Privacy Policy
Privacy Policy
*This is a translation provided for reference only. In the event of any discrepancy, the Brazilian Portuguese version shall prevail, as it is the only legally binding version.*
Last updated: 2026-11-03
This Policy describes the processing of personal data on the Platform, under the terms of the LGPD (Brazilian General Data Protection Law, Law 13.709/2018).
1. Controller and Data Protection Officer
DEVSCALE TECNOLOGIA LTDA (trade name DevScale), CNPJ (Brazilian corporate taxpayer ID) 68.314.003/0001-33, headquartered at Av. Eng. Luiz Carlos Berrini, 1748, Andar 21, Sala 2103, Cidade Monções, São Paulo/SP, CEP 04571-000.
Data Protection Officer (DPO): DevScale Tecnologia Ltda., via the e-mail contato.devscale@gmail.com.
2. Personal data processed
The platform processes data of three groups:
2.1 Platform users (contracting parties and their staff)
| Data | Source | Purpose |
|---|---|---|
| Name, e-mail, phone number | Registration | Authentication, communication, billing |
| CPF/CNPJ (Brazilian individual/corporate taxpayer ID) | Registration | Tax invoicing, fraud prevention |
| Password (bcrypt hash) | Registration | Authentication |
| MFA secret (encrypted) | Optional setting | 2FA |
| Access logs and records of acceptance of the terms (IP, user-agent, date and time) | Automatic | Security, auditing and proof of acceptance |
| Billing address | Payment registration | Billing |
2.2 Contacts of the contracting party (third parties, leads/customers of the contracting party)
| Data | Source | Purpose |
|---|---|---|
| Name, phone number, e-mail | Imported CSV, received messages, forms | Operation of the CRM by the contracting party |
| Address | Manual registration | Operation of the CRM by the contracting party |
| Message history (WhatsApp, Instagram, Facebook, e-mail) | Integrated channels | Customer service and CRM |
| Media (images, audio, documents) | Received messages | Customer service |
| Audio transcriptions | Automatic, upon receiving audio | Viewing and searching as text |
| Call records (and recordings, if enabled) | Telephony, when activated | Customer service and history |
| Tags, pipeline, stage | Manual or automatic assignment | Operational organization |
| Appointment history | Scheduling | Operation |
Important: regarding contact data, the controller is the contracting party (workspace). The Company acts as processor, processing such data only in accordance with the contracting party's instructions. When the contracting party is a customer of a Reseller (white label), the Reseller also acts as processor and the Company as sub-processor.
2.3 Technical data (all users)
| Data | Source | Purpose |
|---|---|---|
| Usage metrics | Automatic | Observability, usage-based billing |
| Error logs | Automatic | Incident diagnosis |
audit_logs (administrative actions) | Automatic | Compliance and auditing |
webhook_events (received payloads) | Automatic | Debugging and deduplication |
3. Legal bases (LGPD art. 7 and 11)
| Processing | Legal basis |
|---|---|
| Authentication, billing, support | Performance of a contract (art. 7, V) |
| Auditing, fraud prevention | Legitimate interest (art. 7, IX) |
| Analytics cookies (if applicable) | Consent (art. 7, I) |
| Marketing communications (opt-in) | Consent (art. 7, I) |
| Compliance with tax obligations | Legal obligation (art. 7, II) |
| Responding to requests from authorities | Legal obligation (art. 7, II) |
4. Use of data for AI training
The Company does not use the content of the contracting parties' conversations, contacts or knowledge bases to train artificial intelligence models. Content sent to AI providers serves only to generate the requested response, transcription, image reading or knowledge base search.
