Privacy Policy

Data we process

To provide the service, we process: the lead's name and phone number (contact received by your team), and the content of conversations exchanged with the AI SDR and with human agents (text and, when sent as audio, the transcript). We also process registration data of those who use the dashboard (name, email) for authentication and invoicing.

TECHNICAL ACCESS DATA. When someone on your team expressly accepts the Terms of Use in the dashboard, we store, together with the account, the user, the version accepted and the date and time, the IP ADDRESS from which the acceptance came and the identification of the browser or device (USER AGENT). This is not audience measurement or a browsing profile: it is evidence of authorship of the act, under the standard of Provisional Measure (MP) 2,200-2/2001 and Law 14,063/2020 — without it, an electronic acceptance does not prove who accepted, and it is precisely the proof that the resale contract requires to exist for the end customer. The IP address is personal data and is declared as such here.

BUSINESS INDUSTRY. When you enter your industry under “Other industry” and ask the AI to build the template, the text you wrote and the generated template are stored so we can improve the platform's industry templates, with no personal data attached. At sign-up, your email is used only to limit this generation to one per sign-up: it is stored only as a scrambled code (a hash), which does not reveal the address, and is deleted when the account is created or, at the latest, 7 days after the request.

CONTACT WITH A SPECIALIST THROUGH THE WEBSITE. When you use "Talk to a specialist" or "Book a demo" on the website, we process your name, WhatsApp number, email (if provided) and the optional answers (company, industry, conversation volume, team size, channels, the AI the company uses, and the preferred day and time of day for the demo) so that a person on our team can speak with you and prepare the proposal — a preliminary procedure at the data subject's request (LGPD, Art. 7, V). This data enters AttendTo's own CRM and a copy goes to our sales mailbox. No automatic message is sent because of the form, and you may ask at any time not to be contacted anymore.

The IP ADDRESS — and only that, not the user agent — is also used to limit repeated login attempts, which is the protection against brute-force attacks. For this purpose it is stored for A MAXIMUM OF 15 MINUTES, only as the key of an attempt counter, and is discarded automatically when that period expires: it does not enter any report, is not associated with your account and does not become history. Outside these two purposes, the Platform does not record your browsing inside the dashboard.

CONTACT REQUEST THROUGH THE WEBSITE. Whoever fills in the form on the reseller page gives us NAME, WHATSAPP PHONE NUMBER and, if they wish, the COMPANY NAME — and nothing beyond that. This data becomes a contact in our own account on the Platform, and it is through it that the conversation about resale takes place on WhatsApp, first with our AI assistant and then with a person from the team. We also store the date, time and text of the authorization you checked, as proof of consent. Requests made outside business hours are answered starting at the beginning of the next business period. In this processing, AttendTo is the CONTROLLER. The sender's IP address is used only to limit repeated submissions from the same network, and for that it is stored for A MAXIMUM OF 15 MINUTES, only as the key of a counter, and is discarded automatically at the end of that period. It is not recorded together with your contact, does not become history and is not used to identify you.

Roles: controller and processor

For the personal data of your company's leads (name, phone number, conversation content), the Customer is the CONTROLLER: it is the one who decides to contact the lead and for what commercial purpose. AttendTo acts as the PROCESSOR of this data, processing it on behalf of the Customer and according to its instructions, for the purposes of the contracted service (LGPD, Arts. 39 to 41).

As for the registration data of those who use the dashboard — name, email and billing details of the account owner and the invited agents —, AttendTo is the CONTROLLER, since it decides the purposes of that processing (authentication, invoicing and support). Requests from a lead about their own data should preferably be directed to the contracting company, which already has the opt-out and anonymization tools in the dashboard.

Legal basis

The lead's first contact is processed on the basis of the Customer's legitimate interest in responding to a spontaneous expression of commercial interest. From there on, the continuation of the conversation and the use of the data for qualification and CRM rely on consent, recorded at the time of the interaction, in accordance with the LGPD.

When your system sends us a lead with the legal basis 'they asked to be contacted' or 'consent', we send a welcome message through WhatsApp on your behalf. With the basis 'they are my customers', we do not send an automatic message. The declaration of the legal basis is yours, and it is recorded with the name of the person who made it.

The technical data of acceptance of the Terms — IP address and user agent — is processed by AttendTo, as CONTROLLER, on the basis of performance of a contractual obligation and regular exercise of rights (Art. 7, V and VI, of the LGPD, Brazil's General Data Protection Law, Law No. 13,709/2018): it exists to prove who accepted which version, and for nothing else. Protection against repeated login attempts relies on the legitimate interest in maintaining the security of the Platform (Art. 7, IX, and Art. 10).

