AgenWeb Privacy Policy

This is a translation provided for convenience. The Portuguese version at /privacidade prevails in case of conflict.

This Privacy Policy explains how AgenWeb processes personal data when you visit the website, subscribe to AgenWeb News, talk to our team, use AgenWeb Empresas, AgenWeb Work, AgenWeb Reviews or the agent template Marketplace, or chat on WhatsApp or on Instagram (Direct or comments) with a business that uses AgenWeb. It was prepared in accordance with Law No. 13,709/2018 (the Brazilian General Personal Data Protection Law, "LGPD"), Law No. 12,965/2014 (the Brazilian Civil Rights Framework for the Internet, "Marco Civil da Internet"), Decree No. 8,771/2016 and the regulations of the Brazilian National Data Protection Authority ("ANPD").

This Policy is a transparency notice. It describes what we do with data, but it does not ask for or replace your consent: when a purpose depends on consent, it will be requested separately and prominently. Reading this Policy or acknowledging it does not amount to consenting to any processing. The contractual relationship with those who hire AgenWeb is governed by the Terms of Use (in Portuguese) and their Annex I (Personal Data Processing Conditions). If there is a signed contract with a business customer about the processing of data on its behalf, that contract prevails as to what it regulates in the relationship between the parties, without reducing the data subjects' rights provided in this Policy and in the law.

READ CAREFULLY. The main points of this Policy:

• AgenWeb is the controller of the data of those who visit the website, subscribe to the News, talk to our team, or hire and use our products. It is the processor of the data of a business customer's end customers, such as those served by the AI agents or those who visit the Reviews pages, and of the content of the Work Pro cloud environment: in these cases, the one who decides on the processing, as controller, is the business customer or the Work Pro subscriber (section 3).
• If you chatted on WhatsApp or on Instagram (Direct or comments) with a business that uses AgenWeb, make your requests about your data to that business first. If you write to AgenWeb, we forward the request to it and help it respond (section 13.5).
• AgenWeb does not sell personal data.
• The AgenWeb Empresas agents use third-party AI models, hired via API by AgenWeb. Under these providers' terms, data sent via API is not used to train their models. AgenWeb does not use personal data to train general-purpose AI models. In AgenWeb Work, the terms of the provider you choose apply (section 7).
• Part of the processing takes place outside Brazil, mainly in the United States (section 9).
• The AgenWeb website does not set advertising cookies or third-party analytics tools. Third-party videos and posts embedded in some posts follow those third parties' rules (section 10).
• Some data remains stored after an erasure request, when the law requires it or when it is needed to prove the contracting and the consent or to investigate and defend rights, such as in complaints, suspected fraud and legal proceedings. This data is blocked from ordinary use (section 11.1).
• The person in charge of personal data processing (Data Protection Officer, "encarregado") is Kauan da Silva Guedes. You can contact him and exercise your rights by email at kauan@agenweb.com.br. In cases where AgenWeb is the controller, the response is given within 15 days. The deletion instructions are on the Data Deletion Instructions page (sections 1.2, 13 and 14).

This summary helps reading, but does not replace the full text.

1. Who we are and how to contact AgenWeb

This section identifies AgenWeb, explains how the privacy channel works and defines the terms used in this Policy.

1.1 Identification of the controller

The data that AgenWeb processes as controller is under the responsibility of AgenWeb, 65.977.148 KAUAN DA SILVA GUEDES, CNPJ 65.977.148/0001-26, with address at Rua Glicéria Santos, 13, Apt 401, Acupe, Salvador/BA, CEP 40290-180, Brazil ("AgenWeb" or "we").

• Email: kauan@agenweb.com.br
• Business phone and WhatsApp: +55 (71) 99270-4744
• Website: https://agenweb.com.br

1.2 Data Protection Officer and privacy channel

AgenWeb appoints as the person in charge of personal data processing (art. 41 of the LGPD) the business owner responsible for it, Kauan da Silva Guedes, who can be contacted by email at kauan@agenweb.com.br.

The Data Protection Officer performs the duties of art. 41, §2, of the LGPD: receives complaints and communications from data subjects, provides clarifications and takes action; receives communications from the ANPD and takes action; and guides the people who work for AgenWeb on personal data protection practices. To contact him or exercise your rights, use the privacy channel:

• Email: kauan@agenweb.com.br, with the subject "Privacidade" (Privacy), "Exclusão de dados" (Data deletion) for deletion requests, or "Denúncia de conteúdo" (Content report) for reports of scams, spam or misuse (section 13.7).
• Mail: at the address in section 1.1, to the attention of the Data Protection Officer, marked "Privacidade" (Privacy).

1.3 Terms used in this Policy

• Personal data: information related to an identified or identifiable natural person.
• Sensitive personal data: data on racial or ethnic origin, religious belief, political opinion, membership of a trade union or of a religious, philosophical or political organization, health, sex life, genetic or biometric data, when linked to a natural person (art. 5, II, of the LGPD).
• Data subject: the natural person to whom the personal data refers.
• Processing: any operation performed with personal data, such as collection, use, access, storage, sharing and erasure.
• Controller: the one who makes the decisions about the processing.
• Processor: the one who processes personal data on behalf of the controller.
• Pseudonymization: replacing a piece of data, such as the IP address or the CPF (Brazilian individual taxpayer number), with a code calculated with a secret key (HMAC), which does not show the original data. Pseudonymized data is still personal data, because whoever has the key can associate it with the person (art. 13, §4, of the LGPD).
• Business customer: the legal entity or the professional that hires AgenWeb to use the AI agents in customer service or another product aimed at businesses, such as AgenWeb Reviews, including its branches. In the Terms of Use, it is the "Contratante" (Customer).
• End customer: the person who chats with a business customer on WhatsApp or on Instagram (Direct or comments), fills out one of its forms, such as the voucher form, receives its campaigns or visits one of its Reviews pages ("Cliente Final", in the Terms of Use).
• User: whoever accesses the console or the app with an AgenWeb account, including the people on the business customer's team ("Usuários Autorizados", Authorized Users, in the Terms of Use).
• Account Administrator: the user with the owner role in the business customer's account.
• Console: AgenWeb's web console, at app.agenweb.com.br ("Console", in the Terms of Use).
• Direct Connection ("Conexão Direta"): a former connection method, using software run on AgenWeb's server, which still serves some existing customers during the transition to Meta's official platforms (section 4.5).
• Suppliers: companies hired by AgenWeb that process data on its behalf or, when AgenWeb is the processor, on behalf of the business customer, in which case the Terms of Use call them "Suboperadores" (Sub-processors) (section 8.3).

2. Who this Policy applies to

This Policy applies to:

• Visitors to the agenweb.com.br website, including AgenWeb News (agenweb.com.br/news) and the agent template Marketplace (agenweb.com.br/marketplace).
• AgenWeb News subscribers and those who receive AgenWeb's communications by email or WhatsApp.
• Prospects who book a call, write to or call AgenWeb, and those who take part in comment campaigns on the Instagram profiles operated by AgenWeb.
• Business customers and console users of AgenWeb Empresas, including the people on the business customer's team.
• End customers who chat on WhatsApp or on Instagram (Direct or comments) with a business customer, fill out its voucher form or receive its campaigns.
• AgenWeb Work subscribers and users, the AI agent app for computers.
• Stores that use AgenWeb Reviews and the people who visit the review pages or tap the NFC cards.
• People whose data appears in the apps a business customer connects to the agents or in its cloud computer, such as those who exchange emails with the business (sections 4.11 and 4.12).

2.1 What this Policy does not cover

• The processing carried out by the business customer itself. As controller, each business customer decides how it uses its customers' data and must have its own privacy notice. This Policy describes what AgenWeb does as processor, but does not replace that notice.
• Third-party platforms and services that have their own purposes or that you use on your own, such as WhatsApp, Instagram, Google, the AI providers you connect to AgenWeb Work and the apps the business customer connects to the agents, such as Gmail and Meta Ads, as to the data stored in them. They follow their own policies (section 8.4).
• Third-party websites accessed through links on AgenWeb's pages.

3. AgenWeb's roles: controller or processor

AgenWeb's role changes depending on the product and the situation. The table summarizes who decides on each processing.

