Privacy Policy

Data Controller Identification

This Privacy Policy describes how Catalisa collects, uses, stores and protects your personal data.

Data Controller: Catalisa Tecnologia e Dados LTDA CNPJ (Tax ID): 49.646.439/0001-85 Address: Rodovia Raposo Tavares, 7389 - Sao Paulo - SP - Brazil - 05577-902

Data Protection Officer (DPO): Email: privacidade@catalisa.io Contact channel: privacidade@catalisa.io

Scope

This Policy applies to the processing of personal data carried out by Catalisa in two categories:

(a) Platform user data: personal information provided by you when creating an account, using our services or interacting with our website.

(b) Users' customer data: personal information of third parties (the User's end customers) that is processed through the Platform, especially via WhatsApp integrations. For this data, the relationship between Catalisa and the User follows the roles defined in Section 13.

This Policy is an integral part of the Platform's Terms of Service.

Data Collected

We collect the following categories of personal data:

• Registration data (legal basis: contract performance): full name, corporate email, phone number, company name, job title, tax ID. Collected at the time of registration on the Platform.
• Usage data (legal basis: legitimate interest): Platform interactions, features used, access logs, usage times, actions taken. Collected automatically during use.
• Communication data (legal basis: contract performance): messages processed by the Platform, message templates, Workflow and AI Agent configurations. Processed according to User instructions.
• Technical data (legal basis: legitimate interest): IP address, browser type and version, operating system, device, screen resolution, pages accessed, time spent. Collected automatically by cookies and similar technologies.

Legal Basis (LGPD Art. 7)

The processing of personal data by Catalisa is based on the following legal bases provided by the LGPD (Brazilian General Data Protection Law):

• Contract performance (Art. 7, V): processing necessary for the provision of contracted services, including account creation, message processing, Workflow execution and technical support.
• Legitimate interest (Art. 7, IX): processing necessary to improve the Platform, ensure security, prevent fraud, perform usage analytics and send service communications. We conduct a Legitimate Interest Assessment (LIA) to ensure our interests do not override the data subject's rights.
• Consent (Art. 7, I): used for specific purposes such as marketing communications, analytical and marketing cookies, and participation in surveys. Consent may be revoked at any time without prejudice to prior processing.
• Legal obligation (Art. 7, II): processing necessary to comply with legal and regulatory obligations, including retention of fiscal and financial data, compliance with requests from competent authorities and maintenance of legally required records.

Processing Purposes

We use your personal data for the following purposes:

• Service provision: operating the Platform, processing automations and Workflows, running AI Agents and providing contracted features.
• Account management: creating and maintaining your account, authenticating access, managing permissions and preferences.
• Technical support: handling support requests, diagnosing issues and providing technical assistance.
• Service communications: sending notifications about maintenance, updates, terms changes and essential service information.
• Platform improvement: analyzing usage patterns (in aggregate), identifying improvements, developing new features and fixing bugs.
• Security: monitoring suspicious activities, preventing fraud, detecting vulnerabilities and protecting Platform integrity.
• Legal compliance: meeting legal and regulatory obligations and responding to requests from competent authorities.
• Marketing (with consent): sending communications about new features, educational content and offers, only when authorized by the data subject.

Cookies and Tracking Technologies

Our website and Platform use cookies and similar technologies to improve your experience. We use the Google tag and Google Analytics 4 (GA4), with Consent Mode v2, and Microsoft Clarity only after analytics permission. You can change your choice in “Cookie preferences”; declining does not prevent use of the site. Contact details and conversation, concept and support content are not sent as analytics parameters. Clarity is not loaded on Contact, Lab or authenticated surfaces.

Cookie categories:

• Strictly necessary cookies: essential for Platform operation, including authentication, security and session preferences. Stored via localStorage and session cookies. They do not require consent.
• Analytical cookies (GA4): collect aggregated data about website and Platform usage for improvement purposes. Include: _ga (user identification, 2 years), _ga_* (session state, 2 years). Require consent.
• Marketing cookies: used to deliver relevant communications. Activated only with explicit consent via the cookie banner.
• External resources (images): our website may load illustrative images from third-party services, such as Unsplash (Imgur Inc.), to enrich editorial content. When loading these images, your browser makes direct requests to the provider's servers, which may receive technical data such as IP address, user-agent and the URL of the visited page. These resources are loaded based on legitimate interest (LGPD Art. 7, IX) to improve user experience. They do not require additional consent, as they do not install cookies or trackers.

