CertuAI Privacy Policy

Who is the data controller?

Certu Ltda, CNPJ 65.868.342/0001-73, headquartered in Florianópolis, Santa Catarina, Brazil. The Data Protection Officer (DPO) is Bernardo Villela, at [email protected].

Who does CertuAI share data with?

With the providers that run the service (hosting, messaging, payments), with the partner in charge when the user themselves asks for a third-party service, and with authorities when the law requires it. The full list of cases is in section 7 of this page.

What does CertuAI do with Google data?

When the Customer connects Google Calendar, CertuAI reads only the busy time slots and creates, changes or deletes the events it booked itself. When they connect Google Ads, CertuAI reads the number, the name and the currency of the accounts and the status of the campaigns it created itself, and always publishes search campaigns paused. The access key is stored until the Customer disconnects, at which point CertuAI deletes the key and tells Google to revoke the access. None of this is sold, used for advertising, or used to train an AI model. The use and transfer, to any other app, of information received from Google APIs follows the Google API Services User Data Policy, including the Limited Use requirements.

How do you exercise your LGPD rights?

Access, correction, portability and deletion can be requested by email at [email protected] or on WhatsApp +55 48 99218-4265. The account owner can also delete everything on their own at Delete my account. The full policy in force is on this page.

What are the legal bases for processing?

CertuAI only processes data on a legal basis under Brazil's LGPD (art. 7): consent for measurement and advertising cookies, news emails and ad forms; performance of a contract to create the account, answer contact requests, bill and deliver the software; legitimate interest to operate, protect and improve the service and prevent fraud; and legal obligation for invoices, the access logs required by Brazil's Marco Civil da Internet and orders from authorities.

Who are the processors and providers that receive data?

CertuAI does not sell data and does not train AI models on the conversations. It shares data only with those who need it for the service to work. It is the same list as on the Security page:

• Google Cloud e Firebase (United States): Database, account login and the daily backup of the database. Data it receives: Everything the account stores: sign-up details, conversations, contacts, Brain and CRM.
• Cloudflare (Not disclosed by the provider): Delivers the website and the dashboard, runs the server routes, protects against abuse and stores the files (audio, photos, documents and call recordings). Data it receives: All website and dashboard traffic, and the files from conversations.
• DeepInfra (United States): Runs the DeepSeek model, which writes the WhatsApp agent's replies and reads the business's conversations to build the Brain, and the models that create the studio's images and videos. Data it receives: The conversation text and the business's Brain, at the moment of each reply, whatever the owner sends to the studio, and what a visitor types in the home page chat to build the agent, even without an account.
• Google Gemini (United States): Replies in place of DeepSeek when it fails (and is the main model on some accounts), transcribes voice messages and reads PDFs that have no text. Data it receives: The conversation text, the business's Brain, and incoming voice messages and PDFs.
• OpenAI (United States): Reads photos that arrive on WhatsApp, transcribes calls, and transcribes voice messages when Gemini fails. Data it receives: Photos, voice messages and call audio.
• Anthropic (United States): Reads the photos and PDFs attached in the home page conversation and PDFs with no text when Gemini fails, and runs dashboard features such as organizing the Brain. Data it receives: The photos and PDFs attached in the conversation, the Brain and the conversations those features use. Certu does not keep the file attached in the conversation.
• Meta (United States): Carries messages to and from WhatsApp when it is connected through the official API, and also Instagram and Messenger messages. Data it receives: The messages and phone number of whoever talks to the business.
• Hostinger (Evolution server) (Brasil): Keeps the WhatsApp connection running when the number is connected by QR code instead of the official API. Data it receives: The messages and phone number of whoever talks to the business.
• Twilio (United States): The phone line and the call itself, for the voice agent and the dialer. Data it receives: The caller's number and the call audio.
• ElevenLabs (United States): The voice of the phone agent. Data it receives: The call audio and text.
• Asaas (Brasil): Billing in Brazil: card, bank slip and Pix. Data it receives: The payer's name, tax ID, email, phone and address.
• Stripe (Estados Unidos e Irlanda): Billing outside Brazil. Data it receives: The payer's name, email and payment details.
• Resend (United States): Sends the platform's emails. Data it receives: The recipient's email address and the email text.
• Systems the company connects itself (Depends on the system the company chose): When the company connects its own account, CertuAI sends it what the integration needs: CRM (such as Salesforce, HubSpot and Pipedrive), calendar (Google Calendar), ads (Google Ads), clinic software (such as Feegow) and others. Data it receives: Name, phone, booked time and the conversation summary, depending on the integration.
• Google Analytics, Google Ads and Meta Pixel (United States): Measure CertuAI's website and ads, only if the visitor accepts cookies. Data it receives: How the visitor uses the website and, for people who sign up with CertuAI from an ad, their hashed email and phone. Never the end customers' conversations.
• Microsoft Clarity (United States): Records how the website is used, only if the visitor accepts measurement cookies. Data it receives: Clicks and scrolling of website visitors.
• Cloudinary (United States): Stores the promotional images on CertuAI's website. Data it receives: No conversation or account data; only the IP address of whoever opens a page with an image.

Also the reseller partner, when the account was purchased through one, and authorities, when the law requires it.

How long is the data kept?

Account and Brain: for as long as the account exists; on deletion, we erase the account, the Brain and the CRM. Conversations and calls with end customers: while the client company's account exists; the owner can delete the account at any time. Backups: the database has one copy per day, kept for 7 days; anything deleted is gone from the copies within 7 days. Forms and job applications: for as long as needed to respond. Access logs: for the period set by Brazil's Marco Civil da Internet (Law 12,965/2014, art. 15). Billing and invoices: for the legal period, generally 5 years. After that, the data is deleted or anonymized.

Does the data leave Brazil?

Yes. Many of the providers are outside Brazil, mainly in the United States, and the data is processed there under the data processing terms each provider publishes. Where each one is located is in the list above.

What if there is a security incident?

Involving CertuAI account data (sign-up, billing, website use), CertuAI is the controller and notifies the data subject and the ANPD, the Brazilian data protection authority, as the LGPD requires (art. 48). Involving end customers' data (the conversations and calls CertuAI handles for a company), the client company, as the controller, is the one that notifies the ANPD and the people affected. CertuAI, as processor, notifies the client company by email, to the people responsible for the account, and gives it what it knows so it can make that notice.

How does CertuAI handle health data?

Health data is sensitive data under the LGPD (art. 5, II, and art. 11). When the client company is a clinic, the clinic is the controller and CertuAI is the processor. On clinic accounts, the platform instructs the AI not to diagnose, not to give treatment advice, not to recommend medicines or doses, and not to assess symptoms, photos or test results; at any sign of an emergency, it tells the person to call emergency services right away. We recommend connecting the clinic's WhatsApp through Meta's official API, not by QR code.