3.1 When AgenWeb is the processor

• AgenWeb processes end customers' data only to provide the contracted service and in accordance with the business customer's documented instructions: the Terms of Use and their Annex I, the Proposal, the settings made in the console and the written requests of whoever speaks for the business (section 3.3 and art. 39 of the LGPD).
• AgenWeb does not use this data for its own purposes, such as AgenWeb's marketing, and does not sell it or share it for third-party advertising. Beyond what is needed for each customer service interaction, it only processes it for the uses the business customer authorizes in Annex I, section F, of the Terms of Use: operating, maintaining, supporting and fixing failures; configuring and adjusting the business's own agents; evaluating quality and testing changes to the service provided to that business, with restricted access and pseudonymization whenever possible, a use the business may refuse in writing; maintaining security and preventing fraud and abuse; and producing aggregated and anonymized statistics (art. 12 of the LGPD). These uses do not include training general-purpose AI models or using one business's identifiable data to configure another's agents.
• AgenWeb may process this data on its own account only to the extent necessary for platform security, the prevention and investigation of fraud, abuse and reports, compliance with a legal obligation or an order from an authority, and the exercise and defense of rights (section 11.1). For these specific purposes, it acts as controller.
• It is up to the business customer, as controller: to have a legal basis for the processing; to inform data subjects, including about the use of AI and of suppliers such as AgenWeb; to obtain consents when required and keep proof of them; and to respond to data subjects' requests, with AgenWeb's support (section 13.5).
• The services may not be resold or used to serve third-party businesses without AgenWeb's written authorization (Terms of Use, section 12.7). If a business customer does so, it remains responsible to AgenWeb for the duties in this section regarding the data processed in those interactions, including informing the data subjects and responding to their requests, and AgenWeb forwards to it the requests it receives from those data subjects.

3.2 When AgenWeb is the controller

In the other situations in the table, AgenWeb decides on the processing and is accountable for it to you and to the ANPD. Sections 4 and 5 describe the data, the purposes and the legal bases.

3.3 Instructions from the business customer

For AgenWeb, the business customer's instructions about the data processed on its behalf, such as exporting, erasing or changing who has access, are the settings made in the console and the written requests of the Account Administrator or of a user with a compatible role (Terms of Use, section 6.2, and Annex I, section C). Requests for cancellation, change or addition of an owner, disconnection of the number, full export and data deletion are only accepted from the Account Administrator, through the registered email, or from a legal representative with powers proven by articles of association, power of attorney or minutes (Terms of Use, sections 2.3 and 6.6).

• If there is a conflict between people presenting themselves as representatives of the business customer, such as in a dispute between partners, the departure of a partner or a change of management, AgenWeb may ask for proof of powers, keep the data preserved and refrain from carrying out export, erasure or access change requests until it receives a joint written instruction, a court decision or sufficient proof of who represents the business (Terms of Use, section 6.6).
• AgenWeb may refuse to carry out an instruction it considers contrary to the LGPD or another rule, such as sending campaigns to contacts without authorization or collecting sensitive data without a legal basis, and notifies the business customer (Terms of Use, Annex I, section C).
• None of this prevents the fulfillment of data subjects' rights or compliance with the law.

4. Data we process and where it comes from

The data we process depends on the product you use and on your relationship with AgenWeb. This section explains where it comes from and lists the data categories of each product.

4.1 Origin of the data

• Provided by you: what you fill in on forms, in the account and in the booking, and the content of the messages and emails you send.
• Collected automatically: technical data generated when you use the website, the console, the app or the public pages (section 4.13).
• Received from third parties: from Clerk and Google, when you sign in with your Google account; from Stripe, about the Work subscription; from WhatsApp and Meta, about the messages, the connection of the number through the WhatsApp Business Platform and the Instagram campaigns; from Google, about the store registered in Reviews; and, through Composio, from the apps the business customer connects to the agents, such as Gmail, Google Sheets and Meta Ads, what the agent reads in them to complete a task (section 4.11).
• Received from the business customer: the data the business customer sends or imports into the platform, such as the customer and purchase spreadsheet, consent records, the catalog, the knowledge base and the facts and rules it approves for the business and agent memory (section 4.6).

When you provide another person's data, such as when registering a colleague in the console or importing your business's customer list, you must have a legal basis for this and inform that person, under the LGPD. Whoever sends or imports this data is responsible for its origin, its legal basis and the authorizations they record.

4.2 Website, sales contact and AgenWeb's Instagram

• Booking a call: the data you fill in on the Cal.com booking form when scheduling a call with AgenWeb, such as your name and a means of contact, the information you choose to include and the chosen date and time.
• Contact by email, phone or WhatsApp: name, phone number, email address and the content of the conversation.
• Comment campaigns on Instagram ("comment a word and get the link by direct message"), on the Instagram profiles operated by AgenWeb: the identifier and username of the person who comments, the comment, the direct messages exchanged to deliver the link and whether the person follows the profile, because the link is only sent to followers. The metric logs of these campaigns keep Meta's identifiers only as a pseudonymized code (HMAC), with no other personal data in the text. The campaign service that runs on AgenWeb's server (section 8.3) uses this data to identify the comments, check whether the person follows the profile and send the messages.

4.3 AgenWeb News

• Subscription: email; name and WhatsApp, only if you provide them; the text of the consent shown, with date and time, and the history of previous consents, if you subscribe again; the origin of the subscription (the post on which you subscribed and the link's campaign parameters, such as utm_source and utm_campaign); the subscription status (active, pending or canceled); and the IP address of the subscription. The current form keeps the IP only as a pseudonymized code (HMAC), which does not show the IP, but is still personal data. Records of subscriptions made before this form may contain the IP address without pseudonymization.
• How the subscription works: it takes effect when you tick the consent box and submit the form (section 5.2). There is no confirmation email. We may then send a welcome email. The WhatsApp number provided is not verified.
• Another person's data: by subscribing, you declare that the email and the WhatsApp number provided are yours. Subscribing another person's data without authorization is prohibited, and AgenWeb may cancel the subscription and use its records (date, time, origin and the IP code) to investigate the abuse.
• Page metrics: post views, subscriptions and clicks on links, offers and share buttons, with the origin of the visit. The current website keeps the IP address of these records only as a pseudonymized code (HMAC), together with the browser identification (user agent), limited to 300 characters. Metric records from before the current website may contain the IP address without pseudonymization.
• Abuse prevention: to limit automated attempts on the forms, the IP address is used as a counting key, which expires within 10 minutes after the last request.
• Attribution: the visit's campaign parameters are kept in your browser's session storage and are deleted when you close the tab (section 10).

4.4 Account, contracting and use of the console (AgenWeb Empresas)

• Account and authentication: name, email, account identifier and session data. Login is done through Clerk, with a code sent to your email or with your Google account.
• Sign-in with your Google account: if you choose to sign in with Google, Google sends to Clerk, and Clerk to AgenWeb, your name, your email address, your profile photo and your Google account identifier. AgenWeb uses this data only to create your account, authenticate access and show your name and photo in the console and the app. AgenWeb does not use Google sign-in to access your Gmail, your Calendar, your Drive or your contacts. Connecting Gmail or another Google app to the agents is a separate step, done through Composio only when the business customer chooses to connect and authorizes access on Google's screen (section 4.11). AgenWeb does not sell the data received from Google at sign-in, does not use it for advertising and only shares it in the cases in this Policy that are necessary for authentication and for the account to work, such as with Clerk and with the business customer to which your account is linked. The use and transfer of this information received from Google APIs at sign-in follow the Google API Services User Data Policy, including the Limited Use requirements. You can remove AgenWeb's access to your Google account at https://myaccount.google.com/permissions (opens in a new tab).
• Link to the business customer: email and access role, such as viewer, agent, manager or owner.
• Action log: some actions taken in the console are logged with the author, date and time, such as configuration changes and the editing of replies before sending. This log may be disclosed to the business customer responsible for the account (section 13.6).
• Contracting and billing: name, email, company and the billing data needed for the payment method provided at contracting or in the Proposal.
• WhatsApp connection through Meta: when the business customer connects the number through the WhatsApp Business Platform, Meta sends to AgenWeb, with the authorization the business gives on Meta's screen, the identifiers of the WhatsApp Business account and of the number, the display name, the status and quality rating of the number and an access key, stored outside the platform's database (section 12.1). This data is used only to send and receive the business customer's messages. The business can remove this access in the settings of its business portfolio at Meta or ask AgenWeb to disconnect the number.
• Support: the content of the messages exchanged with AgenWeb's team.
• Business customer content: catalog, knowledge base, customer service rules, facts and rules of the business and agent memory (section 4.6), campaign texts and images. In general, this content does not contain personal data. When it does, AgenWeb processes it as processor.

4.5 WhatsApp customer service (end customers)

AgenWeb connects the business customer's WhatsApp number to the AI agents through the WhatsApp Business Platform (Cloud API), operated by Meta. New connections are made through it, using Meta Embedded Signup, including in the mode in which the business keeps using the same number in the WhatsApp Business app (coexistence).

Some existing customers still use, during the transition, the Direct Connection: the connection of the business's own number through software run on AgenWeb's server, which does not use the WhatsApp Business Platform. With it, messages still pass through WhatsApp's infrastructure, which handles them under its own policies. These customers are being migrated to the Cloud API.

When a business customer connects its number through the WhatsApp Business Platform (Cloud API) using Meta Embedded Signup, AgenWeb receives from Meta, on behalf of that business, end customers' messages, media, phone number and profile name, and WhatsApp Business Account data (IDs, phone numbers, message templates and status). We use this data only to answer that business's customers, show conversations in the console and keep the connection working; it is never sold or used for advertising. The business can disconnect at any time, and deletion follows our Data Deletion Instructions page.

