Privacy and Data Protection Policy

Last updated: July 8, 2026.

Translation notice. This English version is a translation provided for convenience. The original Portuguese version, available at vipdesk.com.br/privacy, is the governing version. In case of any discrepancy, the Portuguese version prevails.

1. Who we are and to whom this applies

This Policy describes how Vipphone Software (Brazilian CNPJ 03.742.028/0001-92), operator of the Platform ("we"), collects, uses, shares and protects personal data, in compliance with Brazil's General Data Protection Law – LGPD (Law No. 13,709/2018), the Brazilian Civil Rights Framework for the Internet (Law No. 12,965/2014) and other applicable regulations.

2. Processing roles: Controller and Processor

Account and Platform usage data (registration of the Customer and its users, billing, logs): we process it as Controllers.

Data of contacts and end customers that the Customer enters or transmits on the Platform (messages, phone numbers, emails, media): the Customer is the Controller and we act as Processors, processing this data according to the Customer's instructions and only to enable the service. The Customer is responsible for ensuring a legal basis and, where applicable, the consent of these data subjects.

3. Data we collect

• Registration data: name, email, phone number and — when purchasing a plan — company name, Brazilian taxpayer ID (CPF/CNPJ) and address, for billing and issuing invoices.
• Usage and technical data: IP address, device, browser, access and activity logs, necessary for security and operation.
• Transmitted content: messages, contacts and files that the Customer processes in the Channels (in our capacity as Processors).
• Payment data: processed directly by payment gateways (e.g., PIX, boleto and credit card); we do not store full card data.

4. Purposes and legal bases (LGPD, Art. 7)

• Performing the contract and providing the service — performance of a contract;
• Billing, collection and tax/accounting obligations — legal/regulatory obligation;
• Security, fraud prevention and service improvement — legitimate interest;
• Communications about the service and, with authorization, news and offers — consent/legitimate interest;
• Regular exercise of rights in legal proceedings — exercise of rights.

5. Sharing and processors (sub-processors)

We do not sell personal data. We share data only with third parties necessary for the operation, under security and confidentiality obligations, such as: infrastructure and cloud providers, payment and invoicing gateways, Channel providers (e.g., Meta/WhatsApp, Instagram, Facebook, Telegram), and email and monitoring services. We may also share data to comply with a legal obligation or an order from a competent authority.

6. International transfers

Part of the infrastructure and third-party services may be located outside Brazil. In such cases, we adopt safeguards compatible with the LGPD for international data transfers.

7. Retention, deletion and backups

We keep data for as long as necessary for the stated purposes and legal deadlines (e.g., retention of access logs and tax obligations). Once the relationship has ended and the applicable periods have elapsed, data is deleted or anonymized.

We maintain backup routines for continuity and recovery. In the event of a disaster, the recovery point objective (RPO) is up to 2 (two) hours — meaning data from the last 2 hours before the event may be lost — as detailed in the Terms of Use. We recommend that the Customer keep its own copies of critical data.

8. Information security

We adopt technical and administrative measures to protect data against unauthorized access, loss, alteration or improper disclosure, including encryption of sensitive data at rest and in transit, access control, per-company segregation (multi-tenant) and audit logs. No system is 100% infallible; in the event of a relevant security incident, we will take the appropriate measures and make the communications required by the LGPD, including to Brazil's National Data Protection Authority (ANPD) and to data subjects, where applicable.

9. Data subject rights (LGPD, Art. 18)

Data subjects may, at any time, request:

1. Confirmation that processing exists;
2. Access to the data;
3. Correction of incomplete, inaccurate or outdated data;
4. Anonymization, blocking or deletion of unnecessary data or data processed in non-compliance;
5. Portability to another provider, upon express request;
6. Deletion of data processed based on consent;
7. Information about sharing and about the possibility of not giving consent;
8. Withdrawal of consent.

When the data belongs to the Customer's contacts or end customers, requests must be directed to the Customer (Controller); we will act as Processors to support it in handling them.

10. Google integrations (Calendar and Drive)

When a user connects their own Google account to the Platform, access is granted by them in Google's authorization flow (OAuth) and limited to the scopes below. No access takes place without this explicit authorization.

Calendar (Google Calendar)

1. Reading availability (calendar.freebusy): we only check the start and end times of periods when the calendar is busy, so we don't offer unavailable time slots. We do not access titles, descriptions, attendees, locations or any other content of events.
2. Creating events (calendar.events): when an appointment is booked on the Platform, we create the corresponding event in the user's calendar, with the data of that appointment, and update or remove it if it is rescheduled or canceled.

What we store: the identifier of the created event (so we can update it later), the email address of the connected account and the access credentials, in encrypted form. Busy periods are queried in real time and kept only in a temporary cache, for a few minutes, to avoid repeated queries. We do not keep a copy of your events in our database.

Backup (Google Drive)

When the Customer enables backup to Google Drive (drive.file), we write the backup files generated by the Platform itself. This scope only grants access to files created by us: we cannot read, list or change any other files in your Drive.

Limited use and revocation

Data obtained through Google APIs is used exclusively to provide the features described above. We do not use it for advertising, we do not sell it and we do not transfer it to third parties, except when necessary to operate the service, when required by law or with the user's authorization. It is not used to train artificial intelligence models.

The use and transfer of information received from Google APIs adhere to the Google API Services User Data Policy , including the Limited Use requirements.

Authorization can be revoked at any time by the user, on the Platform's integration screen or at myaccount.google.com/permissions . After revocation, we end access and delete the stored credentials. Events already created in the calendar remain under the user's control.

11. Cookies

We use cookies and similar technologies that are essential for operation, authentication and security and, where applicable, for usage metrics. You can manage your preferences in your browser, bearing in mind that disabling certain cookies may affect functionality.

12. Data Protection Officer (DPO) and contact

To exercise your rights or ask questions about privacy, contact our Data Protection Officer at dpo@vipphone.com.br. Data subjects may also file a petition with Brazil's National Data Protection Authority (ANPD).

13. Changes to this Policy

This Policy may be updated at any time, especially for legal, regulatory or product reasons. The current version is always the one published on this page, with its update date.

Privacy questions: dpo@vipphone.com.br.