Data Sharing

We do not sell your personal data. We share data only with the following categories of recipients, to the extent necessary for the purposes described in this Policy:

• Infrastructure providers: hosting, storage and processing needed for the service. Processing locations depend on the services used; we do not guarantee that all data resides exclusively in Brazil.
• Meta/WhatsApp: message processing through the WhatsApp Business API. Necessary for communication integration functionality. Subject to WhatsApp's Terms of Service and Privacy Policy.
• Anthropic (Claude): natural language processing and content generation by AI Agents. Data may be transferred to servers in the United States (see Section 8).
• OpenAI (GPT): natural language processing and content generation by AI Agents. Data may be transferred to servers in the United States (see Section 8).
• Unsplash (Imgur Inc.): provision of illustrative images for the website's editorial content. When loading pages with external images, your browser makes requests to Unsplash servers, which may receive technical data (IP address, user-agent). No personal data is actively shared by Catalisa. Subject to Unsplash's Privacy Policy (unsplash.com/privacy).
• Microsoft Clarity: behavioral analytics and heatmap tool to improve user experience. May collect interaction data such as clicks, scrolling and mouse movements. Subject to Microsoft's Privacy Policy.
• Competent authorities: when required by law, judicial or administrative order, or to protect rights in legal proceedings.

International Data Transfer

Concept generation uses the AI provider configured for the service, among the providers identified in this policy. This processing may take place outside Brazil. We send the brief and context needed to generate or refine the concept; your name, email and phone are not intentionally included in that request. Do not put sensitive personal information, credentials or secrets in free text.

Records retained by the AI provider are subject to its terms, settings and retention rules. Conversation periods on this site do not mean that all third-party copies are deleted at the same time. To clarify the processing applicable to your request, contact the privacy channel identified in this policy.

Data Security

We use the following measures to protect conversations and support on this site:

• Connections protected by HTTPS while you use the site.
• Separate essential cookies to keep your conversation and authenticate the team. A visitor cookie does not grant access to other people’s conversations or to team access.
• Private content encrypted in storage and access restricted to authorized staff. The server and AI provider must process the content needed for the service; this is not end-to-end encryption.
• Access checks, usage limits and validation of submitted data to reduce unauthorized access and abuse.
• The AI produces a structured preview. The site does not execute code supplied by the AI or the visitor.

Data Retention

The periods below apply to conversations, concepts and human support on this site. After expiry, records are no longer available for normal use and enter periodic cleanup. Backups and service provider records may follow their own deletion cycles.

• Visitor conversation, answers, provisional identification and concepts: up to 7 days after the session starts.
• Records used to prevent duplicate processing of the same request: up to 24 hours. Conversation content remains subject to the session period.
• Shared context and human support messages: up to 30 days after the handoff is accepted.
• Authenticated team access: up to 1 hour, also limited by credential expiry. Signing out ends that access.
• Technical usage limit records: until the relevant control window ends.
• Market insight measurement is disabled. Enabling it requires specific information about purposes, access, retention and deletion before collection starts.

Data Subject Rights (LGPD Art. 18)

In accordance with the LGPD (Brazilian General Data Protection Law), you have the following rights regarding your personal data:

• Confirmation of processing: know whether Catalisa processes your personal data.
• Data access: obtain a copy of the personal data we hold about you.
• Data correction: request correction of incomplete, inaccurate or outdated data.
• Anonymization, blocking or deletion: request when data is unnecessary, excessive or processed in non-compliance with the LGPD.
• Data portability: obtain your data in a structured format for transfer to another service provider.
• Deletion of consent-based data: request deletion of data whose processing was based on consent.
• Information about sharing: know which public and private entities your data was shared with.
• Objection to processing: object to processing based on legitimate interest, if you believe your rights prevail.
• Review of automated decisions: request human review of decisions made solely based on automated processing of personal data, including AI Agent decisions.

Automated Decisions

The Platform uses AI Agents that process personal data in an automated manner to generate responses, classify requests and execute Workflows.

In accordance with the LGPD (Art. 20), you have the right to request human review of decisions made solely based on automated processing of personal data that affect your interests, including profiling decisions.

To request human review or obtain information about the logic used in automated decisions, contact our Data Protection Officer at privacidade@catalisa.io. We will respond within 15 (fifteen) business days.

Third-Party Data (User's Customers)

When the User processes personal data of their own customers through the Platform (especially via WhatsApp integrations), the parties operate in the following roles:

- User: Controller of their customers' personal data. Responsible for defining the purpose and legal basis for processing, informing their customers about the use of the Platform and handling data subject rights requests.

- Catalisa: Processor of the User's customers' personal data. Processes data exclusively according to the User's instructions and for the provision of contracted services.