In both methods, AgenWeb processes, on behalf of the business customer:

• Identification and contact: name, when provided in the conversation, in the WhatsApp profile or in the customer record; phone number and, in the Cloud API, the user identifier that Meta may assign to the contact; and, if the business customer records them, email and date of birth.
• Conversation content: the messages sent and received, with date, time, delivery status and an indication of who wrote them (the customer, the AI agent or a team member), including the messages the business customer's team sends through the WhatsApp app of the connected number itself.
• Media: images, audio, videos and documents sent in the conversation.
• Text extracted from media: the transcription of audio and the text read from images, documents and spreadsheets, so that the agent and the team understand what was sent.
• WhatsApp technical logs: the log of each event received from WhatsApp, which includes the content of the message and technical identifiers of the conversation.
• Records and relationship: tags, contact origin, conversation department and the purchase history recorded by the business customer (dates, quantity and accumulated value).
• Technical log of AI replies: the provider and model used, the version of the instructions and the outcome of each reply.

When the business customer uses the same number in the WhatsApp Business app and in the Cloud API, AgenWeb does not import the history of previous conversations or the app's contact list. If Meta sends this data, the platform records only a technical notice, without the content.

4.5A Instagram customer service (end customers)

When a business customer connects its Instagram professional account to AgenWeb through Instagram Login, AgenWeb receives from Meta, on behalf of the business customer: the identifier, username, name and profile picture of the connected account; the direct messages (Direct) that people send to that account and the replies sent by AgenWeb, with the identifier Meta assigns to each person on that account (IGSID), their username and their profile name; and the comments made on the account's own posts, with the author and the post, when the business turns on comment handling. AgenWeb uses this data only to show the conversations and comments in the console, so that the AI agents and the business customer's team can reply to the people who wrote or commented, and to keep the connection working. This data is not sold or used for advertising. The business customer can disconnect the account at any time in the console (Configurações › Instagram Direct, that is, Settings › Instagram Direct) or in Instagram's settings, and AgenWeb stops receiving the data. Deletion follows the Data Deletion Instructions page. Here AgenWeb is the processor, on behalf of the business customer.

4.6 Service memory and business memory

The platform has two types of memory, separated by business customer: the service memory, about those who have already chatted with the business, and the business and agent memory, about the business itself.

Service memory. So that each business customer's customer service remembers the basic context of those who have already chatted with it, the platform sends to the memory service (section 8.3), separated by business, only sentences from a closed list, written by the platform itself: the subjects discussed, chosen from a predefined list (for example, "income tax" or "opening a company"); whether the customer stated they are an MEI (individual microentrepreneur) or which tax regime they stated; the preferred contact channel and time; and the first name by which the customer asked to be called. The memory service may keep a rephrased version of these sentences, including in English.

The free text of the messages and the content of files are not sent to the memory service, nor are documents, payment data, contacts, addresses or health data. The platform also stops remembering messages in which it identifies sensitive data, a password, a credential, a CPF or a phone number, and messages transferring the conversation to the team. The memory is only used in the customer service of the business the customer chatted with, and the business customer can ask AgenWeb not to use it in its customer service.

These rules describe how the memory currently works. Records created in the memory service before the closed list was adopted may contain excerpts of customers' messages and, while they exist, may be consulted in the customer service of the business customer the customer chatted with. The platform's internal queue may also keep, in AgenWeb's database, the text of messages from before this change, which is no longer sent to the memory service. These records follow the retention and erasure rules in sections 11 and 14.

Business and agent memory. When the feature is turned on for the business customer, its agents also use a memory of facts about the business and of work rules.

• What goes in: the facts about the business approved by the owner or a manager of the business customer, or by AgenWeb's team when configuring the agents, such as opening hours, delivery options and customer service arrangements, and each agent's work rules. This memory is not meant to store end customers' personal data.
• What the system refuses: before saving a fact or a rule, AgenWeb's server refuses text containing a CPF, CNPJ (Brazilian company taxpayer number), phone number, email, card number, full address, password or other access key. Since this check depends on recognizing the data, an excerpt the system does not recognize may get through.
• Where it is kept: the text in force is kept in AgenWeb's database. That is where what the agents use comes from: the facts and rules go into the content sent to the AI provider (section 7.1) when an agent replies in customer service or when the console assistant replies to the business's team.
• Index in Supermemory: when the index is turned on, the platform sends to Supermemory (section 8.3) a copy of each fact and each rule, separated by business and by agent, only to find faster what matters for each question. Supermemory keeps this copy for search and may generate excerpts and rephrased versions from it. End customers' messages are not sent to Supermemory in this memory: the search for an end customer's question is done only in AgenWeb's database. When the search starts from a request by the business customer's team, the text of that request may be sent to Supermemory.
• Deletion of the copy: when a fact or a rule is deleted or is no longer in force, the platform asks Supermemory to delete the copy and, if the request fails, repeats it later. When a fact changes, the copy is replaced.

AgenWeb processes this memory as processor, on behalf of the business customer (section 3), and it is only used by the business's own agents and console assistant.

4.7 Campaigns, consents and vouchers

• Consents and opt-outs: the authorizations for each message category (such as customer service, order updates, product recommendations, offers and replenishment reminders), recorded by the end customer themselves in a form, such as the voucher form, or provided by the business customer in the console or when importing contacts, with the reference to the proof indicated by it; revocations; and the list of those who replied SAIR (STOP), so that they do not receive new campaigns.
• Campaigns: audience, goal, messages and status of each send.
• Store voucher form: full name, WhatsApp, CPF (stored as a pseudonymized code and the last 4 digits), date of birth (optional and, when provided, complete), what the person says they bought and the 1 to 5 rating given to the store (mandatory when the store asks for a rating of the visit), the authorization to receive offers on WhatsApp, with the version of the text, the acceptance of the store's privacy notice, the voucher issuance and redemption records and a pseudonymized code derived from the IP address, used to limit sign-up attempts. This data is used to issue and validate the voucher, prevent repeated use and inform the store of the purchase and the rating of the visit. The store offering the voucher is the controller and must provide its own privacy notice on the form.
• Voucher validation: at redemption, the store's team validates the code through a central AgenWeb WhatsApp number, which processes the number and the messages of the team member doing the validation. Messages from people not registered on this number are discarded without being recorded.
• Sales and return: the sales entered by the business customer to measure the results of customer service and campaigns.

4.8 AgenWeb Reviews

• From the store customer: name, address, photos, logo, Instagram profile and the store's Google identifier; the contact details of the person in charge provided at the sale; and the records of the sale of the cards and services. Here AgenWeb is the controller.
• From those who visit the page or tap the card: the type of event (card tap, visit, click to review on Google, to follow on Instagram or on the AgenWeb link), the page and the card, the date and time, the referring page, the campaign parameters and a session code calculated from the browser identification and language, which changes every day. These records do not store the IP address. Here AgenWeb is the processor, on behalf of the store.
• Store search on Google: to find the store, its name and city are sent to Google's Places API.

4.9 AgenWeb Work

• Account: name, email and account identifier, through Clerk, including when signing in with your Google account (section 4.4).
• Subscription: the customer and subscription identifiers at Stripe, the plan, the status, the end of the paid period and the technical log of payment events. Card data is provided directly to Stripe: AgenWeb does not receive or store the card number.
• Running tasks on the Work plan: the app runs tasks on your computer. When a task uses a model or service you connected with your own keys or accounts (such as OpenAI, Anthropic (Claude) or xAI (Grok)), the necessary context is sent to that provider, under the terms you accepted with it.
• Computer Use: when you authorize the agent to use the computer, the app captures screenshots and controls the mouse and keyboard to complete the task. The screenshots may show anything open on the screen, including other people's data, and are sent to the AI provider you connected, under its terms. When the operating system requires it, it asks for your authorization, which you can withdraw in the system settings. Close what should not be seen before starting a task.
• Work Pro: when the Work Pro plan is hired, tasks may also be run in AgenWeb's cloud environment, which keeps your account's browser and workspace for continuous execution. Files, website sessions and other data you bring to the tasks may be stored in this environment. AgenWeb processes this data on your behalf, only to run the tasks you request, keep the environment working and protect it (section 3). Third-party models and APIs are still used with the keys or credits you connect, and the necessary context is sent to these providers, under their terms.
• Devices: when the plan has a device limit, AgenWeb may record technical data of the devices linked to the account, such as an identifier, the name, the operating system and the date of last access, only to apply that limit and protect the account.
• Download and updates: the installer is distributed through GitHub, and the app may check GitHub to find and download new versions. During the download and these checks, GitHub receives technical data, such as the IP address, and processes it under its own policy.
• Usage and diagnostic data: the app may send technical data about usage and operation, such as feature usage events, the app version, the operating system and error messages, including to usage analytics and diagnostics suppliers, which may be located outside Brazil (sections 8.3 and 9). This data is used to measure usage, fix failures and improve the app.

