people to groups unless they join through a link. WhatsApp may restrict or ban numbers, and the Customer bears that risk.

6.5 Advertising and analytics tools

When the Customer registers a destination tool in tracking (such as Meta, Google Analytics 4 or TikTok), the Platform sends it the configured events and data. These providers process the data under the terms the Customer accepted with them.

This chapter (sections 7 to 16) describes how personal data is processed under Brazil's General Data Protection Law, Law No. 13,709/2018 (LGPD).

• Lead data: the Customer is the controller and Datta is the processor. Datta processes this data only to provide the service, following the Customer's instructions expressed in these Terms and in the settings it makes on the Platform, and does not use it for its own purposes, sell it or share it with other customers.
• User and organization data (sign-up, access, usage and support): Datta is the controller, as described in the Privacy Policy.

In case of conflict regarding the processing of Lead data, these Terms prevail.

• Lead records: name, e-mail, phone, company, custom fields, tags, pipeline stage, deals, sales and notes. Purpose: managing the Customer's relationship with its Leads.
• Form responses and source data (UTMs, page and click identifiers). Purpose: capturing leads and attributing their source.
• Browsing on the Customer's website: pages visited, source, visitor identifier, IP address and user agent. Purpose: reports, journey attribution and sending conversions to the tools the Customer configured.
• E-mail: address, deliveries, opens, clicks, bounces, complaints and unsubscribes. Purpose: sending campaigns, measuring results and honoring unsubscribes.
• WhatsApp: number and name of members of the Customer's groups and join/leave events. Purpose: group management and metrics.
• Sales received by webhook: buyer, product, amount and status. Purpose: recording sales and triggering automations.
• Meta Platform data: described in section 9.
• User data: name, e-mail, organizations they belong to, access and audit records. Purpose: authentication, security and support.

When the Customer uses Instagram Flows, the Platform processes:

• for the connected account: Instagram ID and username, profile picture, list of recent posts (so the Customer can choose which post a flow applies to) and the access token, stored encrypted;
• for people who comment or chat: Instagram ID, name and username, the comment text, the messages and the options chosen in the conversation.

This data is used exclusively to run the flows the Customer created, record the Lead in the Customer's CRM and show the flow's results. It is not used for advertising, is not sold and is not shared with third parties other than the subprocessors in section 10. Deletion of this data is described in section 14.

The Customer authorizes Datta to use the following subprocessors to provide the service:

• Supabase: user authentication, file storage and, during the transition to each account's own database, the database (Postgres) of accounts not yet transferred (eu-central-1 region, Frankfurt, Germany).
• Hetzner Online GmbH: application server, managed with Coolify, running the web application, the background workers and each account's database (Postgres), one separate database per account (Falkenstein, Germany).
• Amazon Web Services (Amazon SES): sending campaign and system e-mails.
• Resend: sending authentication e-mails (sign-up and sign-in confirmation).
• Cloudflare: bot protection (Turnstile) on public forms, storage of database backups (R2) and, when enabled, reading the Customer's website for the e-mail studio (backups: European Union).
• Anthropic: e-mail generation in the AI studio (Claude models), based on the User's request and the campaign and website information.
• OpenRouter: transcribing the voice request in the AI studio; the audio is not stored.
• Upstash: request rate limiting, for security.
• Sentry: error monitoring.
• PostHog: product usage analytics.
• Meta Platforms: delivering the replies and messages of Instagram Flows and, when the Customer enables it, receiving events through the Conversions API.
• Evolution API: connection to the Customer's WhatsApp number.
• Google (Google Analytics 4 and Google Ads): receiving events and conversions, when the Customer enables these tools in Tracking.
• TikTok: receiving events and conversions, when the Customer enables this tool in Tracking.

The AI studio does not receive the Customer's Lead base; Users must not include Leads' personal data in their requests.

International transfers. The Platform is hosted by cloud providers located outside Brazil (currently in the European Union and the United States), and other subprocessors may also process data outside Brazil. Personal data processed on the Platform is therefore transferred abroad. These transfers rely on article 33 of the LGPD:

• they are necessary to perform the contract with the Customer and provide the service it subscribed to (art. 33, IX, together with art. 7, V, for User data) and, for Lead data, follow the instructions of the Customer as controller, which must have its own legal basis for the transfer;
• they are made to providers that undertake, in the terms and data processing agreements they offer, confidentiality and security obligations compatible with the LGPD (art. 33, II); Datta will adopt the standard contractual clauses approved by Brazil's data protection authority (ANPD) where required.

The same grounds apply to every country where subprocessors are located, including the European Union and the United States. Datta may change subprocessors or the hosting region and will update this list on this page.

Customer Data is kept while the organization exists or until the Customer deletes it. Technical records and history are deleted automatically within these periods:

• inbound and outbound webhook history: 90 days;
• control records of resolved sends (automations and outbound webhooks) and of processed inbound events: 30 days;
• website tracking events (with IP and user agent) and their deliveries to tools: 90 days;
• analytics page records: about 90 days (deleted per month, once the whole month is older than 90 days); unidentified sessions and visitors: 13 months;
• history of finished automation runs: 90 days;
• Instagram: events received from Meta and send records, 30 days; flow records (results), 90 days; the conversation session expires 24 hours after the last interaction and is deleted;
• form sessions: expire 1 day after completion, or 7 days after start if not completed;
• organization deletion confirmation link: 24 hours.