The User is responsible for:

(a) Ensuring they have a valid legal basis for processing their customers' data through the Platform. (b) Providing clear information to their customers about data processing, including the existence of AI processing. (c) Handling data subject rights requests in a timely manner. (d) Entering into a Data Processing Agreement (DPA) with Catalisa, when necessary, available upon request.

Security Incidents

In the event of a security incident that may pose a risk or significant harm to personal data subjects, Catalisa will take the following measures:

(a) Notification to the National Data Protection Authority (ANPD) within 72 (seventy-two) hours after confirmation of the incident, in accordance with Art. 48 of the LGPD.

(b) Communication to affected data subjects, within a reasonable timeframe, containing: description of the nature of the affected data, information about the risks, measures taken to mitigate the effects and guidance for the data subject.

(c) Internal incident record with complete documentation: nature, affected data, impacted data subjects, technical measures taken and results of containment actions.

(d) Notification to the User (when Catalisa acts as Processor) so that they may take the necessary measures with their customers.

Google user data

When you connect your Google account to Catalisa or Facila, Catalisa, the data controller, accesses only the data needed for the features you enable. For questions or requests about this data, contact privacidade@catalisa.io.

The use and transfer to any other app of information received from Google APIs will adhere to the Google API Services User Data Policy (https://developers.google.com/terms/api-services-user-data-policy), including the Limited Use requirements.

• Google sign-in (openid, email, profile): we access your name, email address and profile photo to authenticate you and identify your account.
• Gmail (gmail.send): we send emails only from your own account. In Facila, each send requires the customer’s explicit approval; in Catalisa, sends are triggered by workflows you create. We do not read, store or modify the contents of your mailbox.
• Google Calendar (calendar.events, calendar.calendars.readonly, calendar.calendarlist.readonly, calendar.freebusy): we read your calendar list, calendar names, time zones and free/busy information. We create, update and cancel appointment events on the calendar you choose.
• Purpose and sharing: we use this data only to provide the features described above. We do not sell it, use it for advertising or use it to train AI models. We do not transfer it to third parties except as needed to operate the service or as required by law.
• Prohibited use: using the integration for spam, fraud or unsolicited messages is forbidden and leads to suspension of the integration or account.
• Security and storage: OAuth tokens are stored encrypted, with access restricted to authorized people and systems that need them to operate the service.
• Retention and deletion: data obtained from Google and OAuth tokens are deleted when you disconnect the integration or request deletion by emailing privacidade@catalisa.io.
• Revoking access: you can revoke access at any time inside the app or at https://myaccount.google.com/permissions.
• Human access: people do not read this data except with your explicit consent, for security purposes (such as investigating abuse or incidents), to comply with a legal obligation, or when the data is aggregated and anonymized.

Final Provisions

Minors. Our services are not intended for individuals under 18 (eighteen) years of age. We do not intentionally collect personal data from minors. If you become aware that data from a minor has been collected, please contact us so we can delete it.

Changes to this Policy. We may update this Privacy Policy periodically. Significant changes will be communicated with a minimum of 30 (thirty) days' advance notice by email or Platform notification. Continued use of the Platform after the notice period constitutes acceptance of the updated Policy.

Contact. To exercise your rights, clarify questions or submit complaints about this Policy:

DPO email: privacidade@catalisa.io General email: contato@catalisa.io WhatsApp: +55 11 97730-3414

Jurisdiction. The courts of the District of São Paulo, State of São Paulo, Brazil, are chosen to resolve any disputes arising from this Policy.

Contact, Lab and human support on this site

To explore an idea, the site stores your answers and creates a provisional identity after you give your name. Before AI generation or support, it requests a valid email address or phone number; either one is sufficient. An essential cookie lets you resume only the same session. Provisional site references are not CRM records.

The agent receives the brief, context needed for generation or refinement, and the authorized capability catalog. Your name, email and phone are not intentionally included in the generation request. However, do not include sensitive customer information, credentials or secrets in free text. The AI generates a product hypothesis; it does not approve credit, execute transactions or publish a system.

When you confirm continuation, you share your contact information, answers, history, selected concept and refinements with the team. The human channel currently implemented is here on the site. Acceptance means the packet was stored; delivery means an authenticated person opened the context; assignment means that person claimed the request. Replies remain in the same conversation. Collecting an email or phone does not automatically send external messages.

Contact, Lab, concepts and support surfaces do not send conversations, names, emails or phone numbers to browser analytics tools. Proposed market measurement requires specific approval and public information before real collection. To request access, correction or deletion, use the privacy contact identified in this policy; identity and request scope will be checked before changing data.