4.10 Agent template Marketplace

The Marketplace catalog is public and can be viewed without an account. When you add a template to your account, the console records the template in the business customer's account, as a draft, for AgenWeb's team to configure. This use does not involve data beyond the account data (section 4.4).

4.11 Apps connected to the agents (Composio)

When the feature is turned on for it, the business customer can connect to the AgenWeb Empresas agents apps it already uses, such as Gmail, Google Sheets and Meta Ads. The connection is made through Composio, an integrations supplier (section 8.3): the owner or a manager of the business customer chooses the app in the console, signs in to the app account and authorizes access on its authorization screen.

• Access keys: the authorization generates access keys (OAuth tokens), which are stored at Composio while the connection exists. AgenWeb does not store these keys: the platform's database stores the connection identifiers, its status, who made it and the tools turned on, without the keys.
• Tools chosen by the business: each connection starts with all tools turned off, and the owner or a manager chooses what the agent can do in each app.
• Use by the agent: when a task needs a connected app, the agent calls the tool through Composio, which passes the request to the app and returns the response. Each call carries to Composio and to the app the content needed for the task, such as search terms, the text of an email or spreadsheet values, and brings back what the app returns, such as emails, spreadsheet rows or campaign results. This content may include other people's personal data, such as the senders and the text of emails. Composio may keep logs of these calls, under its terms. What the app returns may also be sent to the AI provider (section 7.1), with the personal data the system recognizes replaced by codes (pseudonyms). Since this replacement depends on recognizing the data, an excerpt the system does not recognize, such as a name in the middle of a sentence, may reach the provider.
• Approval: every action that writes or sends something outside AgenWeb, such as sending or drafting an email, writing to a spreadsheet or changing an ad campaign, only happens after approval by a person with permission to do so, as a rule the owner or a manager of the business customer. Reads, such as searching emails or reading a spreadsheet, are as a rule done without approval when the tool is turned on. The platform logs each action, with what was requested, who approved or refused it, when applicable, and the result (section 11).
• Disconnection: the owner or a manager can disconnect an app in the console. The connection stops being used immediately, and AgenWeb asks Composio to delete the connection and the access keys it stores and, if the request fails, repeats it later. The authorization given in the app account, such as the Google or Meta account, may remain listed in that account's settings, where it can be removed at any time, for example at https://myaccount.google.com/permissions (opens in a new tab).

AgenWeb processes this data as processor, on behalf of the business customer (section 3), only to perform the requested tasks. The connected apps process the data stored in them under their own policies (section 8.4).

4.12 Cloud computer

When the feature is turned on for the business customer, it can use a cloud computer: a virtual machine with a browser, created for it at Blaxel, a cloud machine supplier (section 8.3), currently in the us-was-1 region, in the United States. It is not to be confused with AgenWeb Work's Computer Use (section 4.9), which uses your own computer. Each business customer has at most one cloud computer. The cloud computer can run at Blaxel or at Agent37, another cloud machine supplier (section 8.3). At Agent37, it is located in the us region, in the United States, and the backups are also located in the United States.

• Allowed websites: each computer only opens the websites on an approved list, made up of AgenWeb's default list and, if any, the business customer's list, with at most 20 websites. With no approved website, the computer is not turned on.
• Who uses it: the business customer's owner and managers can turn on the computer ("Acordar", Wake up), see the latest screenshot and open the live screen. AgenWeb's team, when providing support (section 8.2), can also see the screenshot, turn on the computer and open the live screen. The live screen allows using the computer's keyboard and mouse, through a link that expires in 15 minutes. Whoever opens the live screen connects directly to Blaxel, which receives technical data of the connection, such as the IP address. What is typed on the live screen, including passwords, reaches the computer through Blaxel, without passing through AgenWeb's server, but the sessions opened on websites remain in the computer's browser until it is deleted.
• What the screen may show: everything open on the computer, including personal data of customers and other people that appear on the websites used.
• Screenshot: the latest screenshot is kept on AgenWeb's server for up to 7 days and, in the console, is only shown to the business customer's owner and managers and to AgenWeb's team when providing support (section 8.2).
• Agent tasks: when the agent starts running tasks on the computer, the screenshots will be sent to the AI provider used by the agent (section 7.1), so that it understands the screen and decides the next step, and actions that write or send something outside AgenWeb, such as submitting a form, will only happen after approval by a person with permission to do so, as with the connected apps (section 4.11).
• For how long: under the rules of Blaxel's current plan, within 7 days after being created, each computer is deleted, together with the screen, the files and the website sessions, even while in use. The next use creates another, empty computer. AgenWeb may also delete the computer earlier.
• Log: the platform logs when the computer is created, turned on or opened live and who did it.

AgenWeb processes this data as processor, on behalf of the business customer (section 3). The business customer must use the computer only for purposes and on websites for which it has a legal basis and avoid leaving data that does not need to be seen open on the screen.

4.13 Technical and security data

When you access AgenWeb's website, console, public pages or APIs, our servers and hosting providers may log technical data, such as the IP address and source port, date and time with time zone, the account used, when there is one, the page or resource accessed, the browser identification and error messages. These logs are used to deliver the pages, maintain security, investigate failures and abuse and comply with the retention of application access logs required by applicable law (section 11).

When error monitoring is turned on, the technical errors of the API and of the background processes of the AgenWeb Empresas platform server are also sent to the error monitoring service (section 8.3), so that AgenWeb's team is notified and fixes the failure. This sending is configured not to carry data that directly identifies a person. Each error record contains the error type and message, the point in the code where it happened, the affected service, the system version, the date and time, the technical logs (informational and warning) and the calls to other services (the address, without the parameters, and the result) made shortly before it. It may contain internal codes, such as the identifier of the business customer, the branch, the contact, the conversation or the message, which only AgenWeb can associate with a person, and, in calls to other services, identifiers those services give to people, such as the Instagram profile code. Before leaving the server, the record loses the IP address, the identification of who uses the service, the content of the requests received, the values the program was processing at the time of the error and the personal and confidential data the system recognizes, such as phone number, CPF, CNPJ, email, passwords and the name and text fields of messages. Since this removal depends on recognizing the data, an excerpt the system does not recognize, such as a name written in the middle of a sentence, may exceptionally reach an error record. These records are deleted within the period in section 11.

5. What we use the data for and on what legal basis

AgenWeb only processes personal data under one of the legal bases of arts. 7 and 11 of the LGPD. The table relates each purpose to the data and the legal basis. When AgenWeb is the processor, the legal basis is the one chosen by the business customer (section 5.3).

5.1 Legitimate interest

When we rely on legitimate interest, we process only the data necessary for the purpose, consider your legitimate expectations and your rights and adopt transparency and data minimization measures, such as pseudonymizing the IP in metrics (art. 10 of the LGPD). You can ask for information about this processing and object to it, if you believe it breaches the LGPD (art. 18, §2), through the channel in section 1.2.

5.2 Consent

When the legal basis is consent, it is requested prominently and recorded with the text shown, the date and the time.

• How it currently works in AgenWeb News: a single consent box covers the News and AgenWeb's email offers and, if you provide your WhatsApp number, AgenWeb's messages on that number. The News is sent together with AgenWeb's offers, and it is not possible to receive only the News (art. 9, §3, of the LGPD). The box text mentions this Policy only to confirm that you had access to it: reading the Policy is not consent.
• Revocation: you can revoke consent at any time, free of charge, through the "Descadastrar" (Unsubscribe) link in each email or through the channel in section 1.2 (art. 8, §5). Unsubscribing through the email link ends the entire subscription, including AgenWeb's WhatsApp messages. To stop receiving only the WhatsApp messages, ask in the conversation itself or through the channel in section 1.2.
• Effects: revocation does not affect processing carried out before it. If you do not give consent, you will not receive the News or AgenWeb's offers, and this does not affect any other service (art. 18, VIII).

5.3 When AgenWeb is the processor

In these cases, the legal basis is defined by the business customer, which is responsible for it. For example: performance of a contract with the end customer to fulfill their request, legitimate interest to continue a service interaction the customer started, or consent for campaigns and offers. The platform offers the business customer tools to record consent by message category and respect those who reply SAIR (STOP).

5.4 Required data and optional fields

Some data is necessary to provide the service: without the email, it is not possible to create the account, sign in to the console or receive the News; without billing data, it is not possible to hire a paid plan. Optional fields are indicated on the forms, and leaving them blank does not prevent use of the service.

6. Sensitive data and data of children and adolescents

The LGPD gives enhanced protection to sensitive data and to data of children and adolescents. This section explains how they are handled in each of AgenWeb's roles.

