Privacy Policy

This Privacy Policy describes how CIA LIGHT ILUMINAÇÃO LTDA ("Quatro7", "we") collects, uses, shares and protects personal data within the Quatro7 platform, a customer-service and CRM product that operates on top of Meta's WhatsApp Business Platform (Cloud API). By using Quatro7, you agree to the practices described here.

1. Who this policy applies to

Quatro7 is a tool used by business customers to serve their own contacts over WhatsApp. This policy covers two groups of data subjects:

• Platform users — staff of the business customers who access the Quatro7 dashboard.
• End contacts — people who talk to the business over WhatsApp and whose messages pass through the platform. For these contacts the business customer acts as controller and Quatro7 as processor, handling the data under the business's instructions.

2. Data we collect

Account and platform users

• Name, e-mail and dashboard access credentials;
• Company data and inbox configuration;
• Usage records, access logs and IP addresses, for security and auditing.

WhatsApp conversations

• The contact's phone number and WhatsApp display name;
• Message content exchanged (text, images, audio, documents and other media);
• Message metadata (date/time, delivery/read status, identifiers);
• Technical identifiers of the official account (phone number ID, WhatsApp Business Account ID).

We do not deliberately collect sensitive categories of data. We ask that contacts do not send sensitive information through the support channel.

3. How we use the data

• Send and receive WhatsApp messages on behalf of the business customer;
• Organize customer service (routing, conversation history, sales funnel/CRM);
• When enabled by the business, apply automation and artificial-intelligence features to assist replies;
• Provide technical support, ensure security, prevent fraud and comply with legal obligations;
• Produce operational metrics and reports for the business customer.

4. Legal basis (LGPD)

We process personal data based on the performance of a contract and preliminary procedures (art. 7, V of the Brazilian LGPD), compliance with legal obligations, legitimate interest to operate and protect the service, and, where applicable, the data subject's consent.

5. WhatsApp and Meta

Quatro7 uses the WhatsApp Business Cloud API provided by Meta Platforms. Sending and receiving messages goes through Meta's infrastructure, which processes that data as a processor under its own policies. We recommend reading the WhatsApp Business Policy and Meta's Privacy Policy. We do not use conversation data for advertising and we do not sell it.

6. Data sharing

We share data only as needed to operate the service:

• With Meta/WhatsApp, as an inherent part of how the official API works;
• With infrastructure providers (hosting, database and storage) under confidentiality obligations;
• When the business customer enables integrations (for example, their ERP), strictly per their configuration;
• To comply with the law or respond to competent authorities.

We do not sell, rent or trade personal data.

7. Retention

We keep data for as long as necessary to provide the service and comply with legal obligations. When the contract ends, or upon a deletion request, data is erased or anonymized as described in section 9 and on our Data Deletion page, except where the law requires retention.

8. Security

We adopt technical and organizational measures to protect data, including encryption at rest of credentials and secrets, role-based access control, transmission over secure channels (HTTPS/TLS) and audit logs. No system is entirely risk-free; we work continuously to mitigate risks.

9. Your rights

Under the LGPD you may request: confirmation of and access to your data; correction of incomplete or outdated data; anonymization, blocking or deletion of unnecessary data; portability; information about sharing; and withdrawal of consent. To exercise these rights, write to contato@cialight.com.br. End contacts may also address the request to the business they spoke with, which is the controller of that data.

10. Data deletion

You can request deletion of your data at any time. Full instructions are at https://meta.flowles.com.br/data-deletion.

11. International transfer

Part of the processing may occur on servers located outside Brazil (for example, Meta's infrastructure). In such cases we adopt safeguards consistent with applicable law.

12. Cookies

The dashboard uses only strictly necessary cookies for authentication and session functioning. We do not use advertising cookies.

13. Minors

Quatro7 is intended for businesses and is not directed at anyone under 18. We do not knowingly collect data from minors.

14. Changes to this policy

We may update this policy from time to time. The "last updated" date at the top indicates the current version. Material changes will be communicated through appropriate channels.

15. Contact

Questions about privacy or this policy can be sent to contato@cialight.com.br or to the DPO, Eduardo de Lemos Dorow, at the same address.