Privacy Policy

Azendy acts in two ways: as controller of the registration and usage data of the businesses that contract the Platform; and as processor of the data those businesses handle about their own customers (appointments, customer service, history), following the instructions of each business, which is the controller of that data.

The obligations between the business (controller) and Azendy (processor) are set out in the Data Processing Addendum (in Portuguese).

We collect the data needed to operate the Platform:

• Account data: name, email, phone and credentials of the professionals and administrators of the businesses.
• Data of the business's customers: name, phone, email, appointments, services, amounts and service history — processed on behalf of the business.
• WhatsApp communication data: phone number, profile name and the content of messages (text, image, audio and documents) exchanged between the customer and the business through the service channel, used to enable and record that service.
• Instagram Direct communication data: when the business connects an Instagram professional account, we receive from Meta, about the people who write to that account on Direct: the identifier Instagram assigns to that person in the conversation with the business (Instagram ID, which is neither the phone number nor the @), the name, the @ (username) and the profile picture, and the content of the messages exchanged with the business — text, photo, video, audio and documents, including replies to the business's stories and stories in which the person mentions the business and, when the conversation starts from one of the business's ads, the identification of that ad. Replies the team sends from the Instagram app itself are also recorded, so the service history is complete. The profile lookup also returns the person's follower count and whether they follow the business; these two pieces of information are not stored. We do not receive from Instagram any phone number, email, password or messages from the person's other conversations.
• Connected Instagram account: the ID, @, name and picture of the business's professional account, and the access token issued by Meta, kept in a secrets vault and renewed automatically while the connection is active.
• Health data (where applicable): answers to anamnesis forms and clinical information the business records to perform the procedure. They are sensitive personal data and follow section 6.
• Images and audio: portfolio photos and videos, before-and-after images, and audio sent during customer service, to the extent the business uses these features.
• Payment data: information needed to process deposits and charges, processed by payment providers (we do not store full card data).
• Technical data: access logs (IP address, date and time), device data and measurement cookies/pixels, as described in section 11.

• Providing and operating the Platform (scheduling, service, orders, billing).
• Enabling WhatsApp communication between the business and its customers (confirmations, reminders and requested service).
• Showing Instagram Direct messages in the business's Conversations inbox, with the name and picture of the person who wrote, so that the business's team can serve and reply to its customers right there — and recording which of the business's ads the conversation came from, when applicable. We do not sell this data, we do not use it for advertising and we do not combine it with data from other businesses.
• Operating the artificial intelligence features contracted by the business, as described in section 5.
• Processing payments and issuing tax documents.
• Preventing fraud, ensuring security and complying with legal obligations.
• Providing technical support — which may involve accessing the business's account, as described in section 9.
• Improving the Platform based on aggregated and anonymized data, which does not identify any person or business.

We process personal data on the basis of:

• performance of a contract and pre-contractual procedures (art. 7, V);
• compliance with a legal or regulatory obligation (art. 7, II);
• legitimate interest, where applicable and without overriding the data subject's rights (art. 7, IX);
• consent, where required — for example, for marketing communications (art. 7, I) and for health data (art. 11, I);
• protection of health, in a procedure performed by a health professional or health service (art. 11, II, "f"), where applicable.

The Platform offers artificial intelligence features that the business contracts and activates: suggesting and writing replies in customer service, summarizing a conversation, consulting the business's own manual and supporting scheduling.

To do so, the necessary content of the conversation and of the service is sent to our AI provider, OpenAI, with servers in the United States. This happens without retention on the provider's side: the data is used to generate that reply and is not kept by the provider.

We do not use customer data to train third-party AI models. When the business chooses to improve the AI based on its own conversations, this happens only within its own account, upon specific and reversible activation.

On Instagram Direct, the AI does not reply on its own to customers: service there is provided by the business's team. If someone on the team asks for the transcription of an audio message received on Direct, or if the business activates AI improvement based on its own conversations, the messages involved follow the rules of this section.

AI-generated replies may contain errors. They are a working tool of the business, which is responsible for the content sent to its customers, as set out in the Data Processing Addendum.

Anamnesis forms and clinical information are sensitive data and require specific and prominent consent, or another legal ground under art. 11 of the LGPD. The Platform keeps the exact text of the consent at the moment of signature, including regarding the use of images — and the business, as controller, is the one that collects it and is responsible for it.

Services provided to people under 18 must comply with art. 14 of the LGPD, in the best interest of the child or adolescent, with the consent of at least one parent or legal guardian where required. Obtaining that consent is the business's responsibility.