6.1 Sensitive data

• The standard customer service operation does not ask for sensitive data (art. 5, II, of the LGPD), and AgenWeb does not ask for it in its own channels either.
• The end customer may send sensitive data on their own, in text, audio, image or document. In this case, the data is processed only for that business customer's customer service and does not go into the service memory (section 4.6). The legal basis for this processing is the one chosen by the business customer, as controller, among those of art. 11 of the LGPD.
• Audio transcription is used only to understand the content of the message. AgenWeb does not use voice to identify people and does not process biometric data.
• The business customer must not configure flows that ask for sensitive data without a legal basis under art. 11 and without adequate safeguards, under the Terms of Use.
• If you send sensitive data to an AgenWeb channel without it having been requested, it will be used only as necessary to comply with a legal or regulatory obligation, such as responding to a data subject request (art. 11, II, "a"), or for the regular exercise of rights, including in a contract (art. 11, II, "d"). Outside these cases, it will not be used and will be erased as soon as identified.

6.2 Children and adolescents

• AgenWeb's products and communications are not intended for people under 18. You must be 18 or older to create an account, hire a plan, subscribe to Work or subscribe to the News.
• If AgenWeb learns that it has processed, as controller, data of a child or adolescent without an adequate legal basis or without observing their best interest (art. 14 of the LGPD and CD/ANPD Statement No. 1/2023), it will erase this data, except what it must keep due to a legal obligation or for the regular exercise of rights (section 11.1), which will be blocked from ordinary use.
• As processor, the platform may receive data of children and adolescents who chat with a business customer or fill out one of its forms. The business customer, as controller, must process this data in the best interest of the child and adolescent (art. 14), obtain the consent of one of the parents or the legal guardian when the law requires it and not direct advertising campaigns at children.

7. Artificial intelligence

AgenWeb's agents use third-party artificial intelligence models. This section explains how data goes into these models, what we do not do with it, how automated decisions can be reviewed and what the limits of AI are.

7.1 How data goes into the models

• When a message arrives, the platform sends the AI provider the content needed for that reply: the customer's message; for audio, images and scanned PDFs, the file itself, so that the provider transcribes the audio or reads the visible text; the information approved by the business customer, such as catalog, knowledge base and customer service rules; and, when available, the service memory sentences and the facts and rules of the business and agent memory (section 4.6).
• The text of PDFs that already contain text, of documents and of spreadsheets is extracted on AgenWeb's own server, without sending the file to the provider. Once extracted, this text may go into the content sent to the provider to draft the reply, like the text of any message.
• For some business customers, the model also helps classify the subject of the conversation and indicate when it should be handed over to a team member.
• When the feature is turned on for the business customer, the triage and classification of incoming messages, such as identifying the type of contact or whether the person asked to talk to someone on the team, may also be done by TypeSafe, with the Jev model (section 8.3). TypeSafe does not draft replies: it returns only a classification, which the platform uses in customer service triage. The platform sends TypeSafe only the text of the incoming message, without files and without the conversation history, and never sends the contact's name or phone number stored in the customer record or in the WhatsApp profile. CPF, phone number, email and card number are not sent either: the platform checks the text before sending. Since this check depends on recognizing the data, an excerpt the system does not recognize, such as a name in the middle of a sentence, may reach TypeSafe. TypeSafe may keep logs of these calls for a period, under its terms.
• The customer service AI provider is OpenAI (section 8.3). When the feature is turned on for the business customer, WhatsApp customer service replies are drafted by Claude, from Anthropic (section 8.3), which receives the content needed to draft each reply, such as the conversation, the information approved by the business customer and, when available, the memory sentences. In these cases, OpenAI is still used for the other customer service tasks and drafts the reply when Claude does not respond due to a technical failure or delay.
• When the agent uses a connected app (section 4.11), the AI provider may receive the content needed to prepare the action and what the app returns, such as the emails read, with the personal data the system recognizes replaced by pseudonyms. Screenshots of the cloud computer will only be sent to the AI provider when the agent starts running tasks on it (section 4.12).
• The console assistant, which answers the business customer's team's questions about the operation, works with aggregated data, without end customers' personal data, and, when turned on, with the business and agent memory (section 4.6). When the feature is turned on for the business customer, the console assistant replies with Claude, from Anthropic, instead of OpenAI. Image generation for campaigns sends the provider the description written by the team.
• The AI agent always replies in text.

7.2 No training of general-purpose models

OpenAI and Anthropic, used in customer service, in the console assistant and in internal evaluation (section 7.3), are hired via API. Under their terms, data sent via API is not used to train their models. These terms may provide that the provider keeps the data for a limited period, for example for security and abuse prevention. TypeSafe, used in message triage (section 7.1), is also hired via API, and AgenWeb only sends data to it under conditions that do not allow it to be used to train models. AgenWeb does not use end customers' or users' personal data to train general-purpose AI models, its own or third parties'.

7.3 Evaluation and improvement of the service

To measure and improve the quality of replies, AgenWeb tests the service with sets of evaluation cases, built from the business customers' knowledge bases, from real situations described without personal data and from fictitious cases. These tests may use AI providers different from those used in customer service. When these cases are based on a business customer's data, this only happens within the authorization of Annex I, section F, of the Terms of Use, and the business may refuse this use in writing. AgenWeb may also use anonymized data, which does not allow anyone to be identified by reasonable technical means, for statistics on the use and operation of the products (art. 12 of the LGPD).

The evaluation cases used today do not contain end customers' personal data: the people, phone numbers and documents that appear in them are fictitious.

7.4 Automated decisions and review

The AI agents automatically decide the text of the replies and, for some business customers, the subject of the conversation, the type of contact and whether it should be handed over to a person, including with TypeSafe's classification, when turned on (section 7.1). The voucher system automatically checks whether the CPF or the WhatsApp number has already been used in the same offer, to prevent repeated use. The business customer may segment the campaign audience based on the tags and the purchase history it recorded, and this segmentation is its decision. The platform does not define credit profiles. The business customer can review replies before they are sent, take over the conversation at any time and pause the AI.

If a decision made solely on the basis of automated processing affects your interests, you can request its review and clear information about the criteria used, subject to commercial and industrial secrets (art. 20 of the LGPD). Since this decision is part of the business customer's customer service, make the request to it, and AgenWeb will support the response. In cases where AgenWeb is the controller, make the request through the channel in section 1.2.

7.5 Limits of AI and who is responsible for customer service

AI-generated replies may contain errors, omissions or outdated information. The business customer decides what the agent may say and must review prices, deadlines, availability and conditions, under the Terms of Use. Avoid sending passwords, full card or document numbers and other information you do not need to share in a conversation with an AI agent.

The AI agent's messages are sent by the business customer, on its behalf, in the customer service it provides. Products, prices, deadlines, discounts, warranties and other conditions provided in the conversation belong to the business customer, which is the one selling or providing the service. AgenWeb provides the technology and is not a party to the deal between the business and the end customer. This does not reduce the rights the law guarantees to the end customer.

To investigate complaints, fraud and attempts to manipulate the agent, such as messages asking it to ignore the business's rules or reveal other people's data or internal instructions, AgenWeb may analyze, to the minimum necessary, the conversation and the technical log of the AI replies, as controller for this purpose (section 3.1).

7.6 AgenWeb Work and providers chosen by you

In AgenWeb Work, you choose the models and connected services and use your own keys and accounts. When the call goes from your computer directly to the provider, what you send is processed by it, under the terms you accepted, and not by AgenWeb. These terms may allow uses different from those described in section 7.2: check them before connecting an account. What is run or stored in the Work Pro cloud environment follows section 4.9.

8. Data sharing

AgenWeb shares personal data only when this is necessary to provide the services, comply with the law or protect rights, in the situations described below.

8.1 What we do not do

• We do not sell or rent personal data.
• We do not share personal data with advertisers or for third-party advertising.
• We do not use a business customer's end customers' data for AgenWeb's marketing and do not share it with other business customers.

