Privacy Policy

Depending on your interaction with the service, we may process:

• Account data: email, name, phone number, company, language and access permissions.
• Operational data: contacts, business history, messages and information provided or received through imports and connected channels.
• Business context: materials you provide, content from specified pages and, when used, audio and transcripts.
• Billing data: plan, subscription, transactions and information made available by the payment processor.
• Technical and support data: browsing activity, device, identifiers, usage events, technical records and communications with support.

We process data to provide accounts, perform requested functions, process payments, provide support, protect the service, investigate faults and understand how it is used.

Legal bases depend on the purpose and the relationship with the individual and may include contract performance, compliance with legal obligations, the regular exercise of rights, legitimate interests and consent, where applicable. Legitimate interests require an assessment of necessity and individuals' rights; consent, when used, must relate to the specific purpose.

SalesBack determines the processing necessary to manage its relationship with users and customers. For lead data and conversations processed on behalf of a customer, that customer generally determines the purposes, and SalesBack delivers the service according to their instructions.

The customer must have a legal basis for using contacts and inform individuals about the processing. Simply providing a list to the platform does not authorize every use of that data.

AI features may process business information, conversation excerpts and other data necessary for the feature used. Technical records of these operations may contain the context submitted and the responses generated.

We use providers for hosting and databases, communications, security, payments, AI and usage analytics. Services identified in our operations and integrations include Oracle Cloud, AWS, CloudAMQP, Cloudflare, Mailtrap, Stripe, OpenAI and Amplitude. WhatsApp also processes data under its own terms.

These providers receive data according to their role. Processing includes infrastructure in the United States and may involve other countries used by providers. Requests for information about recipients and transfers can be sent to our privacy contact channel.

Data may also be shared to comply with legal requirements and valid orders or to exercise rights, within the applicable scope.

To measure campaigns, Meta may receive browsing and confirmed registration events. The confirmation sent by the API contains advertising identifiers when available, a pseudonymized internal identifier and browser information. This confirmation payload does not include email, phone numbers or conversation content.

We use cookies and similar technologies to recognize sessions, store preferences and analyze browsing activity. Amplitude receives identifiers and events and may receive name, email, company, account role, language, plan and subscription status.

We also use session replay to investigate navigation difficulties. This technology reconstructs interactions with the interface and may involve information displayed on screen, depending on the collection and masking configuration.

You can manage cookies in your browser settings; some restrictions may affect features. This control does not necessarily cover all event collection or replay. For information and requests about these tools, contact us.

The duration of processing depends on its purpose, service delivery and applicable obligations. Ending a subscription does not mean immediately deleting all records: specific data may need to be retained for legal obligations or the exercise of rights.

You can request information about retention criteria and ask for deletion through our privacy contact channel. Assessment takes into account the data involved, the respective responsibilities of the customer and SalesBack, and any legal grounds for retention.

Protecting data requires technical and administrative measures appropriate to the operation. No service eliminates every risk. Suspected unauthorized access or incidents can be reported through our contact channel.

Under applicable law, you may request confirmation and access, correction, information about sharing, portability, restriction or deletion, withdrawal of consent, objection and review of solely automated decisions that affect your interests.

Send your request to [email protected]. We may need to verify your identity proportionately to protect your data. Where processing takes place on behalf of a customer, we will work with them to route and address the request. You may also contact Brazil's data protection authority, ANPD, and other competent authorities.

This policy may be updated as the service and processing practices evolve. Material changes will be communicated through available channels. New purposes that depend on consent will require a specific choice.