Privacy policy

1. Our role in processing data

As a controller, we decide how and why we process: data about visitors who browse the website and fill in the form, customers' account and billing data, and platform usage logs.

As a processor, we handle, on behalf of our customers, the data they put into the platform: contacts of their own clients or patients, WhatsApp conversations, lists, files and campaign data. In those cases the customer is the controller and sets the purpose and legal basis (Article 28 GDPR). If you are a client or patient of a business that uses Sales Flow, please exercise your rights directly with that business.

2. What data we collect and why

• Contact form: name, email and phone number, to contact you on WhatsApp, by email or by phone about Sales Flow (demo, questions, sign-up).
• Visit data: the page you came from, campaign parameters in the link (for example utm_source or an ad click identifier), time on page, scroll depth, language, device and browser type, IP address and the approximate location (country and city) derived from it. We use it to understand which campaigns bring interested people and to invest better in advertising.
• Customer accounts: name, email, phone number, company, tax ID and billing details, to create and manage the account, bill, provide support and send operational messages.
• Access logs (IP, date and time) for the website and the platform, for security.

3. Legal basis

• Steps taken at your request before entering into a contract (Article 6(1)(b) GDPR): to respond to the contact form about the service you asked to learn about.
• Consent (Article 6(1)(a)): for marketing messages and measurement and advertising cookies (under the ePrivacy rules). You can withdraw it at any time, without affecting earlier processing.
• Performance of a contract (Article 6(1)(b)): for the data needed to provide the service to customers.
• Legal obligation (Article 6(1)(c)): for tax and accounting records.
• Legitimate interest (Article 6(1)(f)): for the campaign data sent with the form, website security and improving the platform.

4. Who we share it with

We don't sell personal data. We only share what is necessary, with providers bound by confidentiality and security obligations:

• Cloud hosting and infrastructure for the website and the platform.
• Automation and CRM tools we use to manage contacts, including the Sales Flow platform itself.
• Meta (WhatsApp), when we talk to you and, on customers' instructions, to connect the platform to their numbers.
• Google (Google Analytics and Google Ads) and Meta (pixel), to measure visits and ads, only if you accept cookies.
• Umami (Umami Software, Inc.), for cookieless visit statistics without personal data: pages viewed, visit source, country, device type and clicks on contact buttons, always aggregated and without identifying you.
• Artificial intelligence providers used in the platform's AI features, on customers' instructions.
• Payment processors, to bill subscriptions.
• Public authorities, when required by a court order or by law.

5. International transfers

We are based in Brazil and some of our providers process data in other countries. Where the GDPR applies, those transfers rely on the safeguards in Chapter V, such as adequacy decisions or the European Commission's standard contractual clauses.

6. How long we keep it

• Form contacts: while we are in touch and, at most, 24 months after the last contact if you don't become a customer.
• Customer data: for the duration of the contract and then for the periods required by law (for example, tax) or to defend legal claims.
• Access logs: 6 months.
• Data processed on behalf of customers: deleted or returned to the customer when the contract ends, except for backups and logs kept by legal obligation, for as long as strictly necessary.

If you withdraw your consent, we delete the data processed on that basis unless the law requires us to keep it.

7. Cookies

Cookies are small files stored in your browser. We use these:

• sf_consent (ours, 6 months, necessary): stores your choice in the cookie notice.
• NEXT_LOCALE and NEXT_CURRENCY (ours, 1 year, necessary): page language and currency.
• sf_aid (ours, 1 year): anonymous visit identifier, set by our customer service tool (Sales Flow) when the page opens. It records data such as language, device and link campaign parameters, without name, email or phone number.
• Source of your first and latest visit in browser storage (ours, 1 year, consent only): so we know which ad brought you if you contact us later.
• _ga and _ga_* (Google Analytics, up to 2 years, consent only): visit statistics.
• _gcl_* (Google Ads, up to 90 days, consent only): Google ad measurement.
• _fbp and _fbc (Meta, up to 90 days, consent only): Facebook and Instagram ad measurement.

You can accept or reject them in the cookie notice and change your choice at any time with the "Cookies" link in the page footer. If you reject them, Google and Meta cookies and the visit source are not stored, and Google only receives cookieless signals. You can also delete them in your browser settings.

8. Security

We apply technical and organisational measures in line with industry best practice to protect data against unauthorised access, loss, alteration or destruction, including access control, encryption, isolation of each customer's data, monitoring and internal security policies.

9. Your rights

You can exercise these rights at any time by writing to contato@talkerflow.me:

• Access to your data.
• Rectification of inaccurate or incomplete data.
• Erasure.
• Restriction of processing.
• Objection to processing based on legitimate interest.
• Data portability.
• Withdrawal of consent, without affecting earlier processing.

If you believe we have not handled your data properly, you can lodge a complaint with the data protection authority of your country (in Spain, the AEPD at www.aepd.es; in Brazil, the ANPD at www.gov.br/anpd).

10. Changes to this policy

We may update this policy to reflect changes in our practices or in the law. The date at the top shows the current version, and we notify customers of significant changes by email or in the platform.

11. Contact and data protection officer

To exercise your rights or ask about this policy, contact our data protection officer (DPO) at contato@talkerflow.me.