The contact request made through the form on the reseller page of our website relies on the data subject's CONSENT (Art. 7, I), given prominently at the time of submission: without the authorization checked, the request is not recorded. It may be revoked at any time — just ask in the WhatsApp conversation itself or write to the contact indicated at the end of this Policy, and the sending of new messages is stopped.

The request made through "Talk to a specialist" or "Book a demo" has no consent checkbox: it relies on preliminary procedures at the data subject's request (Art. 7, V), and no automatic message is sent because of it.

Data subject rights

You (the customer) and the lead, as the data subject, may exercise the rights set out in Article 18 of the LGPD, including: confirmation that processing exists and access to the data processed; correction of incomplete, inaccurate, or outdated data; anonymization, blocking, or deletion of unnecessary data or data processed in violation of the law; portability to another provider; information about with whom data is shared; and withdrawal of consent at any time.

Today, the dashboard already offers directly: immediate opt-out, which stops the sending of new automated messages; and anonymization or deletion from each lead's record in the CRM, logged in the Compliance audit trail. Correction, portability and other requests that do not yet have a dedicated button in the dashboard can be requested at any time by email and will be handled manually.

Because the AI generates a score (BANT) to qualify each lead, you may also request that a human agent review that qualification — which already happens whenever a conversation is handed off to your team (handoff), and can be triggered at any time through the Inbox.

Audio retention

Voice messages received by the AI SDR are transcribed to enable qualification and service. The original audio is automatically deleted 90 days after receipt; the transcript remains in the CRM for the conversation's history and audit for an indefinite period, together with the lead's other data.

Data retention and deletion

The remaining lead and conversation data is stored while the Customer's account is active and for the time necessary to fulfill the purposes of the service and legal obligations (for example, tax proof of charges). When a lead is anonymized through the dashboard, the data that identifies them (name, phone number, text content of messages) is irreversibly removed or masked, keeping only the minimum necessary for aggregated metrics and legal obligations.

If the customer closes its account, data is retained only for the minimum period required by law and then deleted or anonymized.

The evidence of acceptance of the Terms has its own, longer retention period: it is retained throughout the contractual relationship and for at least 5 (five) years after it ends, without prejudice to any longer legal period. This is a deliberate exception to the rule in the previous paragraph — deleting the proof of a contract together with the operational data would leave both parties unable to demonstrate what was agreed.

Information security

The data of each contracting company is isolated by row-level access control (Row-Level Security) in the database, so that one customer's data is never visible to another. Communication between your browser, the Platform and the messaging channels is encrypted (HTTPS/TLS); access to the dashboard is controlled by roles (owner and agent); and sensitive actions (handoff, anonymization, configuration changes) are recorded in an immutable audit trail.

In the event of a security incident that may create a relevant risk to data subjects, AttendTo notifies the Customer WITHOUT DELAY, with the elements provided in Art. 48, § 1, of the LGPD (Brazil's General Data Protection Law, Law No. 13,709/2018), and provides the support necessary so that the notification follows the deadlines set by ANPD regulations.

Notifying the ANPD (Brazil's National Data Protection Authority) and the data subjects is the responsibility of the CONTROLLER (Art. 48 of the LGPD, Brazil's General Data Protection Law, Law No. 13,709/2018). For your leads' data, you are the controller and AttendTo is the processor: notifying on the controller's behalf would mean deciding for it, and therefore we do not do so — we provide you with what the law requires to be provided, in time for you to meet the deadline. When the incident affects data for which AttendTo is the CONTROLLER — the registration data of those who use the dashboard, described in the section on roles —, notification to the ANPD and to the data subjects is ours.

Sharing with third parties

To provide the service, AttendTo relies on providers that process data on its behalf, as sub-processors. The list below groups these providers by what they do and the data they receive, and is kept up to date when a provider joins or leaves. Infrastructure and artificial intelligence providers are identified by category; the named list, with each one's headquarters, is available to the Customer upon request to the Data Protection Officer, through the channel indicated at the end of this Policy. All have their own data protection policies, and none of them receives, for advertising purposes, the content of conversations, your leads' data or your account data.

