Privacy Policy — Delcontrol

1. Who we are

Delcontrol is a management platform for service providers, operated by Ludag Group Serviços LTDA (Brazilian company registration CNPJ 05.394.452/0001-19). This policy explains how we process personal data when operating the platform, including the integrations with the WhatsApp Business Platform (Meta) and with Google (Drive and Calendar).

2. How the platform works

Delcontrol is hired by service companies ("customer companies") to manage their own end customers: records, quotes, contracts, finances and customer service — including, when the customer company turns the feature on, customer service over WhatsApp. Each customer company has its data isolated in its own database, not shared with the other companies.

3. Data processed through the WhatsApp integration

When a customer company connects a WhatsApp Business number to the platform, we process, on its behalf and under its instructions:

• Name and phone number of the contacts who exchange messages with the customer company;
• Content of the text messages and attachments exchanged over WhatsApp;
• Conversation metadata (date/time, delivery status, labels/stage assigned by the customer company).

This data is used exclusively so that the customer company can serve its own customers through the platform (inbox, history, sending of messages authorized by the recipient). Delcontrol does not use the content of these messages to train models, for advertising, or for any purpose outside the service contracted by the customer company.

4. Other data processed by the platform

Besides WhatsApp, the platform also processes, depending on the module used by the customer company: customer and employee registration data, financial data (invoices, bank slips), quote and contract documents, and access data (login, email, usage records for security).

5. Google integration (Drive and Calendar)

When a customer company chooses to connect its own Google account, the platform accesses, after explicit authorization (OAuth) granted by the user on Google's consent screen, the following data:

• Google Drive (scope drive.file, the most restricted scope Google offers): the platform only sees and only creates/organizes the files that it saves itself — copies of approved quotes, contracts, invoices and payment receipts, organized in one folder per customer/lead. The platform does not list, read or access any other file that already exists in the user's Google Drive.
• Google Calendar (scope calendar.events): the platform creates, updates and removes appointment events in the calendar of the person who connected the account, relating to appointments scheduled inside the platform. We also read the email address of the connected Google account (scope userinfo.email), only to show on screen which account is connected.

These data are stored in the customer company's own Google account (its Drive/Calendar) — Delcontrol does not keep a parallel copy of the content of the files or of the events beyond what is necessary to perform the synchronization. The access token is stored encrypted and is used exclusively for these two purposes, at the request of the customer company itself. This access is optional (the customer company turns it on whenever it wants) and can be revoked at any time through the platform itself or directly at myaccount.google.com/permissions; files and events already created remain in the user's Google account, since they already belong to the user.

Delcontrol's use and transfer to any other app of information received from Google APIs adheres to the Google API Services User Data Policy, including the Limited Use requirements: this data is never used for advertising, is never sold or shared with third parties, and is never used to train general-purpose artificial intelligence models.

6. Sharing with third parties

Data may be shared with providers strictly necessary to operate the service, always under contract and limited to the purpose: Meta Platforms (WhatsApp Business API), Google (when the customer company turns on the Drive/Calendar integration, as described in section 5), email providers (SMTP), billing/payment gateways chosen by the customer company itself, and the infrastructure (hosting) provider. We do not sell personal data to third parties.

7. Security and retention

Integration credentials (API tokens) are stored encrypted. Each customer company operates in an isolated database. Data is kept for as long as the contract between Delcontrol and the customer company lasts, or for the period required by applicable legal obligations (for example, tax data).

8. Data subject rights (Brazilian LGPD)

Data subjects whose data is processed through the platform may exercise the rights provided by Brazil's General Data Protection Law (access, correction, deletion, portability, among others) directly with the customer company they have a relationship with — which is the controller of that data. Delcontrol acts as the processor, giving technical support to those requests.

9. Contact

Questions about this policy or about data processing on the platform can be sent to [email protected].