Privacy Policy

1. Scope

This Policy applies to all Products operated under the Cartel brand or by group companies, including institutional websites, SaaS platforms, browser extensions published on the Chrome Web Store, and other technology services.

If a Product-specific notice conflicts with this document for the service you use, the specific notice prevails unless the law requires otherwise. Third-party services (for example, AI providers you connect in an extension) have their own policies.

Sections 2–5 below describe data collection, handling, storage, and sharing for Cartel Products in general. Section 6 contains additional, product-specific disclosure for the WhatsApp Sales Copilot Chrome extension (Item ID: ebfipnpgfocljphplkenfdnigoallbak).

2. Data collection

We collect personal and sensitive user data only as needed to operate each Product. Depending on what you use, collection may include:

• Identification and contact: name, email, phone, job title, company, billing and tax details when you sign up, request access, or contract a service.
• Account and credentials: login identifiers, authentication tokens, and preferences you save in your account.
• Content you provide: text, files, or configuration you enter in forms, dashboards, or product settings (including optional “company context” text in browser extensions).
• Usage and technical data: IP address, browser type, device identifiers, timestamps, error logs, and interaction events on our websites and hosted SaaS.
• Communications: support messages and operational email when you contact us.
• Browser extension — on-device reads: for extensions that interact with web pages (such as WhatsApp Web), data is read from the page only when you take an explicit action (for example, clicking a “Copilot” button). We do not collect your full message history in the background.

We do not collect data from children under 13. Business Products are intended for users 18+ or organizational use.

3. Data handling

“Handling” means how we use, process, transmit, and protect data after collection:

• Purpose limitation: we use data to provide and improve the Product you requested, authenticate you, bill contracted services, prevent abuse, comply with law, and respond to support requests.
• Processing on servers: for hosted Cartel SaaS and websites, processing runs on infrastructure we or our subprocessors operate, with access restricted by role and contract.
• On-device processing: some browser extensions process page content locally in your browser and call external APIs only when you initiate an action.
• Human access: Cartel staff may access data only for support, security, or legal compliance, on a need-to-know basis.
• Security in transit: we use HTTPS/TLS for network transmission where applicable. API keys configured in extensions are not written to logs by our extension code.
• No automatic messaging: WhatsApp Sales Copilot never sends WhatsApp messages on your behalf; it only suggests text you may copy or insert manually.

Legal bases under LGPD and similar laws include contract performance, legal obligation, legitimate interest (with safeguards), and consent when required.

4. Data storage

“Storage” means where data is kept and for how long:

• Hosted Products: account and operational data are stored on servers in Brazil and/or other countries where our providers operate, with backups for disaster recovery.
• Browser extensions (local): WhatsApp Sales Copilot stores settings (provider, model, API key, company context, mock mode) in chrome.storage.local on your device only — not in chrome.storage.sync. Saved sales analyses (situation summary, suggested replies, contact label, chat identifier) are also kept locally, up to 8 analyses per chat and 40 total, then older entries are removed automatically.
• Retention: we keep server-side data for the life of your account or contract, plus periods required for tax, accounting, fraud prevention, and legal claims. When retention ends, we delete or anonymize data unless the law requires longer storage.
• Your controls: you can delete extension data by clearing the extension’s storage in Chrome, uninstalling the extension, or using in-product delete actions for saved analyses. For hosted services, use account settings or contact us to request deletion subject to legal exceptions.

5. Data sharing

“Sharing” means disclosure to third parties. We share personal data only as described here:

• Service providers: hosting, email, payments, CRM, analytics, and support vendors under data-processing agreements and our instructions.
• Cartel group companies: when permitted by law, contract, or consent, for integrated operations, support, and fraud prevention — with minimization and your rights preserved.
• AI and API providers (extensions): when you use WhatsApp Sales Copilot with live mode (not mock), visible messages from the open WhatsApp Web chat, plus your configured company context and prompts, are sent directly from your browser to the provider you chose (OpenAI, Anthropic, Google Gemini, or a custom OpenAI-compatible URL). Cartel does not operate a backend that receives those messages for this extension.
• Legal and safety: authorities or parties when required by valid legal process or to protect rights, safety, and integrity of our services.
• Business transfers: successors in a merger or acquisition, with continued protection under this Policy.

