Privacy notice
Privacy Policy
This notice explains how Escalide Sistemas handles personal data of users, administrators, visitors and the customers of the businesses that use the platform. It can be read, shared and printed without signing in, in line with the Brazilian General Data Protection Law (LGPD, Law 13,709/2018) and the guidance of the national authority (ANPD).
1. Who controls the data
The controller is the organization that subscribes to Escalide Sistemas. The platform acts as a processor when it handles data on the customer's behalf, and as a controller only for the data needed to run the account, billing, security and support.
2. What data we collect
- Identity and contact: name, work e-mail and organization.
- Credentials and security: hashed password, two-step verification, sessions and access logs.
- Product usage: modules used, language and theme preferences.
- Support: content sent in tickets and technical evidence of the incident.
- WhatsApp Business, when a business connects it: see section 3.
3. WhatsApp Business and the Meta platform
When a business connects its WhatsApp Business account, Escalide Sistemas uses Meta's official API so that the business itself can talk to its customers. In this case the business is the controller and Escalide Sistemas is the processor. The full workflow is described in WhatsApp messaging.
| Data | Source | How it is handled |
|---|---|---|
| WhatsApp Business account and phone number identifiers | Meta, through Embedded Signup | Stored per business, isolated from all others. |
| Authorization (access token) granted by the business | Meta | Stored encrypted; erased locally on disconnect. |
| Phone number, profile name and text of messages the end customer sends | Meta (signed webhook) | Encrypted content, used only to show the conversation to the business; discarded after 30 days. |
| Messages the business sends, templates and delivery status (sent, delivered, read, failed) | Business and Meta | History and audit trail of the business while the connection exists. |
| Requests to stop or resume messages (STOP, START) and proof of consent | End customer and business | Kept to honor the request and prove the sending basis, for up to 5 years. |
This data is never sold, never used for advertising and never used to train artificial intelligence models. Meta Platforms, Inc. and its affiliates process messages to deliver them under the WhatsApp Business terms and privacy policy, which may involve international data transfers (LGPD, art. 33).
4. What we use it for
To authenticate access, protect sessions, meet contractual obligations, improve stability and answer support requests. On connected channels we use data only so the business can send and receive messages with its customers. We do not sell personal data or use customer data for third-party advertising.
5. Legal bases
We process data to perform a contract, to meet legal obligations, for the legitimate interest of information security and, when required, with specific consent. WhatsApp messages rely on the consent (opt-in) that the business must obtain from the end customer, which can be withdrawn at any time by writing STOP.
6. Sharing
Data may be processed by cloud, e-mail and monitoring providers, and by Meta on WhatsApp channels, always under contract and the controller's instructions. Public authorities receive data only when the law requires it.
7. Retention
We keep data for as long as needed for the purpose and for legal obligations. Security logs and tax records follow their own periods. The raw content of events received from Meta is discarded after 30 days. Outbound message content is also removed after 30 days. After an account is closed, operational data is deleted or anonymized within the verified scope. After consent evidence expires, only the protected identifier needed to honor do-not-contact requests remains. Deletion requests are handled as described in Data deletion.
8. Your rights
The 30-day period refers to the operational database. Backups are included in the final review of deletion requests and are not used for customer support or messaging. Deletions and do-not-contact restrictions must be reapplied before resuming operation after a restore.
You may request confirmation of processing, access, correction, anonymization, portability, deletion, information about sharing and withdrawal of consent. Requests can be sent to your organization's data officer or to the contact below.
9. Security
We use encryption in transit (HTTPS), encryption of tokens and received events, password hashing, session control, two-step verification, per-business data isolation, verified signatures on Meta webhooks and event logging. No system is risk-free; we report relevant incidents as required by the LGPD and ANPD regulations.
10. Contact
Questions about this notice: murilofonseca126@hotmail.com. You may also lodge a complaint with the ANPD if you believe your rights were not met.