Privacy Policy

1. Who we are and what this policy covers

Sementhe Tecnologia Ltda., registered under CNPJ 69.620.267/0001-88, with its registered office at Av. Senador Ramos Caiado, 381, Qd. 23 Lt. 20, Apto 1103, Bairro Maracanã, Anápolis/GO, CEP 75040-320, Brazil (“Sementhe”).

This policy explains how Sementhe processes personal data on https://sementhe.com.br and in its products (CajuCRM, Condoberry, PapayAgenda and IpeFinance), under Brazil's General Data Protection Law (Law 13,709/2018, LGPD) and Civil Rights Framework for the Internet (Law 12,965/2014). Each product may have its own policy detailing its use; CajuCRM's is at cajucrm.com.br/privacidade.

2. Controller and processor

Sementhe is the controller of the data of people who visit the site, contact us and use the products: sign-up, login, billing, usage and contact.

Sementhe is the processor of the data each client business enters or receives through the products about its own clients and contacts, including WhatsApp, Instagram and Messenger conversations. For that data the controller is the business, which decides what to collect and why.

3. Data we process

• Site contact form: name, e-mail, interest and message. The message is e-mailed to our team; the site does not store it.
• Product accounts and use: name, e-mail, optional phone, company, role and the content you create in each product.
• Messages: content and metadata of conversations through the WhatsApp, Instagram or Messenger accounts a business connects to a product (section 5).
• Technical: IP address, date and time, browser and access logs, to run and protect the service.

4. Purposes and legal bases

• Answering people who contact us through the site: steps taken at the data subject’s request and legitimate interest (art. 7, V and IX).
• Providing the contracted service, keeping the account and giving support: performance of a contract (art. 7, V).
• Sending messages the person asked for or authorised, such as confirmations, reminders and invitations: performance of a contract and consent (art. 7, I).
• Billing, issuing tax documents and meeting legal obligations: legal obligation (art. 7, II).
• Keeping access logs for 6 months: legal obligation (Marco Civil, art. 15).
• Preventing fraud and abuse: legitimate interest (art. 7, IX).

5. Data received from Meta

When a client business connects its WhatsApp Business account, a Facebook Page or an Instagram professional account to a Sementhe product through Meta’s Embedded Signup, we receive through Meta’s official APIs only what each purpose needs:

• Profile name and identifier of whoever talks to the business (WhatsApp number or Messenger and Instagram ID): to identify the conversation and the contact.
• Message and media content: to show and answer the conversation in the product, including through the business’s artificial intelligence agent, always with the option of handing the conversation to a person.
• Delivery and read status: to show whether a message arrived.
• Lead-ad form answers (Lead Ads): to record the contact and the opportunity in the business’s CRM.
• Access tokens of the connected accounts: to run the integration on the business’s behalf. They are stored encrypted.

Data received from Meta is never sold, never used for advertising or profiling, never used to train artificial intelligence models, and never passed to third parties beyond the providers in section 6. Its use follows Meta’s Platform Terms and the WhatsApp Business Messaging Policy. Anyone who receives messages from a Sementhe product can ask them to stop at any time.

A business can disconnect its account by removing the product’s access in Meta’s business manager settings. How to request deletion: https://sementhe.com.br/en/exclusao-de-dados.

6. Sharing and sub-processors

We do not sell personal data. We share it only with the providers needed to run the site and the products, under contract and confidentiality:

• Vercel Inc. (United States): hosting of the site and applications.
• Supabase Inc., on Amazon Web Services (United States): database, authentication and files of the products.
• Resend (United States): sending e-mail, including contact form messages.
• Google LLC (United States): Sign in with Google and the Gemini API, used by the products’ artificial intelligence assistants, under a paid tier that does not train models on this data.
• Meta Platforms (United States): sending and receiving WhatsApp, Instagram and Messenger messages when a business connects its accounts.

We may also share data when required by law or by order of a competent authority.

7. International transfer

Because these providers operate in the United States, personal data is transferred outside Brazil, under art. 33 of the LGPD, in particular the standard contractual clauses approved by Brazil’s data protection authority (ANPD Resolution 19/2024).

8. How long we keep data

• Contact form messages: as long as needed to answer and for up to 12 months after.
• Account and business data in the products: while the account is active and up to 30 days after a deletion request, with backups overwritten in their normal rotation.
• Access logs: 6 months (Marco Civil, art. 15).
• Billing and tax data: for the period tax law requires, usually 5 years.

9. Security and incidents

We use encrypted connections (HTTPS), encryption of integration credentials, isolation of each business’s data, access control in the application and audit logs. If an incident may cause relevant risk or harm, we will notify the ANPD and the affected data subjects within the deadlines of ANPD Resolution 15/2024.

10. Your rights

As a data subject you may request, under art. 18 of the LGPD:

• confirmation that we process your data, and access to it;
• correction of incomplete, inaccurate or outdated data;
• anonymisation, blocking or deletion of unnecessary data or data processed unlawfully;
• portability, as regulated by the ANPD;
• deletion of data processed with your consent, and withdrawal of consent;
• information about whom we share your data with;
• review of decisions taken solely by automated processing.

To exercise these rights, write to contato@sementhe.com.br. We answer within 15 days. You may also complain to Brazil’s data protection authority (ANPD).

11. Cookies

The site uses only necessary technical cookies, such as the one remembering the chosen language. We use no advertising cookies and no third-party tracking.

12. Data Protection Officer (DPO)

Requests to the officer in charge of personal data processing, from data subjects and from the ANPD, are answered at contato@sementhe.com.br. Postal address: Av. Senador Ramos Caiado, 381, Qd. 23 Lt. 20, Apto 1103, Bairro Maracanã, Anápolis/GO, CEP 75040-320, Brazil.

13. Changes to this policy

This policy may be updated. The date at the top shows the version in force, and relevant changes are announced in the products and by e-mail.