1. Who this policy covers
- Visitors to braveinnov.com.
- Business customers — the businesses that use the Braveinnov platform, and the people who log in on their behalf.
- Their contacts — people who send a business a form, an email or a WhatsApp message handled through the platform.
2. Our role
For visitors and for business customers' account data, Braveinnov is the controller. For the data of a business's own contacts — leads, customers and their messages — the business is the controller and Braveinnov is the operator (processor): we process that data only to provide the platform to the business and on its instructions. Contacts who want to exercise their rights should write to the business first; we will help the business answer.
3. What we process
- Visitors: technical data needed to deliver the website (such as IP address and browser information), handled by our hosting and network provider. To display the page, your browser also loads fonts from Google Fonts and a script from jsDelivr, which receive your IP address. This website sets no advertising or analytics cookies. The sign-up fields on the home page are not active yet; nothing typed in them is sent or stored.
- Business customers: name, email and phone of account users, the business's identification and settings, and records of use of the platform.
- Contacts of a business: what they send through the business's form, email or WhatsApp channel — such as name, phone number, email address, message content, attachments and delivery and read status.
- WhatsApp connection data: when a business connects WhatsApp through Meta's Embedded Signup, we receive and store its WhatsApp Business Account ID, phone number ID, display phone number and an access token issued by Meta that lets the platform send and receive messages for that business. For each WhatsApp contact we may receive the phone number, the profile name and the business-scoped user ID that Meta provides. We do not receive the business's Facebook password.
4. Why we process it, and on what legal basis
- To provide the platform a business has contracted, including sending and receiving its messages — performance of a contract (LGPD art. 7, V).
- To process contacts' data on a business's behalf — on the business's instructions, under the legal basis the business relies on as controller.
- To keep the platform secure, prevent abuse and fix faults — legitimate interest (art. 7, IX).
- To meet legal and tax obligations — legal obligation (art. 7, II).
We do not sell personal data, and we do not use contacts' messages for advertising.
5. Who we share it with
- Meta Platforms (WhatsApp Business Platform), to send and receive WhatsApp messages for the businesses that connect WhatsApp. Meta's own terms and privacy policy apply to its processing.
- Service providers that run parts of the platform for us under contract, including website hosting and network (Cloudflare), email delivery (Resend) and our own email (Google Workspace).
- Authorities, when the law requires it.
6. International transfers
Some of these providers process data outside Brazil, including in the United States. We use them under contractual safeguards, as LGPD art. 33 allows.
7. How long we keep it
We keep data while the business's account is active. When a business disconnects WhatsApp, we delete its stored access token. When an account is closed, or when deletion is requested under section 9, we delete or anonymise the related personal data within 90 days, except what we must keep to meet a legal obligation.
8. Security
Access tokens and other credentials are kept in a dedicated secrets store, never in the website and never sent back to a browser. Access to personal data is limited to what each person needs.
9. Your rights
Under LGPD art. 18 you may ask us to confirm whether we process your data, give you access to it, correct it, anonymise, block or delete it, port it, tell you whom we share it with, and withdraw consent where consent is the basis. You may also complain to the national authority, ANPD. To exercise any right, write to [email protected]. How to have your data deleted is explained on our Data Deletion page.
10. Contact
Our contact for personal-data matters (encarregado) is Tecnology, at [email protected]. Postal address: Avenida Tenente Haraldo Egidio de Souza Santos, 66, Sala 01, Jardim Chapadao, Campinas – SP, 13070-160, Brazil.
11. Changes
We will publish any change to this policy on this page, with its new effective date.