5. Where the data is stored and with whom it is shared
The Platform is hosted on virtual private servers (VPS) in Brazil (state of São Paulo). Encrypted backup copies are stored with a second provider, in the United States.
| Sub-processor | Data shared | Purpose | Location |
|---|---|---|---|
| Hostinger | All Platform data (database, media) | Hosting | Brazil |
| Hetzner | Encrypted backup copies | Backup | USA |
| OpenRouter | Content of conversations handled by AI, audio for transcription, images for reading and knowledge base content, for semantic search | AI inference | USA |
| OpenAI | Content of conversations handled by AI, audio for transcription, images for reading and knowledge base content, for semantic search, when the contracting party uses its own OpenAI key | AI inference | USA |
| Meta (WhatsApp, Instagram, Facebook) | Messages, external contact | Sending and receiving messages | USA/Ireland |
| Composio / Google | OAuth tokens (encrypted) and calendar/file data authorized by the contracting party | Integration with Google Calendar and Google Drive | USA |
| Asaas | Billing data, amounts | Processing charges | Brazil |
| Stripe | Billing data, amounts | Processing international charges | USA |
International transfers: carried out for the performance of the contract and with providers that adopt data protection safeguards, under the terms of art. 33 of the LGPD.
6. Data retention
| Category | Period |
|---|---|
audit_logs (administrative actions) | 90 days |
webhook_events (received payloads) | 30 days |
| Expired or used reset/invite tokens | 30 days |
| Revoked/expired refresh tokens | 30 days |
| Messages, contacts, tickets, appointments | While the account is active, or as per a deletion request |
| Billing data | 5 years (tax obligation) |
| Backups | 3 most recent daily copies |
After the account is closed, data is deleted within 30 days, except for data retained due to a legal obligation. Backup copies are automatically replaced by the most recent ones.
7. Data subject rights (LGPD art. 18)
The data subject may, free of charge, request:
- Confirmation of the existence of processing;
- Access to the data;
- Correction of incomplete, inaccurate or outdated data;
- Anonymization, blocking or deletion of unnecessary data or data processed in non-compliance;
- Data portability;
- Deletion of the data (subject to the legal bases that justify retention);
- Information about sharing;
- Withdrawal of consent.
How to exercise: e-mail contato.devscale@gmail.com or the support form. Response within 15 business days.
For workspace contacts (group 2.2): the request must be directed to the contracting party, which is the controller. The Company, as processor, will carry out the instruction it receives from the controller.
8. Security
Technical and organizational measures applied:
- Encryption in transit: TLS on all public connections (HTTPS);
- Credentials: passwords with bcrypt; AI keys, integration tokens and payment tokens with AES-256-GCM, never displayed in full;
- Isolation between customers: all queries are filtered by the company (workspace) of the authenticated user, with automated isolation tests; an additional layer of Row Level Security in the database is being gradually rolled out;
- Backups: daily, encrypted, stored with a separate provider and cannot be altered or deleted from the production server;
- Rate limiting: per workspace, prevents abuse;
- Auditing: logs of administrative actions retained for 90 days;
- Internal access: principle of least privilege; administrative access to the servers only via cryptographic key.
In the event of a security incident affecting personal data, the ANPD (Autoridade Nacional de Proteção de Dados — Brazilian National Data Protection Authority) and the affected data subjects will be notified within a reasonable period (LGPD art. 48).
9. Cookies
The Platform uses cookies that are strictly necessary for its operation (session, authentication and language). There are no marketing or analytics cookies by default. On the reseller sign-up page, with consent, we use the Meta Pixel and a campaign attribution cookie for 90 days.
10. Children and adolescents
The Platform is not directed at persons under 18 years of age. The contracting party is responsible for not registering minor contacts without the proper parental consent, where applicable.
11. Changes to this Policy
Material changes will be communicated 30 days in advance, via e-mail and/or notice in the interface. Continued use after the effective date implies acceptance.
12. Contact
- Data Protection Officer (DPO): contato.devscale@gmail.com
- Phone: (11) 3042-6308
- Address: Av. Eng. Luiz Carlos Berrini, 1748, Andar 21, Sala 2103, Cidade Monções, São Paulo/SP, CEP 04571-000