Privacy Policy

1. Who we are and our role

Abracode is operated by GBS Tecnologia da Informacao Ltda, CNPJ 44.000.992/0001-22, contact contato@abracode.com.br. For personal data contained in the WhatsApp messages our customers send and receive, our customer is the data controller and Abracode acts as data processor, handling data only on the customer’s documented instructions. For account data of the people who sign in to our dashboard, Abracode is the controller.

2. Data we process

Depending on how you use Abracode, we process:

• Account data: name, email, hashed password, organization name, role and preferences.
• Connection data: WhatsApp Business Account identifiers, phone-number identifiers, display names and quality indicators returned by Meta.
• Message data (as processor): message content, sender and recipient identifiers, delivery status and timestamps routed through the WhatsApp Business Platform.
• Technical data: session cookies, IP address, device and log data needed to operate and secure the service.

3. Purposes and legal bases

• Providing the service (account, onboarding, sending and receiving messages, health monitoring): performance of a contract.
• Security, fraud prevention and audit logging: legitimate interest.
• Message processing on behalf of a customer: the legal basis defined by that customer as controller (contract performance, legitimate interest or consent, depending on the message).
• Legal and regulatory compliance: compliance with a legal obligation.

Marketing messages sent through the platform require explicit, separate opt-in obtained by the customer. Consent for another channel does not carry over to WhatsApp.

4. Sub-processors and sharing

We use carefully selected sub-processors to deliver the service. We do not sell personal data. Current sub-processors include:

• Meta Platforms (WhatsApp Business Platform / Cloud API): message delivery and receipt.
• Neon (managed PostgreSQL database hosting).
• Vercel (application hosting and infrastructure).

5. International data transfer

Some sub-processors, including Meta, operate data centers outside Brazil (for example in the United States and European Union). Where personal data is transferred internationally, we rely on the ANPD Standard Contractual Clauses under Resolution CD/ANPD n 19/2024 and equivalent safeguards.

6. Security

We protect data with encryption in transit (TLS) and encryption at rest for secrets such as access tokens and PINs (AES-256-GCM). We enforce tenant isolation on every request, verify webhook signatures, keep audit logs and follow least-privilege access. No method of transmission or storage is completely secure, but we work to protect your data using industry best practices.

7. Retention

We retain personal data only as long as needed for the purposes above or as required by law, then anonymize or delete it. Default retention windows (configurable per contract) are approximately: transactional messages ~5 years, marketing records ~2 years after last interaction, consent records 5 years after revocation, and operational logs ~2 years.

8. Your rights under LGPD

Subject to LGPD, you may request confirmation of processing, access, correction, anonymization, blocking or deletion, portability, information about sharing, and consent withdrawal. When we act as processor, we assist the controller (our customer) in fulfilling these requests. To exercise your rights, contact us at contato@abracode.com.br.

9. Cookies

We use a strictly necessary session cookie to keep you signed in and to secure the dashboard. We do not use advertising cookies.

10. Data protection contact

For any data-protection matter, including exercising your rights, contact our data-protection point of contact at contato@abracode.com.br. We respond to Brazilian data subjects in Portuguese.

11. Changes to this policy

We may update this Privacy Policy from time to time. We will post the updated version here and revise the "Last updated" date above.