Privacy Policy

Version 2.2 · Last updated: 2026-07-26

WiseData Business LTDA is committed to protecting the privacy and data of its users. This policy describes how we collect, use, store, and protect information across our entire product ecosystem, in compliance with applicable data protection laws.

1. WiseData Business Structure and Product-Specific Policies

WiseData Business LTDA is a technology company that develops and operates an ecosystem of software products. This Privacy Policy is the umbrella document applicable to all of our products and to the wisedatabusiness.com website.

  • WiseData Tools — lead capture through a WhatsApp button
  • WiseData Agency — management system for marketing agencies
  • WiseData Finances — personal and business financial management
  • WiseData Leads — B2B lead prospecting
  • WiseData NPS — satisfaction surveys
  • Balancinho — financial control for sole proprietors and freelancers
  • Goiânia NFS-e Issuer — issuance of service invoices
  • WiseData Help Center (wisedata.wiki) — documentation, tutorials and support service for all products

Each product may have its own specific Privacy Policy, detailing the processing activities particular to that service. When you use a specific product, that product's policy prevails on any point where it is more detailed or specific, and this policy applies in a complementary manner.

Our products include, among others:

2. Data Collected

We collect information in the following ways:

Data provided by users: Information entered during sign-up, authentication, or use of our systems' features, such as name, email, phone, company, tax ID, and, in financial products, financial and payment data.

Data collected automatically: Technical and browsing information, such as IP address, activity logs, cookies, and tracking data from tools like Google Analytics and advertising pixels (Meta, Google Ads, LinkedIn).

Support and Help Center data: When you open a ticket or browse the Help Center (wisedata.wiki), we process the content of the messages and attachments you send, the originating product, the service history, article ratings ("was this article helpful?") and the terms you searched for. Article voting uses a random visitor identifier stored in our own cookie, with no link to your identity. Please avoid including in tickets any sensitive or third-party personal data that is not necessary to resolve your request.

Data entered or imported by you: Third-party data that you record or import into our products — such as CRM contacts, survey respondents, invoice recipients, or leads captured by your buttons. In these cases, you act as the Controller and we act as the Processor (see section 5).

Data obtained through Meta APIs (Facebook, Instagram, WhatsApp):

  • Business Manager ID and name
  • ID and name of connected pages
  • WhatsApp Business phone number ID
  • Conversations and messages (text, media, and metadata) exchanged via WhatsApp, Instagram Direct, and Facebook Messenger
  • Public profile information of users who interact with the integrated accounts

3. Purpose of Data Use

The data collected is used to:

  • Provide, operate, and improve the contracted products and services
  • Provide support, respond to your requests and identify gaps in the Help Center documentation
  • Sync and display messages sent and received on the connected channels (WhatsApp, Instagram, and Facebook)
  • Provide reports, analytics, and artificial intelligence assistants
  • Enable centralized management of multiple assets (pages, numbers, accounts, companies)
  • Facilitate automations and operational routines requested by users
  • Comply with legal, administrative, or tax obligations, where applicable
  • Improve the performance, stability, and security of WiseData systems
  • Communicate news and offers about WiseData group products, when authorized

4. Legal Basis

Data processing is carried out based on the following legal bases:

Performance of a contract: To provide the services contracted by the user.

Legitimate interest: To ensure security, prevent fraud, monitor performance, improve the platform, and communicate group products, always subject to a balancing test.

Consent: For marketing communications, non-essential cookies, and specific integrations with third-party platforms.

Compliance with a legal obligation: For the retention of access records, tax documents, and other legal requirements.

Data made publicly available by the data subject: For the processing of data on companies and their representatives obtained from official public sources in commercial prospecting products (see section 8).

5. Our Roles: Controller and Processor

Under applicable data protection laws, WiseData Business may act as a Controller or as a Processor, depending on the data and the product:

As a Controller: For your account, billing, marketing, and browsing data on our websites, we decide how and why to process it.

As a Processor: For third-party data that you enter or import into our products (CRM contacts, survey respondents, invoice recipients, leads captured by your buttons), you are the Controller and we process that data only following your instructions and to deliver the service.

When you act as the Controller, you are responsible for ensuring an adequate legal basis for the collection and use of that data. For these cases, upon request, we provide a Data Processing Agreement (DPA) that formalizes each party's obligations.

6. Data Sharing and Transfer

We do not sell, rent, or assign personal data. Sharing occurs only with subprocessors and partners necessary to operations (see section 7), when required by a legal obligation or court order, or with the user's consent.

Data may be shared internally among WiseData group products when a centralized feature is used by more than one product, always respecting the specific purpose of each processing activity.

Some of our subprocessors are located in other countries (for example, in the United States). In these cases, the international transfer complies with applicable data protection laws, with standard contractual clauses and appropriate security measures.

7. Subprocessors and Partners

To operate our products, we rely on subprocessors that process data on our behalf, always under contract and with appropriate safeguards. The list may vary by product and is updated periodically. The main ones are:

Infrastructure and hosting: Hostinger and Amazon Web Services (AWS). Cloudflare, as a content delivery network and protection against automated traffic.

Payment processing: Stripe (we do not store full card data).

Artificial intelligence: OpenAI and Anthropic, for AI assistants. The data sent is not used to train their models.

Communication and support: SendGrid (Twilio) for emails, Chatwoot for customer service, and WhatsApp channels.

Validation and tax issuance: MillionVerifier (email validation) and Focus NFe (invoice issuance).

Analytics and advertising: Google (Analytics, Ads, Tag Manager), Meta (Pixel), and LinkedIn (Insight Tag).

