Privacy Policy

This is a courtesy translation. In case of any discrepancy, the Portuguese version prevails.

Your privacy matters to us. Learn how we process your personal data.

Your privacy is very important to us, FULFILLING INTELIGENCIA E DESENVOLVIMENTO LTDA., a private legal entity registered under CNPJ No. 30.533.081/0001-56, hereinafter referred to as "FFID". Likewise, it is also very important to us to be transparent about how we collect and process your personal data ("information relating to an identified or identifiable natural person"). Accordingly, the main purpose of this policy is for you to know about:

  • IOur role as a personal data processor
  • IIOur role as a personal data controller
  • IIIWhich personal data we process
  • IVThe purposes and legal bases for processing
  • VWhen and where we store personal data
  • VIThe security practices we adopt
  • VIIWith whom and for what purpose we share personal data
  • VIIIYour rights as a personal data subject
  • IXGeneral Provisions
  • XFacebook/Instagram Policy
  • XICookies and Similar Technologies
  • XIIConsent and Cookie Management
  • XIIIData from Google services
  • XIVHow long we keep your data

This policy covers the personal information collected when using the FFID customer service management platform ("FFID Platform"), thereby covering the use of personal data: a) of those who access our website; b) of the User (any person authorized by the FFID Customer to operate the FFID Platform on its behalf); and c) of third parties who use the channels integrated by FFID's services to interact with the company that contracts the use of the FFID Platform from FFID ("Customer").

I. Our role as a personal data processor

The personal data processor is the natural or legal person, governed by public or private law, that processes personal data on behalf of the controller.

Our services are aimed at legal entities. Therefore, when we make them available under a contract with our Customer, the controller of the personal data collected through the FFID Platform will be the Customer itself.

II. Our role as a personal data controller

The personal data controller is the natural or legal person, governed by public or private law, who is responsible for decisions regarding the processing of personal data.

Although in the vast majority of cases we act as a processor in the processing of personal data, in some situations we act as a controller.

III. Which personal data we process

We collect the personal data that you provide through any of the tools integrated by the FFID Platform or that you provide directly in any of the company's communication channels.

IV. The purposes and legal bases for processing

We process personal data to provide the services contracted by the Customer, to operate and protect the FFID Platform and to comply with legal obligations. The LGPD (Brazil's General Data Protection Law) legal bases we use are:

  • Performance of a contract (art. 7, V): customer service, AI agents, scheduling, CRM and advertising platform integrations.
  • Consent (art. 7, I): marketing messages and non-essential cookies.
  • Legitimate interest (art. 7, IX): service improvement, performance analysis and fraud prevention.
  • Compliance with a legal obligation (art. 7, II): retention of records required by the Marco Civil da Internet (Brazil's Internet Civil Framework) and by tax obligations.

V. When and where we store personal data

Data is stored from the moment it enters the FFID Platform, whether through an integrated channel or through direct registration. It is kept in databases hosted on cloud infrastructure, mainly Google Cloud, for the period described in section XIV.

VI. The security practices we adopt

  • All traffic between the browser, our servers and third-party APIs, including Google's, is carried over HTTPS with TLS encryption.
  • Access to the FFID Platform requires authentication, and each user only sees the data of the Customer they are linked to.
  • Connecting, configuring or disconnecting advertising platform integrations is restricted to users with a manager or administrator profile.
  • Integration access tokens (OAuth) are kept only on the server. They are never returned to the browser or written to logs.
  • When a Google integration is disconnected, the token is revoked at Google itself and deleted from our database.
  • We send third parties only the data needed for each feature, as described in sections VII and XIII.

VII. With whom and for what purpose we share personal data

We do not sell personal data. We share data only with suppliers needed to provide the services and with integrations that the Customer itself activates:

  • Cloud infrastructure providers, such as Google Cloud, for hosting and processing.
  • Meta, for sending and receiving messages through the WhatsApp Business API.
  • Artificial intelligence providers, for natural language processing by the AI agents.
  • Integrations activated by the Customer, such as CRMs and advertising platforms (for example, Google Ads), within the limits described in section XIII.

We may also share data when required by law or by order of a competent authority.

VIII. Your rights as a personal data subject

We respect your rights as a personal data subject and, when we act as a controller, we guarantee that at any time you may request:

  • • Confirmation that your personal data is being processed
  • • Access to the personal data we process about you
  • • Correction of incomplete, inaccurate or outdated personal data
  • • Anonymization, blocking or deletion of unnecessary or excessive data
  • • Portability of data to another service provider
  • • Deletion of your data processed with your consent
  • • Information about data sharing
  • • Withdrawal of consent

IX. General provisions

If you have any questions about this Privacy Policy or any matter related to the protection of your personal data, you can contact us by e-mail:

dpo@ffid.com.br

X. Facebook/Instagram Policy

For more information about integration with Meta platforms: Read on Facebook

XI. Cookies and Similar Technologies

We at FFID use cookies and similar technologies (pixels, local storage and device identifiers) to provide a more efficient, secure and personalized experience on our websites and applications. Cookies are small files stored on your device when you visit our services, allowing us to remember preferences, keep sessions active, measure performance and improve features.