8.2 Who we share with

• The business customer: end customers' data is accessible to the business customer and to the people on its team that it authorizes in the console, according to each person's role. The data the business customer exports, copies or downloads from the platform is then processed only by it, outside AgenWeb's control. Access made with valid credentials of users that the business customer keeps in the console is considered access by the business itself (Terms of Use, section 6.2).
• Suppliers: companies that provide services to AgenWeb (section 8.3), each with the data needed for the service it provides.
• Platforms with their own purposes: such as WhatsApp, Meta, Google, Stripe and GitHub (section 8.4).
• Platforms and suppliers that investigate abuse: when Meta, an AI provider or a payment method investigates a breach of its rules linked to an AgenWeb or business customer account, AgenWeb may provide the registration data of the business customer involved and the technical data needed for the investigation, such as the volume of sends, the status of the number and the blocking events, without the content of the conversations and without the application access logs.
• AgenWeb's team: only those who need it, to implement, operate, support and keep the service secure.
• Professional advisers: such as accountants, lawyers and auditors, under a duty of confidentiality, when necessary.
• Collection and credit protection: in case of non-payment or a disputed reversal, the identification data of the contracting party, of the contract, of the debt and of the usage may be shared with payment institutions, acquirers, card brands and issuers, collection agencies, protest registry offices and credit protection databases, only as necessary and with the prior notice required by law.
• Proceedings: judges, courts, arbitrators and administrative bodies, when AgenWeb needs to exercise or defend rights (art. 7, VI, of the LGPD).
• Authorities: when the law or an order requires it (section 8.5) and, on AgenWeb's initiative, when there are signs of fraud, scam, intrusion or other crime committed against AgenWeb, against data subjects or through the services, to report the fact to the police, the Public Prosecutor's Office or another competent authority, with the registration data and the information strictly necessary to describe it (art. 7, VI and IX, of the LGPD). The content of private communications and the connection and application access logs are only delivered to authorities with a court order (section 8.5).
• Successors: if AgenWeb is transformed into a company, merges, is acquired or transfers the business, the data may pass to the successor, which will become the controller and will have to comply with the LGPD and the purposes stated in this Policy. You will be informed prominently of the change of controller (arts. 8, §6, and 9, III, of the LGPD) and, for processing based on your consent, you may revoke it. Data processed on the basis of your consent, such as the AgenWeb News subscription, will only be passed to an acquirer that is not AgenWeb's universal successor if you give new specific consent (art. 7, §5).
• At your request: for example, when you connect a third-party service.

8.3 Suppliers that process data on AgenWeb's behalf

The suppliers below process data on AgenWeb's behalf or, when it is the processor, on behalf of the business customer. Each one receives only the data needed for the service it provides. AgenWeb updates this list when a supplier joins or leaves and notifies business customers under Annex I, section G, of the Terms of Use.

Infrastructure and hosting

Artificial intelligence

Connected apps and cloud computer

Account, payment and communication

AgenWeb Empresas billing is done through the payment method provided at contracting or in the Proposal. The banks and payment institutions involved in this billing process the data needed for it under their own rules and policies.

In addition to the suppliers above, the Work Pro cloud environment and the Work app may use other cloud hosting and usage analytics and diagnostics providers (section 4.9). They receive only the data needed for the service they provide and may be located outside Brazil. The updated list of these suppliers can be requested through the channel in section 1.2.

8.4 WhatsApp, Meta and other platforms with their own policies

• WhatsApp and Meta. In the Direct Connection, used only by some existing customers during the transition, AgenWeb does not hire Meta: messages pass through WhatsApp's infrastructure, which handles them like those of any account, under its own policies. In the WhatsApp Business Platform (Cloud API), used for new connections, Meta acts as processor to deliver the messages and may also process data for its own purposes, described in its policies, and not in AgenWeb's instructions. In both methods, this infrastructure may be located outside Brazil.
• WhatsApp and Meta documents: see the WhatsApp Privacy Policy (opens in a new tab), the WhatsApp Business Policy (opens in a new tab) and the Meta Privacy Policy (opens in a new tab).
• Instagram. The comment campaigns on AgenWeb's profiles use Meta's official API. The comment is public on Instagram and follows Meta's rules. Instagram is also a customer service channel for business customers that connect their professional account (section 4.5A), through Meta's official API.
• Google. When signing in with your Google account, Google confirms your identity and sends Clerk the data in section 4.4, under Google's policy. The Reviews pages lead to Google's official review form or to the store's Instagram profile, and what you do on these websites follows their policies.
• Stripe. In addition to processing payment for AgenWeb, Stripe may process data for its own purposes, such as fraud prevention and compliance with legal obligations, under its policy.
• GitHub. Distributes the Work installer and updates and processes access to the download under its policy.
• Connected apps. Google, Meta and the other apps the business customer connects to the agents through Composio process the data stored in them, such as emails and spreadsheets, under their own policies. The authorization given to these apps is also managed in the app account itself (section 4.11).
• Embedded content. Some News posts embed videos or posts from YouTube, Vimeo or Instagram, which may collect data from those who watch them, under these services' policies (section 10).

8.5 Requests from authorities

AgenWeb complies with court orders and requests from competent authorities, as provided by law:

• the content of private communications is only provided with a court order (arts. 7, II and III, and 10, §2, of the Marco Civil da Internet);
• connection and application access logs, alone or associated with personal data that may identify the user, are provided with a court order (arts. 10, §1, and 22 of the Marco Civil da Internet);
• other personal data is provided with a court order or to an authority with express legal power to request it, such as the ANPD in the exercise of its oversight (art. 55-J of the LGPD);
• registration data (personal qualification, parentage and address) is provided to administrative authorities with express legal power to request it, which must state the legal ground and the reason for the request (art. 10, §3, of the Marco Civil da Internet and art. 11 of Decree No. 8,771/2016).

Generic, collective or legally unfounded requests and requests from authorities without jurisdiction may be refused or challenged (art. 22 of the Marco Civil da Internet and art. 11, §3, of Decree No. 8,771/2016). When the request involves data that AgenWeb processes as processor, it notifies the business customer, so that it can respond, unless the law or the order prohibits the notice or it could harm the investigation (Terms of Use, section 14.3). AgenWeb also fulfills authority requests to keep logs for a longer period (art. 15, §2, of the Marco Civil da Internet) and reports to the competent authorities the crimes the law requires it to report.

9. International data transfer

The main server of the AgenWeb Empresas platform is in Brazil. Part of the processing, however, takes place outside the country, because some suppliers are located or store data in other countries, mainly in the United States. The table shows, for each transfer, the importer, the country, the purpose and the data. Each transfer lasts as long as AgenWeb uses the supplier for the stated purpose.

These transfers are subject to the cases of art. 33 of the LGPD and to CD/ANPD Resolution No. 19/2024, and AgenWeb carries them out as provided by applicable law. When the transfer uses the standard contractual clauses approved by the ANPD, you can request their full text through the channel in section 1.2. You can also request more information about these transfers and exercise your rights regarding them through the same channel, including the right to petition the ANPD (section 13.8).

10. Cookies and similar technologies

Cookies are small files that a website stores in your browser. Similar technologies include the browser's local storage and identifiers calculated from the information the browser sends. AgenWeb uses only what is necessary for the operation and security of the services and for its own metrics with reduced data.

10.1 agenweb.com.br website and AgenWeb News

• The website does not set advertising or analytics cookies and does not use third-party analytics tools, such as Google Analytics, or social media pixels.
• In AgenWeb News, the visit's campaign parameters are kept in the browser's session storage, to attribute subscriptions and clicks. This storage is deleted when you close the tab.
• News metrics are recorded in the AgenWeb News database (Supabase, section 8.3), with the pseudonymized IP and the browser identification limited to 300 characters, without a cookie.
• The internal News console uses a session cookie, valid for 14 days, only for those who manage the News.
• Posts with videos or embedded posts from YouTube, Vimeo or Instagram load content from these third parties, which may set their own cookies, under their policies.

10.2 app.agenweb.com.br console and AgenWeb Work

• Sign-in uses Clerk session and authentication cookies, needed to keep you signed in securely.
• The browser keeps preferences such as the light or dark theme in local storage.
• The console does not load analytics or advertising tools.
• If the business customer connects WhatsApp through the Cloud API, the connection screen loads Meta's (Facebook's) software development kit, which may set Meta's own cookies.
• When connecting an app to the agents, the console takes you to the authorization pages of Composio and the chosen app, and the cloud computer's live screen opens a Blaxel page. These pages follow these suppliers' policies and may set their own cookies.
• For the Work app, see section 4.9.

10.3 Reviews pages and voucher form

The Reviews pages and the voucher form do not use AgenWeb cookies. The Reviews page metrics use a session code calculated from the browser identification and language, which changes every day and does not use the IP address (section 4.8).

10.4 How to control them

You can delete or block cookies and local storage in your browser settings. If you block the sign-in cookies, you will not be able to sign in to the console or the app. Since AgenWeb does not use advertising or analytics cookies, there are no other categories to turn on or off. If this changes, your consent will be requested beforehand.

11. How long we keep the data

Data is kept for the time needed for the purposes of this Policy, for compliance with legal obligations and for the exercise and defense of rights (arts. 15 and 16 of the LGPD). At the end of this period, it is erased or anonymized, as provided by applicable law, except in the cases in section 11.1.

11.1 Retention due to legal obligation, for the defense of rights and preservation of evidence

Some data remains stored after the end of the original purpose or an erasure request, when there is another legal basis for this:

• Legal or regulatory obligation (art. 7, II, and art. 16, I, of the LGPD), such as tax and accounting documents and application access logs.
• Regular exercise of rights in judicial, administrative or arbitration proceedings (art. 7, VI, and art. 11, II, "d", of the LGPD): records of contracting, consent and opt-out are kept until the end of the applicable limitation period, because they prove what was contracted, authorized or refused. The log of each agent action in the connected apps, without the text of the request, is also kept, because it proves what the agent did, who approved it and the result (section 11).
• Preservation of evidence: when there is a complaint, a report, an investigation by Meta or an authority, a reversal request, a collection, suspected fraud or abuse, or a proceeding involving an account, AgenWeb may preserve, as controller, the records needed to investigate the facts and defend itself, even if the business customer or the data subject requests erasure. These records include the agent's configuration and instructions, consent, opt-out and campaign sending records, the action log, the access logs and, to the minimum necessary, the conversations related to the facts.

