Privacy Policy

Who we are

Initu provides InituBot, a WhatsApp-first SaaS platform for support with an intelligent agent, knowledge base, human handoff, control, and continuous improvement.

The data controller for institutional purposes is INITU LTDA - ME, CNPJ: 55.167.992/0001-38, based in Curitiba, PR, Brazil.

Data we may collect

We may collect data needed to operate the service, provide support, maintain security, and deliver contracted features.

• Registration data, such as name, email, phone, company, role, and contact information.
• Account and authentication data, such as user identifiers, preferences, permissions, and access records.
• Platform usage data, such as accessed pages, configuration events, used features, operational metrics, and technical logs.
• Messages and content sent in conversations handled by the platform, including text, files, and information needed for support.
• Support metadata, such as timestamps, status, channel, conversation identifiers, history, handoff, and routing information.
• Files sent or used as context, such as documents, PDFs, images, screenshots, audio, and location sent by the customer.
• Integration identifiers, such as WhatsApp Business, 3CX, Twilio Flex, and other systems connected by the customer.
• Billing data when applicable, usually processed by payment providers.
• Support, security, audit, and abuse prevention records.

How we use data

We use data to deliver, maintain, and improve InituBot. Initu does not sell personal data.

• Create and manage accounts, access, and permissions.
• Operate InituBot, automate conversations, and support human handoff when needed.
• Use the knowledge base and settings provided by the customer company to guide answers.
• Improve platform quality, security, stability, and performance.
• Generate reports, metrics, and commercial signals for the customer company.
• Provide support, respond to requests, and solve technical issues.
• Comply with legal, tax, regulatory, and contractual obligations.
• Prevent fraud, abuse, misuse, and security incidents.

End customer data

Companies using InituBot may support end customers through WhatsApp or connected integrations. In those cases, the contracting company is responsible for informing its end customers about platform use and obtaining legal bases or authorizations when applicable.

Initu acts as a technology provider for the customer company and processes data according to instructions, settings, and contracted scope.

WhatsApp Business Platform and Meta

InituBot may integrate WhatsApp Business Platform resources and other Meta services when configured by the customer company.

Initu is not affiliated with, sponsored by, or endorsed by Meta. WhatsApp, Facebook, Meta, and related marks belong to their respective owners.

Use of those services may be subject to terms, policies, and availability defined by Meta and connected providers.

Data sharing

We may share data only when needed to operate the service, comply with legal obligations, or support integrations configured by the customer.

• Infrastructure, hosting, database, security, and monitoring providers.
• Communication, messaging, and connected channel providers.
• Payment and billing providers, when applicable.
• Support, service, audit, and usage analytics tools.
• Integrations configured by the customer, such as 3CX, Twilio Flex, WhatsApp Business, and external systems.
• Public, judicial, or regulatory authorities when required by law.

Storage and security

We adopt reasonable technical and organizational measures to protect data against unauthorized access, loss, misuse, alteration, or improper disclosure.

These measures may include company-level isolation, access controls, activity records, security mechanisms, and data protection practices.

No data transmission or storage is completely risk-free. We also depend on responsible use of accounts, integrations, and credentials by the customer company.

Retention and deletion

We keep data for as long as needed to provide the service, comply with legal, tax, and contractual obligations, maintain audit records, protect rights, and prevent abuse.

The customer company may request data export or deletion when applicable. Some data may be retained for an additional period due to legal obligation, security, fraud prevention, billing, audit, or disputes.

Data subject rights

Data subjects may request access, correction, deletion, information about sharing, and other rights provided by applicable law.

When a request involves data processed on behalf of a customer company, we may guide the data subject to contact that company or route the request according to the context.

Data deletion

To request data deletion, email contato@initu.com.br with the subject Data deletion. Include the account email, related company, and, if applicable, the WhatsApp number or identifier involved.

Before processing the request, we may validate identity, ownership, relationship with the account, and scope of data. Deletion will be handled according to law and may follow mandatory retention periods.

Cookies and similar technologies

We may use cookies and similar technologies for website functionality, preferences, security, usage analytics, and experience improvement.

Marketing cookies are used only when applicable configuration exists. You can control cookies through your browser and through mechanisms available on the website when they exist.

International transfer

Some providers used by Initu may process data outside Brazil. When this happens, we adopt measures compatible with applicable law and supplier contracts.

Children and minors

InituBot is not directed to children. Companies using the platform must ensure their channels and support operations comply with laws applicable to the audience they serve.

Changes to this policy

We may update this Privacy Policy to reflect changes in the product, operation, or legal requirements. The current version will always be available on this page.