FOR THE CONVERSATION TO TAKE PLACE. Meta/WhatsApp delivers and receives messages through the official channel — the lead's phone number and profile name, the content of the messages and media files pass through it. An artificial intelligence model provider processes the content of conversations, the persona and the knowledge base to generate the SDR's replies, for semantic search in the knowledge base and to transcribe incoming voice messages; a second model provider transcribes as a fallback and synthesizes spoken replies when the voice feature is active.

FOR THE PLATFORM TO EXIST. A cloud provider hosts the application, the database and the task and event queue — it is the infrastructure where the data is stored, in a Brazilian region (São Paulo). The file storage service of that same provider keeps the audio received, images, documents exchanged in the conversation and logos. A private repository, on a code hosting service, keeps the daily database backup, with 30-day retention.

TO BILL AND DOCUMENT. Mercado Pago and Asaas are the payment institutions that process top-ups and monthly fees — which of them serves your account depends on how it was contracted; they receive the payer's name, email and, when required, CPF or CNPJ. The National NFS-e Issuer (Sefin Nacional) receives the service recipient's tax data — CNPJ or CPF, legal name and address — to issue the service invoice. ZapSign is used for the electronic signature of partnership contracts: it receives the signatory's name, email and CNPJ and hosts the signed document.

TO NOTIFY YOU. A transactional email service sends the Platform's emails — agent invitation, verification code, balance alert and weekly summary — and receives the recipient's name and email and the content of the message. Push notices are delivered by the notification service of the recipient's own browser (Google, Mozilla, Microsoft or Apple), which carries the notice's title and text to the device.

WHEN YOU TURN ON AN INTEGRATION. Four features add providers that you are the one to choose. When you connect Google Calendar, your availability and the events created pass through Google, and the lead's email goes as a meeting guest. When you enable the SMS or email channels, the provider you configure (for example Zenvia, Sinch, Comtele, SMSDev, SendGrid, Mailgun, Postmark or your own SMTP server) receives the recipient's phone number or email and the content of the message. When you register a webhook, the events you choose are sent to the address you provide. If you turn on the sending of personal data in a webhook, name, phone number, email and the conversation summary are sent to the address you registered; the legal basis and the custody in that system are yours. With conversions turned on, we send Meta, on your behalf, the ad form ID or the encrypted phone number and email, and the stage the lead reached, with the sale value when there is one; the lead's name and the conversation are never sent. In these four cases the relationship with the provider is yours, and the legal basis for the transmission is your responsibility.

IF YOUR COMPANY SUBSCRIBES TO THE ENTERPRISE PLAN WITH YOUR OWN AI. When you connect to the dashboard artificial intelligence models that your company contracts directly with a provider of its choice and assign them to a task, the platform sends that provider the data needed for that task: the recent conversation, the company context, and excerpts from the knowledge base; for internal tasks, it also sends dashboard figures, without the lead's name or contact details. In this transmission, your company is the CONTROLLER and chooses and contracts the provider, and AttendTo acts as the PROCESSOR, following the instructions recorded in the configuration. Before each transmission, emails, phone numbers, CPFs, and CNPJs identified in the content are replaced with placeholders, which is a data minimization measure and not anonymization. The data protection terms of the contract with that provider, including retention, use for training, and any international transfer, are your company's responsibility, under the Enterprise Plan Conditions.

Separately, and only on the public website (not in the dashboard), ad measurement tags send browsing data from site visitors to Google (Google Ads) and OpenAI (OpenAI Ads) — to measure the results of our ads and, in Google's case, to build remarketing audiences. This transmission depends on your acceptance in the cookie notice and is detailed in the Cookie Policy below.

International data transfer

To generate the AI SDR's replies, transcribe voice messages and synthesize spoken replies, AttendTo uses artificial intelligence model providers headquartered in the United States. These providers process data on infrastructure outside Brazil, which constitutes an international transfer of personal data under Arts. 33 et seq. of the LGPD (Brazil's General Data Protection Law, Law No. 13,709/2018).

They are not the only ones. Others also process data outside Brazil, each for its own part: Meta/WhatsApp, in transporting messages; the transactional email service, in sending the Platform's emails; the code hosting service, in backing up the database; Google, when you connect the Calendar; browser notification services, in delivering push notices; and Google and OpenAI, in measuring our ads on the public website, if you accept in the cookie notice. The primary storage — database and files — is located in a Brazilian region, with a provider headquartered abroad, which may imply access from another country for operation and support.

These transfers are limited to what is necessary to provide the service, and take place on the basis of the applicable legal grounds and the contractual and security safeguards offered by these providers. By contracting AttendTo, you acknowledge that this international data flow is an essential part of how the Platform works, in particular its artificial intelligence and voice features.

