CertuAI Privacy Policy
CertuAI (Certu Ltda, CNPJ 65.868.342/0001-73, Florianópolis, SC, Brazil) handles personal data under the Brazilian LGPD (Law 13,709/2018). The policy says which data we keep, what for, who we share it with, and how you ask to see, correct, take away or delete yours. Data Protection Officer: Bernardo Villela, [email protected].
Build your agent and watch it answer with your own business information.
Build my agent for free Building it is free, no signup and no card.Who is the data controller?
Certu Ltda, CNPJ 65.868.342/0001-73, headquartered in Florianópolis, Santa Catarina, Brazil. The Data Protection Officer (DPO) is Bernardo Villela, at [email protected].
Who does CertuAI share data with?
With the providers that run the service (hosting, messaging, payments), with the partner in charge when the user themselves asks for a third-party service, and with authorities when the law requires it. The full list of cases is in section 7 of this page.
What does CertuAI do with Google data?
When the Customer connects Google Calendar, CertuAI reads only the busy time slots and creates, changes or deletes the events it booked itself. When they connect Google Ads, CertuAI reads the number, the name and the currency of the accounts and the status of the campaigns it created itself, and always publishes search campaigns paused. The access key is stored until the Customer disconnects, at which point CertuAI deletes the key and tells Google to revoke the access. None of this is sold, used for advertising, or used to train an AI model. The use and transfer, to any other app, of information received from Google APIs follows the Google API Services User Data Policy, including the Limited Use requirements.
How do you exercise your LGPD rights?
Access, correction, portability and deletion can be requested by email at [email protected] or on WhatsApp +55 (48) 99218-4265. The full policy in force is on this page.
What are the legal bases for processing?
CertuAI only processes data on a legal basis under Brazil's LGPD (art. 7): consent for measurement and advertising cookies, news emails and ad forms; performance of a contract to create the account, answer contact requests, bill and deliver the software; legitimate interest to operate, protect and improve the service and prevent fraud; and legal obligation for invoices, the access logs required by Brazil's Marco Civil da Internet and orders from authorities.
Who are the processors and providers that receive data?
CertuAI does not sell data. It shares data only with those who operate the service, under contract: Cloudflare (hosting), Google (Firebase, Gemini, Analytics and Ads, plus Calendar and Google Ads when the customer connects them), Meta (WhatsApp Business Platform and Pixel), Anthropic and OpenAI (AI models that generate replies, transcribe audio and organize the Brain), DeepInfra (hosts DeepSeek, which generates the WhatsApp agent's replies), Microsoft (Clarity), Twilio (telephony), ElevenLabs (voice), Asaas and Stripe (billing), Resend (email), Cloudinary (images), the QR code connection server (Evolution API, Hostinger, Brazil) and the reseller partner, when there is one. None of them uses the data to train an AI model. Much of it is stored in the US; the transfer follows art. 33 of the LGPD and the rules of Brazil's data protection authority (ANPD).
How long is the data kept?
Account and Brain: for as long as the account exists; on deletion, we erase the account, the Brain and the CRM. Conversations and calls with end customers: for as long as the client company decides, or until it asks us to erase them. Forms and job applications: for as long as needed to respond. Access logs: for the period set by Brazil's Marco Civil da Internet (Law 12,965/2014, art. 15). Billing and invoices: for the legal period, generally 5 years. After that, the data is deleted or anonymized.
Frequently asked questions
- Who operates CertuAI?
- Certu Ltda, CNPJ 65.868.342/0001-73, a Brazilian company headquartered in Florianópolis, SC.
- Who does CertuAI share my data with?
- With the providers that run the service, with the partner in charge when you ask for a third-party service, and with authorities when the law requires it. The cases are listed in section 7 of the policy.
- Who is CertuAI's Data Protection Officer (DPO)?
- Bernardo Villela. Contact: [email protected].
