Privacy Policy

Controller and Data Protection Officer

Controller

OnSkull, headquartered at R. República do Iraque, 40 - Sala 1210 - Jardim Oswaldo Cruz, São José dos Campos - SP, 12216-540.

DPO

Matheus Barbosa — matheus@onskull.ai.

What we collect

We collect personal data in three distinct contexts:

Data provided by customers (business users)

• Account data: name, corporate email, phone, role, company, tax ID.
• Payment data, processed by our gateway (we don't store card data).
• Business info: industry, hours, team, sales process.

Data from Meta (Facebook Login and WhatsApp Business)

When you connect your WhatsApp Business account via Meta's Embedded Signup, we receive:

• Your WhatsApp Business Account identifier (WABA ID) and associated phone numbers.
• A system user access token — stored encrypted — to send and receive messages on your behalf.
• Phone number quality metadata (status, rating) provided by Meta.

We don't receive your Facebook password. We don't access your personal messages or posts.

WhatsApp conversation data (end users)

When your customers interact with your connected number:

• Contact phone numbers.
• Message content (text, images, audio, documents).
• Conversation metadata: date, time, delivery status, read receipts.
• AI-extracted data (intent, entities, summary) for lead qualification.

Why we process it

• Operate the CRM service and WhatsApp conversation automation.
• Classify messages, qualify leads and suggest replies via AI.
• Provide technical and commercial support.
• Comply with legal and regulatory obligations.
• Prevent fraud, abuse and terms violations.
• Improve the product using aggregated, anonymized data.

Legal bases

Contract performance

LGPD Art. 7, V — to provide the contracted service.

Legal obligation

Art. 7, II — tax, fiscal and regulatory requirements.

Legitimate interest

Art. 7, IX — security, fraud prevention, product improvement.

Consent

Art. 7, I — when required, in a specific and highlighted manner.

Sharing with third parties

Meta Platforms

Sending and receiving messages via WhatsApp Cloud API.

OpenAI

AI processing (classification, extraction, rephrasing). We don't use customer data to train models.

Infrastructure

Hosting, databases, observability — bound by data processing agreements.

Authorities

Under valid court orders or legal requests.

We do not sell personal data to third parties under any circumstances.

International data transfers

Meta and OpenAI are headquartered outside Brazil. These transfers are carried out under adequate safeguards provided in LGPD Art. 33 — contractual clauses and adherence to recognized data protection standards.

Retention

We keep data only as long as necessary for the described purposes:

Conversations

During account lifetime + 90 days after closure.

Registration/tax data

Legally required periods (e.g., 5 years, Consumer Defense Code Art. 27).

Technical and security logs

Up to 6 months, unless a legal request applies.

Security

We adopt measures proportional to risk: encryption at rest and in transit, role-based access control, audit logging for sensitive changes, anomaly monitoring, periodic access review. WhatsApp Business API tokens are stored encrypted.

Cookies

We use essential cookies for authentication and analytics cookies to understand aggregate usage. You can manage cookies in your browser — disabling essential cookies may impair service functionality.

Data subject rights (LGPD Art. 18)

You can, at any time, request:

• Confirmation that processing exists.
• Access, correction or update of your data.
• Anonymization, blocking or deletion of unnecessary data.
• Portability to another provider.
• Deletion of data processed under consent.
• Information about entities with which your data has been shared.
• Consent revocation.
• Review of automated decisions affecting your interests.

To exercise any of these rights: matheus@onskull.ai. We respond within 15 business days. For deletion specifics, see the Data Deletion page.

Minors

OnSkull is intended exclusively for businesses and does not intentionally collect data from minors under 18. If you notice misplaced collection, contact the DPO immediately.

Changes to this policy

We may update this Policy from time to time. Substantial changes will be communicated via email or in-platform notice at least 15 days in advance. The last-updated date is at the top of this page.

Contact

DPO

matheus@onskull.ai

General support

lucas@onskull.ai

You may also file a complaint with Brazil's National Data Protection Authority (ANPD).