Unsubscribed or bounced addresses stay on the organization's suppression list so they never receive campaigns again; if the Lead is deleted, the address is kept only as a hash. Data may also remain for a limited time in the database provider's backups until they are overwritten in the normal cycle.

• per-organization isolation in the database with Row-Level Security (RLS): every query is limited to the User's organization;
• AES-256-GCM encryption of stored credentials, such as Instagram, WhatsApp, tracking tool and webhook tokens;
• encrypted connections (HTTPS), User authentication, rate limiting and bot protection on public forms;
• an audit log of actions in the organization and removal of personal data from error reports.

No system is completely immune to failures, and the Customer must also protect its Users' credentials.

If Datta becomes aware of a security incident affecting Customer Data, it will notify the Customer without undue delay, with the available information about the nature of the incident, the data affected and the measures taken, and will cooperate so the Customer, as controller, can make the notifications to the ANPD and to data subjects required by article 48 of the LGPD.

Data subjects have the rights in article 18 of the LGPD (confirmation, access, correction, anonymization, blocking or deletion, portability, information about sharing and withdrawal of consent). Since the Customer is the controller of Lead data, the data subject should first reach the company they dealt with. The Platform provides the Customer with:

• Lead deletion, individually or in bulk, with the option to record that it fulfills a data subject request. Deletion erases the record and anonymizes the person's trail in the organization (name, e-mail, phone, IP and user agent are removed; aggregate report figures remain);
• one-click e-mail unsubscribe in every campaign;
• viewing, correcting and exporting Lead data on the Platform itself.

Instagram data: a person can request deletion of their data through Instagram. Meta sends the request to https://crm.agenciadatta.com.br/api/webhooks/instagram/data-deletion, and the Platform deletes that person's conversation sessions, received events and flow records, unlinks the Instagram ID from Leads and returns a confirmation code. Other Lead data in the Customer's CRM is deleted when the Customer deletes the Lead.

Data subjects and Customers can also write to [email protected]. If the request concerns data controlled by a Customer, Datta will forward it to the Customer and support the response.

Datta only discloses Customer Data to public authorities under a valid court order or legal requirement, limiting the response to what is strictly required. Where the law allows, it will notify the Customer beforehand so it can respond.

• Any member can request deletion of the organization in Settings › Account; the owner confirms it through the link sent to their e-mail, valid for 24 hours.
• Once confirmed, deletion is final: it erases the organization's data (leads, deals, sales, forms, campaigns, automations, webhooks, tracking and flows), stored files and the WhatsApp instances created by the Platform, and stops receiving events for connected Instagram accounts. The data cannot be recovered afterwards.
• Before deleting, the Customer should export anything it wants to keep.
• Datta may keep, for the legal period, data it is required by law to retain, such as application access logs (Brazilian Internet Civil Framework, art. 15).

Each organization has a plan that sets usage caps:

• Every lead in the organization counts toward the lead cap. The e-mail month follows Brasília time, and Datta may set a specific sending cap for an organization.
• When a cap is reached, creating new items of that type is refused until there is room or the plan changes. Leads received by webhook above the cap are recorded as blocked and can be reprocessed later.
• Each organization's plan is set by Datta. Price, billing period and payment method, when applicable, are set out in the commercial proposal or contract; the Platform does not process Customer payments.
• Datta may change plans and caps, giving affected Customers reasonable notice.

The Customer may stop using the Platform at any time by deleting the organization (section 16). Datta may suspend or terminate access, in whole or in part, for breach of these Terms or the law, non-payment of agreed amounts, risk to the Platform's security or sending reputation, or an order from an authority. Whenever possible, Datta will give prior notice and time to fix the issue; in serious or urgent cases, suspension may be immediate.

The Platform, its brand, code and design belong to Datta or its licensors. The Customer receives a limited, non-exclusive, non-transferable and revocable license to use it while these Terms are in force. Customer Data and the content the Customer creates, including AI-assisted e-mails, belong to the Customer.

Datta strives to keep the Platform available and secure, but it is provided as is, without a warranty of uninterrupted or error-free operation. Integrations depend on third parties that may change or interrupt their services.

To the extent permitted by law, Datta is not liable for lost profits, indirect damages, loss of opportunity, blocks applied by third parties (such as Meta, WhatsApp or e-mail providers), or data processing carried out by the Customer in breach of the law or these Terms. Datta's total liability is limited to the amount paid by the Customer in the 12 months before the event, except where the law prohibits such a limitation. The Customer is liable for damages it causes to Datta or third parties through misuse of the Platform.

Datta may update these Terms. The current version is always on this page, with its update date. Material changes will be communicated to the Customer at least 15 days in advance; continued use after that means acceptance of the new version.

These Terms are governed by the laws of the Federative Republic of Brazil. The courts of Manhumirim/MG, Brazil, are chosen as the venue, except where the law grants the Customer another venue, such as the consumer's domicile.

Questions, personal data requests and notices about these Terms: [email protected]. LO SOLUCOES DIGITAIS LTDA, CNPJ 45.535.063/0001-80, Avenida João Batista, nº 451, 2º andar, Centro, Martins Soares/MG, CEP 36.972-000, Brazil.