The use of cookies may involve the processing of data such as online identifiers, pages visited, time spent, browsing events, language preference and technical information about the device/browser. Strictly necessary cookies are used on the basis of legitimate interest and/or performance of a requested functionality; analytics, functional and advertising/remarketing cookies are used on the basis of consent, where applicable.

Categories of cookies

  • Strictly necessary — enable essential features, such as authentication, security, fraud prevention and load balancing. Without them, the service may not work properly.
  • Performance/Analytics — collect aggregated information about usage and performance, helping us understand which pages and features are used most and improve the product.
  • Functional — remember your preferences (language, region, layout) and improve features such as forms, search and accessibility.
  • Advertising/Remarketing — allow us to measure campaigns and display relevant content/offers based on anonymous or pseudonymized interactions, where permitted.

Third-party cookies

We may also integrate third-party tools (for example, traffic analysis, social media, CRMs and advertising platforms). These third parties may set cookies and collect data under their own policies and legal bases. We recommend that you consult the privacy policies of the respective providers for more information.

XII. Consent and Cookie Management

When required, we will ask for your consent for non-essential categories (analytics, functional and advertising/remarketing). You can withdraw or change your consent at any time by adjusting your browser's cookie preferences or through the management options available in our services, when enabled.

Blocking strictly necessary cookies may compromise essential features. To manage cookies, see the help pages of your browsers (Chrome, Firefox, Safari, Edge) and clear cookies/data as desired. If you need additional support, contact our DPO at dpo@ffid.com.br.

In regions that require consent banners, we will display controls for accepting, rejecting and choosing by category where applicable.

XIII. Data from Google services

When you authorize integrations with Google services, we process only the data strictly necessary to enable the requested features:

  • Google Calendar — we use availability information (free/busy) to facilitate scheduling and time synchronization. We do not access the content of events, descriptions, guest lists, attachments or sensitive data.
  • Google Login (OAuth) — we capture name and e-mail for authentication and for creating and managing your account. Access tokens are stored with security controls and renewed as needed.
  • Google Ads: when a Customer manager connects the Google Ads account, we request two permissions.
    • adwords: used for reading only. We list the ad accounts the user has access to, including accounts linked to a manager account (MCC), and the conversion actions of each account, so that the manager can choose where to send qualified leads and sales. We also read campaign, keyword and ad metrics for the platform's reports. We do not create, change or delete anything in the Google Ads account.
    • datamanager: used to send to Google Ads, through the Data Manager API, offline conversions for leads that the Customer has marked as qualified or as a sale. Each conversion carries only the ad click identifier (gclid, gbraid or wbraid), the date and an internal event code. We do not send the lead's name, e-mail, phone number or any other personal data.
    The manager can disconnect the account at any time in the FFID Platform. On disconnection, the access token is revoked at Google and deleted from our database.

The use and transfer, to any other app, of information received from Google APIs adhere to the Google API Services User Data Policy, including the Limited Use requirements. Data received from Google APIs is not used for advertising to third parties, is not sold and is not used to train artificial intelligence models.

The applicable legal basis may be consent, performance of a contract or legitimate interest, as the case may be. The data is used exclusively for the purposes described, kept for the time necessary to run the features, and is not shared with third parties, except when required by law or to comply with contractual obligations with the provider itself.

You can revoke access at any time in your Google account settings and request deletion of the linked data by contacting our DPO.

XIV. How long we keep your data

If you are an active customer, we will keep your personal data for as long as our contractual and/or commercial relationship lasts. After it ends, we may retain data in a controlled environment for up to 5 years, when necessary to comply with legal obligations, for the regular exercise of rights, audits and fraud prevention.

For prospective customers with no contractual/commercial relationship, we will keep the data only for the period necessary for the stated purpose (for example, commercial contact), discarding it when there is no applicable legal basis. Technical logs and metrics may be retained for periods compatible with security, monitoring and continuous improvement.

We observe the principles of necessity, adequacy and data minimization. You can request information about data retention or deletion at dpo@ffid.com.br.

This Privacy Policy will be governed by and construed exclusively in accordance with the laws of Brazil, especially the General Data Protection Law (Federal Law 13.709/2018).