Session recording and user experience: Microsoft Clarity, which records browsing behavior in pseudonymized form (clicks, scrolling and navigation path) so we can identify friction points. Form fields and sensitive content are masked.

Visitor location detection: VisitorAPI, which receives the IP address of anyone accessing our websites and returns country, region, language and currency, so we can adapt the content shown. It receives no name, email or account data.

Marketing automation (own infrastructure): Mautic, used to send communications, segment contacts and track interactions with our emails and pages. Unlike the other items in this list, Mautic is hosted on WiseData Business' own server in Brazil — no third party operates this data and there is no international transfer.

Monitoring and security: Sentry and Laravel Nightwatch, which receive only technical reports on failures and performance, never the content of your data.

Public data sources: Official public business registries and municipal webservices, used in B2B prospecting and NFS-e issuance.

8. Third-Party Data and Commercial Prospecting (B2B)

Some products, particularly WiseData Leads, process data on companies and their representatives for commercial prospecting (B2B) purposes.

This data is obtained mostly from public and official sources, such as official public business registries, and from corporate profiles made public by the data subjects themselves. The processing is based on the legal bases of data made publicly available by the data subject and legitimate interest under applicable data protection laws.

WiseData Business organizes, classifies, and enriches this data but does not alter the original content coming from the official sources. Any inconsistencies must be corrected with the original source.

If you are a data subject or a representative of a company present in our databases and wish to access, correct, or request the deletion of your data, contact our Data Protection Officer (section 14). We will handle your request in accordance with applicable data protection laws.

9. Data Security

We adopt strict security measures, including:

  • Encryption of sensitive data in transit (TLS) and at rest
  • Access control by permission levels, with logging and auditing
  • Constant monitoring for suspicious activity
  • Encrypted storage of sensitive credentials, such as digital certificates, with restricted access
  • Access to information restricted to authorized professionals

10. Data Retention

We keep data only for as long as necessary for the purposes for which it was collected and to comply with legal obligations. Among others, we adopt the following reference periods:

  • Access records and logs: 6 months, or as required by applicable law
  • Tax and contractual documents: 5 years or the applicable legal period
  • Marketing and browsing data: up to 24 months or until consent is withdrawn
  • Tax data processed when issuing invoices: for the minimum legal period required by tax legislation
  • Support tickets, messages and attachments: for the duration of the customer relationship and up to 5 years after its termination, for defense in potential litigation
  • Help Center audit logs: 60 days

After the account is closed, data is securely deleted or anonymized within the periods defined in each product's specific policy.

11. Data Subject Rights

You may, at any time:

  • Request access to your data
  • Correct inaccurate information
  • Request the deletion or anonymization of your data
  • Request data portability
  • Withdraw consent previously given
  • Restrict the use or processing of your data

To exercise your rights, contact our Data Protection Officer (section 14). You may also file a complaint with the competent data protection authority.

12. Revoking Access to Meta Accounts

The user may revoke access to their Meta business accounts (WhatsApp, Facebook, Instagram) at any time:

  • Directly in our systems' dashboard
  • Through Meta's Business Manager
  • By uninstalling the WiseData Business app in the Meta dashboard

Revocation will cease the processing of data from those accounts within WiseData systems, subject to the applicable legal retention periods.

13. Use of Cookies and Tracking Technologies

The cookies below were identified through a technical audit of our pages. Durations are the ones actually applied by the browser and may vary by product.

Strictly necessary: authenticated session and cross-site request forgery (CSRF) protection cookies in our systems, language preference (NEXT_LOCALE) on our websites, and __cf_bm (30 minutes), from Cloudflare, which distinguishes humans from bots.

Audience measurement: _ga and _ga_<stream ID> (1 year), from Google Analytics 4, loaded through Google Tag Manager. _clck (12 months) and _clsk (24 hours), from Microsoft Clarity, which group browsing into session recordings and heatmaps.

Advertising and campaign measurement: _fbp (3 months), from the Meta Pixel. _gcl_au (3 months), from Google Ads. bcookie (12 months), li_sugr (3 months), lidc (24 hours) and ar_debug (1 month), from the LinkedIn Insight Tag.

Marketing automation: mtc_id and mtc_sid (session), mautic_device_id (12 months) and mautic_referer_id (29 minutes), from Mautic. The same cookies are used on the marketing.grupowisedata.com domain.

Strictly necessary cookies are essential to the operation of our websites and systems. Measurement, advertising and automation cookies rely on your consent and can be managed in your browser settings, in our preference center when available, or through the ad controls of the platforms themselves. Withdrawing consent does not affect the lawfulness of processing carried out beforehand.

14. Data Protection Officer (DPO)

WiseData Business maintains a Data Protection Officer, responsible for receiving requests from data subjects and from the competent data protection authority:

General channel: dpo@wisedatabusiness.com

Product-specific channels: dpo.tools@wisedatabusiness.com, dpo.agency@wisedatabusiness.com, dpo.finances@wisedatabusiness.com, dpo.leads@wisedatabusiness.com, dpo.nps@wisedatabusiness.com, dpo.balancinho@wisedatabusiness.com and dpo.nfse@wisedatabusiness.com

We will respond to requests within the periods set forth in applicable data protection laws.

15. Updates to This Policy

This policy may be updated periodically. When significant changes are made, we will notify you by email or directly within the WiseData systems. The version and the date of the last update appear at the top of this document.

16. Contact

If you have any questions, requests, or complaints related to privacy or the use of your data, contact us through the contact page on our website or via our Data Protection Officer's email.

WiseData Business LTDA
CNPJ: 53.182.850/0001-14
www.wisedatabusiness.com