We do not sell personal data to data brokers. We do not share WhatsApp Sales Copilot conversation content with Cartel servers. Optional host permissions for custom API URLs are requested at runtime when you save settings, not for undisclosed third parties.

6. WhatsApp Sales Copilot (Chrome extension)

This section supplements Sections 2–5 for the extension WhatsApp Sales Copilot (Chrome Web Store Item ID: ebfipnpgfocljphplkenfdnigoallbak). Controller: Cartel Company. Privacy contact: privacidade@cartel.com.br.

What the extension does: it adds a sales copilot panel to WhatsApp Web. When you click the Copilot control, it reads currently visible messages in the open chat, optionally sends them to your configured AI provider, and displays suggested replies and guidance. You choose whether to copy or insert text; sending messages remains your action in WhatsApp.

Data collection: (a) Settings you enter: AI provider, model name, API key, optional custom base URL, optional company/sales context, mock-mode flag. (b) When you request an analysis: visible chat text parsed from the WhatsApp Web page, a stable chat key derived from the page, and the contact name shown in the UI. (c) Technical: none sent to Cartel; provider APIs may log requests per their policies.

Data handling: parsing and panel display occur in the content script on web.whatsapp.com. API calls are made from the extension service worker to the provider endpoints declared in the manifest (api.openai.com, api.anthropic.com, generativelanguage.googleapis.com) or your approved custom host. Mock mode generates sample output without calling an external API.

Data storage: all extension settings and saved analyses remain in chrome.storage.local on your computer until you delete them or uninstall the extension. API keys are not exposed to the content script and are not synced across devices via Google account sync.

Data sharing: conversation excerpts and prompts are shared only with the AI provider you configure, under that provider’s terms and privacy policy. We do not receive, store, or sell that content on Cartel servers. WhatsApp/Meta is a separate platform; this extension is not affiliated with WhatsApp or Meta.

Permissions: storage (save settings and analyses locally); content script on https://web.whatsapp.com/* (inject UI and read visible chat when you act); host permissions for listed AI APIs and optional runtime host access for custom URLs you enter.

7. Who is responsible for processing

The controller of personal data is the Cartel entity or group company identified in the Product, contract, or invoice applicable to the service you use or purchase.

For the Cartel institutional website and contact or access-request forms, the controller is Cartel Company.

When we act as a processor on behalf of a corporate customer (for example, processing end-user data for a SaaS product), that customer is the controller; in those cases, consult the customer’s privacy policy and, if needed, exercise your rights directly with them.

8. Data categories (reference)

Depending on the Product and your interaction, we may process categories such as:

• Identification and contact: name, email, phone, job title, company, address, documents when required by law or contract.
• Account and authentication: credentials (stored securely), preferences, login history, session tokens.
• Commercial and usage data: subscribed plan, billing, support tickets, usage logs, settings, content you submit to the platform.
• Technical data: IP address, device identifiers, browser, operating system, error logs, performance metrics.
• Marketing and communications: communication preferences, campaign interactions, when consent or an applicable legal basis exists.
• Sensitive data: only when strictly necessary, with an adequate legal basis and enhanced measures — for example, when a Product requires regulatory information or you provide it voluntarily in a permitted context.

You are not required to provide all data, but refusing essential data may prevent signup, purchase, or Product features.

9. How we collect data

• Directly from you (forms, signup, support, contracts, events).
• Automatically during use of the Products (cookies, pixels, SDKs, server logs).
• From authorized third parties (payment partners, identity verification, B2B enrichment, referrals).
• From other Cartel ecosystem companies, when permitted by law, contract, or consent, to operate the product network in an integrated way.