The data kept in these cases is blocked from ordinary operation, is only accessed for these purposes and is erased or anonymized when retention is no longer necessary, such as at the end of the proceeding or the limitation period.

11.2 Backups

The AgenWeb Empresas platform makes a daily, encrypted backup of the customer service and Direct Connection databases, including the sessions of this connection. The daily backups are kept for 14 days on the server and then deleted. The platform also makes an encrypted backup before each system update and, when active, keeps an encrypted external copy of the daily backups (section 8.3). These other copies are kept for the time needed for the security and recovery of the system. Data erased from the platform may remain in the backups until they are deleted. During this period, it is not used, except to restore the system or test the restoration in an isolated environment.

11.3 End of the contract with the business customer

When the contract with a business customer ends, it has 30 days to request the export of the data processed on its behalf. Afterwards, AgenWeb erases or anonymizes this data within 60 days, or, within this period, informs the business of what could not be erased and why, except the data in section 11.1, which remains blocked from ordinary use, and the backup deletion cycle (section 11.2), under section 21.6 and Annex I, section M, of the Terms of Use.

For the connected apps and the cloud computer (sections 4.11 and 4.12), the end of the contract also has these effects: AgenWeb disconnects the apps that are still connected, which includes the deletion request to Composio in section 4.11; the cloud computer is deleted at Blaxel, at the latest within the period in section 4.12; the text of the requests made to the apps, the connection data and the computer history follow the erasure described above; and the log of each agent action, without the text of the request, remains stored, blocked from ordinary use, as proof of what was done (section 11.1).

12. Security

AgenWeb protects data with measures proportionate to the service and the risks and discloses these measures clearly, as required by art. 16 of Decree No. 8,771/2016, while respecting the confidentiality of business secrets. Therefore, AgenWeb does not disclose details of architecture, configurations, fraud and abuse detection rules or other information that could facilitate attacks, fraud or copying of the services, without prejudice to the information owed to data subjects and to the ANPD. The security information owed to the business customer as controller is provided under Annex I of the Terms of Use.

12.1 Measures we adopt

AgenWeb adopts technical and administrative measures compatible with the service and with the risks of the processing (arts. 46 and 47 of the LGPD), including:

• encryption in transit (HTTPS) on connections to the website, the console and the APIs;
• encrypted backups, daily and before each system update, with a restoration test in an isolated environment before each update;
• connection access keys stored outside the platform's database, which keeps only a reference to them; those of the apps connected through Composio are kept at Composio;
• in the connected apps, tools turned off until the business customer turns them on and approval by a person with permission to do so, as a rule the owner or a manager of the business customer, before any action that writes or sends something outside AgenWeb (section 4.11);
• in the cloud computer, a network filter that only allows approved websites to be opened, no AgenWeb access key inside it, and the screenshot and the live screen only for the business customer's owner and managers and, when providing support, for AgenWeb's team, through links that expire;
• role-based access control (viewer, agent, manager and owner), verified on the server;
• separation of each business customer's customer service at the application level;
• on the AgenWeb Empresas platform server, explicit allowlisting, in the configuration, of each external supplier the customer service system can call;
• pseudonymization where it is possible without harming the service: the voucher CPF, the IP of the News subscription and metrics and Meta's identifiers in the Instagram campaign metrics as a pseudonymized code (HMAC), and the Reviews metrics without IP;
• in TypeSafe triage and in the business and agent memory, a text check on the server, so as not to send to TypeSafe or save in memory the data the system recognizes, such as CPF, phone number and card number (sections 4.6 and 7.1);
• rate limiting and origin verification on public forms;
• signature verification of the notifications received from Stripe and Clerk;
• controls available to the business customer: human review before sending, taking over the conversation, pausing the AI in general or by branch and sending campaigns only to contacts with authorization recorded in the message category, with the SAIR (STOP) option.

12.2 Limits and your part

No environment is risk-free, and no measure eliminates all risks. AgenWeb reviews its measures over time, but cannot guarantee that incidents will never happen. You also protect your data: keep access to your email and your Google account secure, do not share login codes, remove from the console people who leave your team, protect the data you export or download from the platform and notify AgenWeb immediately, through the channel in section 1.2, if you suspect misuse of your account.

13. Your rights as a data subject

The LGPD grants you rights over your personal data. This section explains what they are, how to exercise them, within what period we respond and what to do if your data came from a business customer.

13.1 What your rights are

Under art. 18 of the LGPD, you can request:

• confirmation that we process your data;
• access to the data;
• correction of incomplete, inaccurate or outdated data;
• anonymization, blocking or erasure of unnecessary or excessive data or data processed in breach of the LGPD;
• portability of the data to another provider, upon express request, subject to commercial and industrial secrets and the ANPD's regulations;
• erasure of the data processed with your consent, except in the retention cases of art. 16;
• information about the public and private entities with which we share your data;
• information about the possibility of not giving consent and about the consequences of refusing;
• revocation of consent;
• review of decisions made solely on the basis of automated processing (art. 20; section 7.4).

You can also object to processing carried out without consent, in case of breach of the LGPD (art. 18, §2).

13.2 How to exercise them and response times

Send your request to kauan@agenweb.com.br, with the subject "Privacidade" (Privacy), stating your name, the email or phone number linked to the data and what you want. The service is free of charge (art. 18, §5).

• Confirmation that we process your data and access to it are provided in simplified form, immediately, or by a clear and complete statement, within 15 days (art. 19).
• Other requests are answered within 15 days. When it is not possible to fulfill them immediately, we will state the factual or legal reasons and the next steps (art. 18, §4).
• The periods are counted from the date of your request (art. 19, II). If information needed to locate the data or confirm your identity is missing, we will ask for it as soon as possible. If it does not arrive in time, we will respond within the period and state this reason (art. 18, §4, II). Once it arrives, the request is fulfilled within 15 days.
• The data is provided by secure electronic means or in printed form, as you choose (art. 19, §2).
• When we correct, anonymize, block or erase data, we will immediately inform the processing agents with whom it was shared, so that they do the same, unless this communication is proven impossible or requires disproportionate effort (art. 18, §6).
• When the data belongs to an end customer of a business customer, the decision on the request belongs to the business customer, as controller, and the forwarding and erasure periods are those in section 13.5.

13.3 Identity confirmation and requests through a representative

To protect you, we may ask for information confirming that the request comes from the data subject, such as confirmation through the email or number linked to the data, to the extent necessary and without requiring disproportionate documents. A request made through a representative requires proof of representation.

13.4 When it is not possible to fulfill a request

We may decline a request, in whole or in part, stating the factual or legal reasons (art. 18, §4). This may happen, for example, when:

• it is not possible to confirm the identity of the requester;
• AgenWeb is not a processing agent of the data, in which case we will indicate, whenever possible, who is (art. 18, §4, I). When AgenWeb is the processor, the request follows section 13.5;
• retention of the data is required by law or regulation (art. 16, I) or necessary for the regular exercise of rights (art. 7, VI), under section 11.1;
• fulfilling the request would reveal other people's personal data, in which case that data will be omitted and the rest will be provided;
• the information is protected by commercial or industrial secrecy, in the cases where the LGPD safeguards that secrecy (arts. 18, V, 19, II, and 20, §1). In this case, we will provide the rest and, if the request is about an automated decision, you may ask the ANPD for the audit provided in art. 20, §2.

13.5 If you are an end customer of a business that uses AgenWeb

If your data came from a conversation on WhatsApp or on Instagram (Direct or comments), a voucher form, a campaign, a Reviews page, an app connected to the agents or the cloud computer of a business customer, that business is the controller and is the one that decides on the request. Make the request to the business first, through the channel it provides.

If you write to AgenWeb, we:

• acknowledge receipt, forward the request to the responsible business customer within 2 business days and inform you that it was forwarded, naming the business whenever possible;
• help the business respond, with the console's tools: exporting a customer's data and recording a deletion request, which immediately blocks the sending of new messages and campaigns to that contact;
• for deletion requests, if the business does not object on reasoned grounds within 5 business days of forwarding, for example due to a legal retention obligation, we erase the data we process on its behalf, according to the instruction it gave in the Terms of Use (Annex I, section J). If it objects, we inform you that the response will be up to it;
• complete the erasure, except for the data in section 11.1, within 15 days of receiving your request with the information needed to locate the data, or, within this period, inform the business of what could not be erased and why.

If the business customer does not respond, you can petition the ANPD (section 13.8). If you no longer want to receive campaigns from a business, reply SAIR (STOP) in the conversation with it: the refusal is recorded, and the platform stops sending that business's campaigns to your number.

