Privacy Policy
This is a convenience translation. In case of any discrepancy, the Portuguese version prevails. Português
This Policy explains how EXECFY INOVA SIMPLES (I.S.), Brazilian company registration (CNPJ) no. 69.463.097/0001-75, headquartered at Rua Rondônia, 226, Santa Rosa, Uberlândia/MG, ZIP 38401-246, Brazil ("Execfy", "we"), processes personal data on the website https://execfy.com and on the Execfy platform, in compliance with Brazilian Law No. 13,709/2018 (General Data Protection Law — LGPD).
1. Our role in each situation
- As controller, Execfy decides on the data of website visitors, of people who request a demo, and of Users who access the platform console (account and access data).
- As processor, Execfy processes, on behalf of its Customers (the companies that subscribe to the platform), the data of people who talk to those Customers via WhatsApp, Telegram, website chat and other channels ("End Users"). In this case, the Customer decides why and how the data is used and is the controller. If you talked to a company that uses Execfy, the privacy policy that applies to you is that company's, and you should address your requests to it first. We help it fulfill them.
2. Data we process as controller
| Who | Data | Purpose | Legal basis (LGPD, Art. 7) |
|---|---|---|---|
| Website visitor | IP address, browser (user agent), pages accessed, date and time; chosen language (lang cookie) | Deliver the website, maintain security and prevent abuse; remember the language | Legitimate interest (IX); compliance with a legal obligation regarding access logs (II) |
| Demo requester | Name, company, email, phone, message, language, IP address and browser | Respond to the request and schedule the demo; prevent automated submissions (spam) | Pre-contractual steps at the data subject's request (V); legitimate interest (IX) |
| Console User (a Customer's employee) | Name, email, role and permissions, access credentials, access and action logs (audit), preferences and, if enabled, browser notification subscriptions | Authenticate, authorize, provide the service, give support, maintain security and the audit trail | Performance of contract (V); legitimate interest (IX); legal obligation (II) |
| Customer that connects WhatsApp through Meta | Identifiers of the business portfolio, the WhatsApp account and the numbers at Meta; the access token that Meta grants to Execfy and the number's two-step verification PIN, stored encrypted. The company details typed on the connection screen go to Meta's window, straight from the browser. For a new number, the address, the website and the photo also go to the number's profile, through Execfy, which passes them on in the same request and does not keep them. The company name and the website go into the initial message templates, and stay with Execfy as part of those templates | Connect the number to the platform and operate it on the Customer's behalf: register the number, receive and send the messages and manage the message templates | Performance of contract (V) |
The website does not use audience analytics tools, advertising pixels or third-party tracking.
3. Data we process as processor, on behalf of Customers
When a Customer connects its channels to Execfy, we process, under its instructions:
- End User identification data provided by the channel or in the conversation: profile name, phone number or channel identifier, email and other data the person chooses to send;
- conversation content: text messages, audio, images, documents, choices in lists and buttons, with date and time;
- when the Customer keeps the number on the WhatsApp Business app, the messages its team sends through the app, which Meta copies to the platform so the AI agent knows what was said;
- the End User's authorization to receive notices and offers from the Customer on WhatsApp outside a conversation: the text of the question, the button tapped, the date and the number that answered;
- service data: handovers to human agents, queues, business processes started from the conversation and technical failure records;
- in the website chat, a visitor identifier generated by the platform and, if the person verifies their phone number, the confirmed number;
- documents and knowledge bases that the Customer registers for its AI agents.
We use this data only to provide the service to the Customer: receive and deliver messages, generate AI agent responses, route conversations to human agents, run the processes and integrations the Customer configured, and keep the platform secure. We do not sell personal data and do not use it for advertising.
4. Artificial intelligence
To generate a response, the conversation text and the agent's instructions are sent to a language model provider (see section 5). The same applies to excerpts of the knowledge base, which are converted into numerical representations (embeddings) for search, and to text the Customer chooses to turn into audio. Execfy does not use conversation content or Customer data to train AI models. AI responses may contain errors; Customers configure and supervise their agents and can hand the conversation over to a person at any time.
5. Who we share data with
We share data only with those who need it for the platform to work (sub-processors), always within the limits of that need:
| Provider | Purpose | Location |
|---|---|---|
| DigitalOcean, LLC | Hosting of servers and database; AI model inference; speech synthesis (through third-party models it makes available) | United States and other countries where it operates |
| Meta Platforms, Inc. (WhatsApp Business Platform) | Sending and receiving WhatsApp messages; connecting the Customer's WhatsApp account (Facebook Login for Business), whose window and SDK, loaded on the console's connection screen, receive the IP address of whoever opens it | United States and other countries |
| Telegram | Sending and receiving Telegram messages, when the Customer uses that channel | Several countries |
| Google LLC (Gemini API) | Generating knowledge base embeddings for search | United States and other countries |
| Transactional email provider | Sending platform emails (notices, invitations, sales contact) | Brazil |
| Browser push services | Delivering notifications to console Users who enable them | Depending on the browser |
| Open-source content delivery networks (jsDelivr, unpkg) | Loading console interface libraries; they receive the visitor's IP address | Several countries |
In addition:
- Customer integrations: if the Customer connects its own systems or services to the platform (for example, an ERP, an SMS provider or an AI provider with its own account), data goes to those destinations by the Customer's decision and under its responsibility.
- Authorities: when required by law or court order.