10. Purposes and legal bases (LGPD)

We process personal data for purposes such as:

• Providing, operating, personalizing, and improving the Products.
• Creating and managing accounts, authenticating users, and ensuring security.
• Processing payments, issuing tax documents, and fulfilling contractual obligations.
• Handling requests, access applications, support, and operational communications.
• Preventing fraud, abuse, incidents, and terms-of-use violations.
• Conducting aggregated analytics, product research, and performance metrics.
• Sending marketing communications, when applicable, with opt-out options.
• Complying with legal, regulatory obligations and orders from competent authorities.
• Exercising rights in judicial, administrative, or arbitration proceedings.

Legal bases include, as applicable: performance of a contract or preliminary procedures; compliance with a legal or regulatory obligation; regular exercise of rights; legitimate interest (with balancing and safeguards); and consent when required — for example, for non-essential cookies or certain marketing communications.

11. Cartel ecosystem and additional sharing

Cartel operates a network of technology products. With consent, contract, or an applicable legal basis, data may be shared among group companies for: integrated operation, discovery of complementary products, unified support, fraud prevention, aggregated analytics, and experience improvement — always respecting minimization, transparency, and your rights.

We may also share data with:

• Service providers (hosting, email, payments, CRM, analytics, support), under appropriate contracts and instructions.
• Commercial partners, when you choose integrations or joint offers.
• Public authorities, when required by law or a valid decision.
• Successors in corporate reorganization, merger, or acquisition, with continuity of the protections in this Policy.

We do not sell personal data in the sense of commercialization to data brokers.

12. Cookies and similar technologies

We use cookies, local storage, and equivalent technologies for essential operation (session, security, preferences), audience measurement, product improvement, and, when applicable, advertising.

You can manage cookies through your browser or preferences shown in the Product. Disabling essential cookies may affect service functionality.

13. International transfers

Infrastructure and vendors may be located in Brazil or abroad. When international transfer occurs, we adopt contractual clauses, impact assessments, or other mechanisms provided under LGPD and applicable regulation, according to risk and the nature of the data.

14. Retention (summary)

We retain data for as long as necessary for the purposes described, legal compliance, dispute resolution, and protection of rights. Criteria include: contract duration, tax and accounting deadlines, statute of limitations for claims, and internal backup and log policies.

After the applicable period, we delete or anonymize data unless the law requires retention.

15. Security

We adopt technical and organizational measures proportionate to risk: access control, encryption in transit where applicable, environment segregation, monitoring, and incident response procedures.

No system is fully invulnerable. In the event of a relevant incident that may affect you, we will communicate as required by LGPD and good practice.

16. Your rights

Under Brazilian Law No. 13,709/2018 (LGPD) and related legislation, you may request, when applicable:

• Confirmation of processing and access to data.
• Correction of incomplete, inaccurate, or outdated data.
• Anonymization, blocking, or deletion of unnecessary data or data processed unlawfully.
• Portability to another provider, subject to ANPD rules.
• Deletion of data processed based on consent, subject to legal exceptions.
• Information about sharing and about the possibility of withholding consent.
• Withdrawal of consent and objection to processing based on legitimate interest, when applicable.

To exercise your rights, use the privacy channel below or the contact for the Product you use. We may request information to confirm your identity. You may also file a complaint with the National Data Protection Authority (ANPD).

17. Children and adolescents

Our Products are generally intended for people 18 or older or for business use. We do not knowingly collect children’s data without parental consent or an adequate legal basis. If we become aware of improper collection, we will take steps to delete the data.

18. Automated decisions

Some Products may use automated profiles or rules (for example, fraud detection, risk scoring, or recommendations). When the law requires, we will disclose relevant logic and enable human review or contestation.

19. Changes to this Policy

We may update this Policy to reflect new Products, legal requirements, or processing practices. We will publish the revised version with a new “Last updated” date. Material changes may be communicated by email, in-app notice, or a prominent site notice.