Google Calendar data (Limited Use)

When you connect Google Calendar, AttendTo accesses only your availability (free/busy times) and creates the meeting events that you authorize. The use of data received from Google APIs adheres to the Google API Services User Data Policy, including the Limited Use requirements.

In particular: this data is not used for advertising; it is not sold or transferred to third parties beyond what is necessary to provide the calendar functionality; it is not used to create, train or improve artificial intelligence or machine learning models, whether generalized or not; and humans do not read this data, except with your explicit consent, for security reasons or to comply with the law. You can disconnect the integration at any time in the dashboard, which revokes access.

Cookie Policy (LGPD)

We use two categories of cookies. NECESSARY cookies make the service work and do not require consent: a session cookie (httpOnly, inaccessible to scripts) that keeps you securely logged in, and a trusted-device cookie that avoids asking for the two-step verification code at every login. MEASUREMENT AND ADVERTISING cookies depend on your acceptance and come from third parties, Google and OpenAI: the Google Ads tag and the OpenAI Ads pixel.

What the Google Ads tag does, concretely: it analyzes the traffic coming from our ads, recording which ads and keywords resulted in a contact form submission; and it feeds Google's audience lists, which allow our ads to be personalized and shown again to people who have already visited the website (remarketing). To do this, Google sets its own cookies in your browser and receives data about your visit, such as the page accessed, IP address and the identifier of the ad clicked. This personalization applies to ADS elsewhere — the website content itself is the same for everyone, and the customer dashboard has no advertising or third-party analytics.

The OpenAI Ads pixel has a narrower purpose: to measure which of our ads displayed by OpenAI resulted in a contact form submission. It records the visit to the website and, when you submit the contact form, sends OpenAI the contact request event — without your name, your email or any account data. Along with it travels the click identifier that the advertising platform adds to the URL by itself when you arrive through one of its ads. We do not build remarketing audiences with OpenAI.

None of this loads on its own. As long as you do not accept in the cookie notice — and forever, if you decline — no request leaves your browser for Google or OpenAI. Declining does not limit any functionality of the website. Your response is stored only in your browser and can be changed whenever you want through the Cookies link in the website footer, which reopens the choice; you can also block or delete cookies in your browser's own settings, and adjust Google's ad personalization at myadcenter.google.com.

Changing your mind takes effect immediately, not just going forward: when you decline after having accepted, we remove the tags from the page, delete the cookies they set at AttendTo's address and reload the page — which is what actually stops a third-party script that was already running. What is beyond our reach are the cookies that these companies set on their own domains: they stop being fed, and it is you who deletes them, through your browser settings.

These tags exist only on the public website and only at AttendTo's address. They are not loaded inside the customer dashboard or at the own address of a partner that resells the Platform — the browsing of those who use a partner's account is not measured by us. And this is not only about the first load: if you accept on the website and then log in to the dashboard, they are removed from the page when you cross that boundary. They are also not loaded on pages opened through a link with an access code, such as the team invitation and account activation, so that this code does not end up in the address sent to third parties.

Apart from cookies, we store in the browser's local storage your interface preferences (light/dark theme, menu) and, when you arrive through a campaign or referral link, the origin of the visit (UTM parameters, click and ad identifiers, or partner code) for up to 30 days — it is only associated with your request if you submit the contact form. This origin is stored even without cookie acceptance, because it is not a third-party cookie: it stays in your browser, is read only by us, and serves to let us know which ad brought in a customer — including when payment is confirmed days later, outside the browser. If this information starts to be sent back to the advertising platform to measure the sale, this Policy will say so beforehand. If we ever adopt another technology that requires consent, this Policy will be updated and consent will be requested before any collection.

Data Protection Officer (DPO) and controller contact

To exercise your rights or ask questions about this data processing, write to privacidade@attendto.com.br. This is the channel of the Data Protection Officer (DPO) appointed by AttendTo, under Art. 41 of the LGPD (Brazil's General Data Protection Law, Law No. 13,709/2018) — through it you reach the person responsible for assisting data subjects and for serving as the point of contact with the ANPD (Brazil's National Data Protection Authority).

Company identification: RYTORA AI TECHNOLOGY & SOLUTIONS LTDA, CNPJ 62.234.242/0001-05. Contact: contato@attendto.com.br.

Changes to this Policy

This Policy may be updated to reflect changes in the product, the providers used or applicable legislation. Relevant changes will be communicated by registered email and/or a notice in the dashboard.