We do not sell personal data. We share data only when necessary to operate the Platform, with the companies listed — by name, with purpose, data accessed and country — at azendy.com.br/subprocessadores (in Portuguese). Among them: Amazon Web Services (infrastructure), Meta Platforms (WhatsApp and Instagram), OpenAI (artificial intelligence), Vercel, Resend, Asaas, Pagar.me/Stone, Mercado Pago, Whop and Focus NFe.

We also share data with authorities, when required by law or court order, and in the integrations that the business itself activates.

These partners process the data according to our instructions and are subject to confidentiality and security obligations.

Part of the processing and storage takes place outside Brazil — in particular in the United States, in the cloud infrastructure, in the WhatsApp and Instagram channels and in the artificial intelligence features. The subprocessors page identifies the country of each company. These transfers are necessary for the performance of the contract and rely on the applicable contractual safeguards (LGPD, art. 33).

To diagnose problems, our team may access a business's account, seeing the same screens it sees. This access is logged (who entered, when they entered and when they left), expires automatically and takes place to resolve a support ticket, investigate an incident or comply with a legal obligation. The business may request the log of accesses to its account.

We keep each piece of data for as long as necessary for its purpose:

• Data of the business's customers: for as long as the contract lasts, according to the instructions of the business, which is the controller.
• Instagram Direct conversations: like the other conversations, they stay in the business's history for as long as the contract lasts — including if the business disconnects Instagram or removes Azendy from the account's permissions, which only stops new messages from being received. They are removed earlier if the person requests deletion, as described in section 12.
• After the account is closed: the business has 30 days to request an export of the data. After that period, we delete or anonymize the personal data processed on its behalf.
• Access logs: at least 6 months, as required by art. 15 of the Brazilian Internet Civil Framework (Marco Civil da Internet).
• Tax and financial documents: for the period required by tax law, generally 5 years.
• Proof of acceptance of the Terms: while there is a contract and for the applicable limitation period, for defense in any legal proceeding.

The Platform and the booking pages use cookies necessary for operation and security (session, authentication, fraud prevention), which do not depend on consent.

Measurement and advertising cookies and pixels (for example Meta, Google, TikTok) are used according to each business's configuration of its booking page, and on Azendy's website to measure our own funnel. You can accept or decline these cookies in the notice shown, and change your mind at any time by clearing your browser's cookies.

As a data subject, under the LGPD (art. 18) you may request:

• confirmation that processing takes place and access to the data;
• correction of incomplete, inaccurate or outdated data;
• anonymization, blocking or deletion of unnecessary data;
• portability and information about sharing;
• withdrawal of consent, where that is the legal basis.

We will reply within 15 days of receiving the request, at the address in section 14. We may ask for information to confirm your identity before responding — handing personal data to someone who is not the data subject is also a violation.

For data processed on behalf of a business (customers of a clinic or salon), the request is handled by the business itself, which is the controller. In that case, we forward your request to it and let you know that we have done so.

Deletion of Instagram Direct data. If you talked to a business on Instagram Direct, you can request the deletion of your data through Instagram itself. Meta sends us the request automatically, signed, through the data deletion address we registered with it (api.azendy.com.br/public/v1/integrations/instagram/data-deletion), and the deletion runs immediately, across all businesses using Azendy that you talked to on Direct.

We delete the Direct conversations and messages, the files (photos, videos, audio, documents and your profile picture) and the records of receipt of those messages. In the business's funnel, the record of the conversation remains without your name and contact details. Appointments, orders and tax invoices that already exist stay with the business, which is required by law to keep them, as does any customer record the business has created for you.

Meta shows you a confirmation code, which you can use to track the request at azendy.com.br/exclusao-de-dados. Of the request, we keep only its record (Meta's identifier, the code, the date and how many items were deleted), without the deleted content. You can also request deletion at the address in section 14.

We adopt technical and organizational measures to protect data against unauthorized access, loss or alteration — including role-based access control, available two-factor authentication, encryption in transit, isolation between businesses, audit logging and daily backups.

In the event of a security incident that may cause relevant risk or harm, we notify the affected controllers and, to the extent it falls to us, the Brazilian National Data Protection Authority (ANPD) and the data subjects, within the deadlines set by the applicable regulation.

Vulnerabilities can be reported to security@azendy.com.br.

To exercise your rights or ask questions about privacy, contact our Data Protection Officer:

privacidade@azendy.com.br

Azendy Tecnologia LTDA - ME — CNPJ 62.492.990/0001-80.

We may update this Policy from time to time. The date of the last update is shown at the top, and previous versions are archived. Relevant changes will be communicated through the appropriate channels.