- Corporate transactions: in case of merger, acquisition or reorganization, with the same protection as this Policy.
Services such as the identity service (login), AI execution monitoring and the process engine run on our own infrastructure, without being sent to third parties.
6. International transfer
Some providers in section 5 process data outside Brazil, mainly in the United States. These transfers take place under the cases of Article 33 of the LGPD, supported by these providers' contractual data protection terms, and are necessary to perform the agreement with the Customer and provide the service requested by the data subject.
7. How long we keep data
- Demo requests: for as long as the business relationship lasts, or until you request deletion.
- Console account data: while the User is active and during the Customer's subscription; afterwards, for the period needed to meet legal obligations and exercise rights.
- WhatsApp connection through Meta: the access token and the PIN are stored, encrypted, while the connection exists, and are removed when the Customer disconnects WhatsApp, deletes the number's channel, discards a connection that did not finish or ends the subscription. On these exits, Execfy also asks Meta to stop sending it the account's events. The Customer can also revoke the access at any time at Meta itself: the token stops working, and Execfy deletes it once Meta confirms the revocation.
- Application access logs: for at least 6 (six) months, as required by Article 15 of the Brazilian Internet Civil Framework (Law No. 12,965/2014).
- Customer content: for the period set by the Customer in the platform's retention policies, which can automatically delete or anonymize conversations, contacts, files and other data. Regardless of that, technical service failure records are deleted within 90 days, the website chat inbox within 180 days, and the messages exchanged through the WhatsApp Business app, and the message templates the Customer's processes send through WhatsApp, that the AI agent has not yet read within 7 days. After termination, the Customer has 30 days to request an export; afterwards, the content is deleted.
- Authorization for WhatsApp messages: while it is in force and, once revoked, for 5 (five) years, so the Customer can prove consent (art. 8, § 2, of the LGPD). A question the person did not accept is deleted within 30 days. To revoke, the person just writes PARAR (or STOP) in the conversation.
- Website chat: the history shown to the visitor is stored in the visitor's own browser (local storage), for the period configured by the Customer, up to 90 days.
- Audit log: administrative actions are kept in a tamper-evident log, retained for security and accountability. It does not store free text typed by people (such as messages or questions), only identifiers and the type of action.
8. Security
We adopt technical and administrative measures proportionate to the risk, including: encrypted traffic (HTTPS/TLS); integration credentials encrypted in the database and masked in the interface; separation of each Customer's data; role- and permission-based access control, with least privilege; an audit log with cryptographic chaining that reveals tampering; and restricted access to the infrastructure. No system is entirely immune to incidents. If a security incident occurs that may cause relevant risk or harm, we will notify the affected Customers, the Brazilian National Data Protection Authority (ANPD) and data subjects, where applicable, under Article 48 of the LGPD.
9. Your rights
Under Article 18 of the LGPD, you may request: confirmation that we process your data; access to it; correction of incomplete, inaccurate or outdated data; anonymization, blocking or deletion of unnecessary or excessive data or data processed in non-compliance; portability; deletion of data processed based on consent; information on whom we share it with; information on the possibility of not consenting and its consequences; withdrawal of consent; and review of decisions made solely on the basis of automated processing. You may also object to processing based on legitimate interest and complain to the ANPD (www.gov.br/anpd).
We respond within 15 (fifteen) days. We may ask for information to confirm your identity before responding, so as not to hand your data to someone else.
10. How to request deletion of your data
- If you talked to a company via WhatsApp, Telegram or website chat: request deletion directly from that company, which is the controller of your data. If you prefer, write to suporte@execfy.com with the company's name and the phone number (or identifier) used in the conversation; we will forward the request to the responsible Customer and support its execution. The platform allows the Customer to delete or anonymize a contact's data and to export it.
- If you requested a demo or are a console User: write to suporte@execfy.com with the subject "Data deletion", from your registered email.
- In the website chat: the history stored in your browser can be erased at any time by clearing the site data in your browser settings.
Some data may be kept after the request when required by law (for example, the access logs required by the Internet Civil Framework) or for the regular exercise of rights, always for the minimum necessary period.
11. Cookies and browser storage
| Name | Where | Purpose | Duration |
|---|---|---|---|
lang | Website | Remember the chosen language | 1 year |
session | Console | Keep the User signed in (essential, signed cookie) | 8 hours |
| Chat local storage | Website chat | Keep the conversation visible between visits | Set by the Customer, up to 90 days |
| Meta cookies | WhatsApp connection screen, in the console | Sign in to the Meta account to connect WhatsApp; set and governed by Meta | Set by Meta |
We do not use third-party advertising or analytics cookies. You can delete or block cookies in your browser; blocking the session cookie prevents signing in to the console.
12. Children and adolescents
Execfy's website and console are intended for businesses and professionals and are not directed at people under 18. Customers who serve children and adolescents through their channels are responsible for complying with Article 14 of the LGPD.
13. Data protection officer and contact
Data protection officer (encarregado): Claudio Rafael da Silva — suporte@execfy.com.
EXECFY INOVA SIMPLES (I.S.) · CNPJ 69.463.097/0001-75
Rua Rondônia, 226, Santa Rosa, Uberlândia/MG, ZIP 38401-246, Brazil
14. Changes to this Policy
We may update this Policy to reflect changes in the platform, providers or the law. The effective date is shown at the top of the page, and material changes will be announced to Customers by email or on the platform.