13.6 Requests from people on a business customer's team

If you use or used the console as part of a business customer's team, AgenWeb fulfills, as controller, your requests about the personal data of your account: name, email, role, sessions and the logs of the actions taken with it.

• These rights cover the data about you, and not the business customer's work content, such as the conversations you handled, the customer records, the campaigns and the metrics. This content is processed on behalf of the business and is only delivered to it, on its instruction or by court order, including after you leave the team.
• If your request is about your data that appears in this work content, such as your name as the author of a message, it follows section 13.5, because the controller of this data is the business customer.
• The business customer responsible for the account may receive from AgenWeb the logs of the actions taken by each user, to control access and investigate misuse. These logs are kept according to section 11.

13.7 Reports of scams, spam or misuse

If you received, from a number served by the platform, a message that looks like a scam, spam or misuse of your data, write to kauan@agenweb.com.br with the subject "Denúncia de conteúdo" (Content report), stating the number that sent the message and, if possible, the message itself. AgenWeb analyzes the report and may pause sending and preserve the records (section 11.1 and Terms of Use, section 13). A false or bad-faith report subjects whoever made it to the legal consequences.

13.8 Petition to the ANPD and consumer protection bodies

If you are not satisfied with the response, you can petition the ANPD (art. 18, §1, of the LGPD) and also the consumer protection bodies (art. 18, §8), through the channels in section 18.

14. Data deletion

The step-by-step instructions are on the Data Deletion Instructions page, at https://agenweb.com.br/data-deletion. In summary:

• Send an email to kauan@agenweb.com.br with the subject Exclusão de dados (Data deletion), stating: your name; as applicable, the phone number used on WhatsApp, your Instagram username (@), if the request is about a comment campaign on AgenWeb's profiles, or the email of your AgenWeb account or News subscription; whether you are the person served, the business customer, an account user or a News subscriber; and what you want to delete.
• To delete your AgenWeb account (console or Work), send the request from the email registered on the account. To protect you, we may ask you to confirm the request through the email or number linked to the data (section 13.3).
• When AgenWeb is the controller, it responds and completes the deletion within 15 days of receiving the request with the information needed to locate the data (section 13.2).
• When the data belongs to an end customer of a business customer, AgenWeb is the processor and can only erase it on the business's instruction (art. 39 of the LGPD). It forwards the request to the business within 2 business days and informs you of the forwarding. If the business does not object on reasoned grounds within 5 business days, AgenWeb erases the data according to the instruction the business gave in the Terms of Use and completes the erasure within 15 days of receiving the request with the information needed to locate the data or, within this period, informs the business of what could not be erased and why (section 13.5).
• A request to delete the data of a business customer's account is only accepted from the Account Administrator or from a representative with proven powers (section 3.3).
• If you subscribe to AgenWeb Work, cancel the subscription in the payment portal before requesting deletion of the account, to avoid new charges.
• To leave only AgenWeb News, use the "Descadastrar" (Unsubscribe) link in the footer of any email.
• The data in section 11.1 may be kept, such as access logs, tax and accounting documents, consent and opt-out records and the log of agent actions in the connected apps, without the text of the requests. This data is no longer used in ordinary operation.
• Deletion by AgenWeb does not delete: the copies Meta keeps under WhatsApp's and Instagram's policies; the messages that remain on your device and on the WhatsApp of the business you chatted with; the public comment you made on Instagram, which you can delete in the app itself; the data stored in the apps the business customer connected to the agents, such as emails in Gmail, and the authorization given in those apps' accounts, which follow their rules, and the call logs that Composio keeps, under its terms (section 4.11); the error records of the monitoring service (section 4.13) in which it is not possible to locate your data, until they are deleted within the period in section 11; and the backups, until they are deleted according to section 11.2.

15. Marketing communications and unsubscribing

AgenWeb separates marketing communications, which depend on your consent, from communications about the service, which are part of the contract.

15.1 AgenWeb News and email offers

You only receive AgenWeb News and AgenWeb's email offers if you tick the consent box when subscribing (section 5.2). Every email includes the "Descadastrar" (Unsubscribe) link and one-click unsubscribe headers: cancellation takes effect immediately. You can also request cancellation or deletion of your data from the list through the channel in section 1.2.

15.2 AgenWeb messages on WhatsApp

AgenWeb only sends marketing messages on WhatsApp to those who provided their number and ticked the consent box when subscribing to the News (section 5.2). To stop receiving them, ask to unsubscribe in the conversation itself or through the channel in section 1.2, or use the "Descadastrar" (Unsubscribe) link in a News email, which ends the entire subscription (section 5.2). The number provided at subscription is not verified: if you received a message from AgenWeb without having subscribed, let us know, and the number will be removed from the list.

15.3 Communications about the service

Messages about your account, security, billing, changes to the Terms of Use and to this Policy and other operational notices are not marketing. They are sent to those who have an account or contract with AgenWeb and do not depend on consent, because they are part of the service.

15.4 Business customers' campaigns

The campaigns a business customer sends through the platform are its own; it is the controller and is responsible for the legal basis. The platform only sends campaigns to contacts with authorization recorded in the corresponding category and respects those who replied SAIR (STOP). The authorization may be recorded by the end customer themselves or provided by the business customer, which is responsible for its existence, validity and proof (art. 8, §2, of the LGPD). AgenWeb does not check whether the authorization provided by the business customer was actually given, may ask for proof at any time and may pause campaigns when there are signs that it does not exist (Terms of Use, sections 9.7 and 11.7).

16. Security incidents

• If a security incident occurs with personal data that AgenWeb processes as controller and that may cause relevant risk or harm to the data subjects, AgenWeb will notify the ANPD and the affected data subjects, under art. 48 of the LGPD and CD/ANPD Resolution No. 15/2024. The notice will state the affected data, the risks, the measures taken and the recommendations to reduce the effects of the incident.
• If the incident affects data that AgenWeb processes as processor, it will notify the business customer without undue delay and within 48 hours of confirming that the incident affected personal data processed on its behalf, and will support it, so that the business can meet its obligations as controller (Terms of Use, Annex I, section I).
• Incidents originating in the environment of the business customer or its users are the responsibility of the business customer, as controller, which must assess them and report them to the ANPD and to the data subjects when required. This is the case of shared codes or sessions, of a user's hacked email or Google account, of access by a person the business did not remove from the console, of the devices and WhatsApp sessions of the connected number, which the business controls, and of the data it exported, copied or downloaded from the platform. AgenWeb cooperates with the investigation and is liable under arts. 42 to 44 of the LGPD, which does not include an incident to which it did not contribute.
• AgenWeb records security incidents involving personal data as provided by applicable law, including those that do not need to be reported (art. 10 of CD/ANPD Resolution No. 15/2024).
• If you suspect an incident involving AgenWeb, notify us immediately through the channel in section 1.2.

17. Changes to this Policy

• AgenWeb may update this Policy to reflect changes in the products, the suppliers, the law or the ANPD's guidance. The version in force is always on this page, with the date of the last update at the top. This version replaces the version published on October 31, 2026.
• Relevant changes, such as a new purpose, a new type of personal data, a new category of recipient, a change of controller or a change in how to exercise rights, will be announced prominently, by email, in the console or on the website, with reasonable advance notice. When the change is required by law, by an authority or for security reasons, it may take effect immediately, but the prominent notice, with the content of the changes, will be given as soon as possible (art. 8, §6, of the LGPD).
• When a change of purpose is not compatible with a consent already given, you will be informed beforehand and may revoke the consent (arts. 8, §6, and 9, §2, of the LGPD).
• AgenWeb keeps the previous versions of this Policy, which can be requested through the channel in section 1.2.

18. Contact and National Data Protection Authority

AgenWeb, 65.977.148 KAUAN DA SILVA GUEDES, CNPJ 65.977.148/0001-26, Rua Glicéria Santos, 13, Apt 401, Acupe, Salvador/BA, CEP 40290-180, Brazil.

• Person in charge of personal data processing (Data Protection Officer): Kauan da Silva Guedes, by email at kauan@agenweb.com.br (section 1.2).
• Privacy and data subject rights: kauan@agenweb.com.br, with the subject "Privacidade" (Privacy).
• Data deletion: the same email, with the subject "Exclusão de dados" (Data deletion), as described on the Data Deletion Instructions page.
• Reports of scams, spam or misuse: the same email, with the subject "Denúncia de conteúdo" (Content report) (section 13.7).
• Business phone and WhatsApp: +55 (71) 99270-4744.
• National Data Protection Authority (ANPD): https://www.gov.br/anpd/pt-br (opens in a new tab), where the channels for data subject petitions and complaints are available.
• Consumer protection: the Procon (consumer protection agency) of your city or the https://www.consumidor.gov.br (opens in a new tab) platform.

This Policy is governed by Brazilian law.