Privacy Policy

Last updated: October 9, 2026

This policy explains how Atlântida Code processes personal data on its corporate website and on the customer-support platform it hosts for business clients, including the integration with Meta's WhatsApp Business Platform. It follows the Brazilian General Data Protection Law (LGPD — Law 13,709/2018). This is a translation of the Portuguese version, which prevails in case of conflict.

1. Who we are

Atlântida Code — ATLANTIDA CODE SOLUTIONS LTDA., registered under CNPJ (Brazilian company registry) no. 31.379.930/0001-21, with offices in Guarulhos/SP, Brazil.

Data Protection Officer (DPO): privacidade@atlantida-code.com.br.

General contact: contato@atlantida-code.com.br · +55 (11) 95848-7752.

2. What we do

Atlântida Code hosts and operates a Chatwoot-based customer-support platform for business clients, and integrates it with Meta's WhatsApp Business Platform (Cloud API). In that integration we act as a Tech Provider: we connect our business clients' WhatsApp numbers to the platform so they can talk to their own contacts.

The integration can run in two modes:

• Cloud API — the number is operated through Meta's API and messages reach the platform.
• Coexistence — the number stays active in the client's WhatsApp Business app while messages are also available in the platform.

In either mode, conversation content belongs to the business client and to its contacts. We do not use it for our own purposes, we do not sell it, and we do not use it for advertising.

3. Our roles under the LGPD

4. Personal data we process

4.1 On behalf of business clients (as processor)

• Contacts' phone numbers.
• Contacts' display names and profile pictures, when made available by WhatsApp.
• Message content and attachments (images, audio, video, documents, location).
• Metadata: send and receive timestamps, delivery and read states, conversation identifier, source channel, assigned agent.
• Identifiers issued by Meta: WhatsApp Business Account ID (WABA), phone number ID, message ID, and the access tokens Meta issues to run the integration.
• Labels, internal notes and custom attributes the client records about a contact inside the platform.

4.2 From platform users (as controller)

• Name, business e-mail and hashed password.
• Access profile, assigned inboxes and preferences.
• Technical access logs: IP address, timestamp, browser — kept for security and as required by the Brazilian Internet Civil Framework.

4.3 From the corporate website

• Name, company, e-mail, phone (WhatsApp), interest and message submitted through the contact form.
• Origin of the visit when the form is sent: landing page, referring site and campaign parameters (UTM).
• Basic technical security data (IP, user agent) and anti-abuse verification.

5. Why we use the data

• To deliver the support service contracted by the business client.
• To send, receive, display and store messages and attachments.
• To produce support reports and metrics for the client itself.
• To authenticate users and keep the platform secure, preventing fraud, spam and abuse.
• To provide technical support to the client.
• To comply with legal and regulatory obligations and orders from competent authorities.
• To reply to business enquiries received through the website.

6. Legal bases (LGPD, art. 7)

• Performance of a contract (art. 7, V) — delivering the service to the business client and managing its users' accounts.
• Legitimate interests (art. 7, IX) — information security, fraud and abuse prevention, service improvement and stability, always balanced against data subjects' rights.
• Compliance with a legal or regulatory obligation (art. 7, II) — retention of access logs and responses to authorities.
• Consent (art. 7, I) — where applicable, for example marketing communications from the website. Consent can be withdrawn at any time.

Where we act as a processor, the legal basis for processing contacts' data is defined by the business client, who is the controller of that data.

7. Who we share data with

We do not sell personal data. We share only what is necessary, with the following processors and partners:

All processors are contractually bound to confidentiality and security obligations consistent with this policy.

8. Data location and international transfers

Platform data is stored on servers located in Brazil. International transfers happen only to the providers listed in section 7, which run infrastructure abroad. Those transfers rely on specific contractual clauses and on the safeguards set out in articles 33 to 35 of the LGPD.

9. How long we keep data

• Data processed on behalf of a client: for the duration of the contract and any applicable legal period.
• Enquiries received through the website contact form: for 2 years from submission, then deleted automatically.
• After a deletion request or contract termination: deletion or anonymisation within 30 days.
• Backup copies: erased in the normal rotation cycle, within 90 days.
• Access logs: for the period required by the Brazilian Internet Civil Framework (Law 12,965/2014).
• Data needed to exercise rights in judicial or administrative proceedings: until those proceedings and limitation periods end.

To request deletion, see the Data Deletion Instructions.

10. Data subject rights (LGPD, art. 18)

At any time you may request:

• Confirmation that processing exists, and access to the data.
• Correction of incomplete, inaccurate or outdated data.
• Anonymisation, blocking or deletion of unnecessary or excessive data, or data processed in breach of the LGPD.
• Portability to another provider, under ANPD rules.
• Deletion of data processed on the basis of consent.
• Information about who we share data with.
• Information about the option not to consent and the consequences of refusing.
• Withdrawal of consent.
• Review of automated decisions, where they exist.

11. Security

• Encryption in transit (TLS) and encryption at rest in the storage infrastructure.
• Role-based access control, individual authentication and hashed passwords.
• Logical isolation between different client accounts.
• Audit logs for administrative access.
• Restricted custody of the access tokens issued by Meta, used solely to operate the integration authorised by the client.
• Periodic backups with limited retention.

No system is infallible. In the event of a security incident with relevant risk, we notify affected clients and the ANPD within the legal deadlines.

12. Cookies

• Corporate website: technical cookies required for operation and security (including anti-abuse verification on the contact form). Measurement and marketing cookies (Google Analytics, Meta Pixel and Apollo.io) are only enabled if you accept them in the cookie notice, and you can change that choice at any time under “Cookie preferences” in the site footer.
• Support platform: session cookies to keep the user signed in and store interface preferences.

You can block cookies in your browser, but that may prevent signing in to the platform.

13. Minors

Our services are aimed at companies and their professionals. They are not directed at people under 18 and we do not knowingly collect children's or adolescents' data. If we identify such collection, we delete the data.

14. Commitment to Meta and WhatsApp policies

As a Tech Provider, we comply with — and contractually require our clients to comply with:

• The Meta Platform Terms and Policies.
• The WhatsApp Business Messaging Policy.
• The WhatsApp Business Policy.

In particular: the client is responsible for obtaining contacts' opt-in before starting conversations, for offering a clear way to opt out, and for not using the channel for unsolicited bulk messaging (spam). Breach may lead to immediate suspension of the integration, under the Terms of Service.

15. Changes to this policy

We may update this policy to reflect changes in the service or in the law. The last-updated date is always at the top of the page. Material changes are communicated to clients by e-mail with reasonable notice.

16. Contact