Privacy Policy

This policy explains how Atendoa (“we”) processes personal data while operating its AI customer service platform. We follow Brazil's General Data Protection Law (Law No. 13,709/2018 — LGPD). It applies to account holders, invited team members, and visitors who talk to assistants published by our customers.

Account data: name, email address, and an irreversibly hashed password, plus organization membership and role.

Business content:documents, text, and website pages submitted to create an assistant's knowledge base.

Chat and lead data: messages, response feedback, and contact details that a visitor voluntarily submits.

Technical data: operational records used for security, abuse prevention, and plan limits. Essential cookies and local preferences include login, language, theme, and recent chat session identifiers. If you accept advertising cookies, we also store the identifier of the ad that brought you here (see section 8).

• to create accounts, organizations, and team access;
• to generate answers from content provided by the customer;
• to show conversations, usage metrics, and leads in the dashboard;
• to send transactional emails and protect the service;
• to comply with applicable legal obligations.

We do not sell personal data or use customer content for advertising.

The business that publishes an assistant is the controller of its visitor conversations and leads. Atendoa acts as its processor, handling that data according to the business's instructions and this policy. Requests about a conversation should first be directed to the business responsible for the website.

We use providers required to operate hosting, databases, file storage, transactional email, and AI models. AI providers receive the visitor's question and relevant knowledge excerpts only to produce the requested answer. Providers may operate outside Brazil; international transfers follow the safeguards required by the LGPD.

We retain data while an account is active and as needed for the purposes described here or legal obligations. We use HTTPS, irreversibly hashed passwords, organization-level data isolation, role-based access controls, and abuse limits. Deleted content is removed from active systems within a reasonable period.

Subject to applicable law, you may request confirmation, access, correction, portability, information about sharing, consent withdrawal, anonymization, or deletion. Contact [email protected]. We respond within the periods required by the LGPD and other applicable law.

Essential, always on: session cookie (login) and language preference, plus local storage for theme and recent chat session identifiers. The site does not work without them, so they do not depend on consent.

Audience measurement: we use Cloudflare Web Analytics to count visits. It sets no cookie and creates no visitor identifier. We also use Google Analytics 4 to understand navigation on the site; Google analytics cookies are only enabled after you accept the notice shown on your first visit.

Advertising, only with your consent:we advertise on Google Ads and use the Google tag to learn which ads bring visitors. It only sets a cookie after you accept in the notice shown on your first visit — until then, and if you decline, it stays disabled. You can change your mind at any time by clearing this site's data in your browser, which brings the notice back.

We also store, in a first-party cookie, the ad identifier (“gclid”) and campaign parameters from your first visit, for 90 days, so we can tell which ad led to a signup. This cookie is ours, not a third party's, and is not used to show you ads.

We may update this policy to reflect changes to the service or law. Material changes will be communicated through the dashboard or by email. For questions, contact [email protected] or read our Terms of Use.