Privacy Policy — AutoVendas
Last updated: July 25, 2026 Effective date: July 25, 2026
This is an English translation provided for convenience. AutoVendas is a Brazilian company and its services are governed by Brazilian law. In the event of any discrepancy, the Portuguese version available at autovendas.ai/privacidade prevails. References to the LGPD are references to Brazilian Federal Law No. 13,709/2018 (Lei Geral de Proteção de Dados Pessoais).
1. Who we are
This Privacy Policy describes how the AutoVendas platform processes personal data.
Controller and processor, as applicable:
- Legal name: 50.016.130 David dos Reis Pereira
- Brazilian taxpayer number (CNPJ): 50.016.130/0001-90
- Address: Rua Caio Pereira, 331, Encruzilhada, Recife, State of Pernambuco, Brazil, ZIP 52041-017
- Platform:
autovendas.aiandapp.autovendas.ai - General contact: contato@autovendas.ai
- Data Protection Officer (DPO): Micael Duarte de Amorim — privacidade@autovendas.ai
Throughout this document, "AutoVendas", "we", "us" and "our" refer to the company above.
2. What AutoVendas is, and why that matters to your privacy
AutoVendas is a software platform (SaaS) used by vehicle dealerships and car dealers to serve, qualify and follow up on their customers, supported by artificial intelligence, WhatsApp integration and vehicle financing simulation.
This means there are two groups of people whose data flows through the platform, and our role differs for each one. Understanding that difference is essential in order to know who to address a request to:
| Who you are | Our role | Who decides about your data |
|---|---|---|
| Platform customer — owner, manager or salesperson of a dealership that subscribed to AutoVendas | We are the controller | We are |
| Consumer — a person who contacted a dealership and was served through the platform | We are the processor | The dealership you spoke to |
In practice: if you had a WhatsApp conversation with a dealership and that conversation ran through AutoVendas, the dealership is the controller of your data and we process that data on its behalf and under its instructions. You may exercise your rights with either of us — section 9 explains how, and we forward requests to the dealership when necessary.
3. What data we process
3.1 Platform customer data (dealership)
| Category | Examples |
|---|---|
| Account | Name, email, phone number, job title, password (stored only as a cryptographic hash, never in readable form) |
| Company | Legal name, taxpayer number, address, business phone, subscription plan details |
| Platform usage | Records of actions performed in the system by the identified user, with date and time, for audit and support purposes |
| Billing | Data required for invoicing and issuing tax documents |
| Integrations | Credentials and identifiers of accounts connected at your instruction (Meta, WhatsApp, advertising and inventory platforms), stored in encrypted form |
3.2 Data of a consumer served by a dealership
| Category | Examples |
|---|---|
| Identification | Name, phone number, email |
| Financing simulation data | Taxpayer number (CPF), date of birth, whether the person holds a driver's licence, down payment amount — collected only when the person chooses to simulate financing and provides the data voluntarily |
| Conversation content | Text messages, audio, images and documents sent in the conversation, plus transcriptions generated from audio and from reading images and documents |
| Commercial interest | Vehicle of interest, intended payment method, details of a vehicle offered in trade, visit appointments |
| Simulation outcome | The financial institutions' response to the proposal, including approval, refusal and terms |
| Source | Which advertisement, portal or channel the person arrived from, including click identifiers provided by the advertising platforms |
| Technical | WhatsApp account identifiers, message date and time, delivery and read status |
We do not request sensitive personal data as defined in article 5, II of the LGPD. If a person spontaneously sends content of that nature in a conversation, it is treated solely as part of the service history, never for segmentation, and may be deleted on request.
We do not intentionally process data of children or adolescents. The platform is intended for people aged 18 and over. If we identify processing of a minor's data without an adequate legal basis, we will delete the record.
3.3 How we obtain this data
- Directly from the person, when they fill in a form, create an account or talk to a dealership;
- From the customer dealership, when it registers or imports data into the platform;
- From WhatsApp, when the person sends a message to the number of a connected dealership;
- From advertising platforms, when the person clicks an advertisement and is directed into the conversation;
- From the automotive portals and platforms with which the dealership maintains an active integration;
- From financial institutions, when they return the result of a requested simulation.
4. Why we use it, and on what legal basis
| Purpose | Legal basis (LGPD) |
|---|---|
| Provide the platform to the subscribing customer, create and maintain accounts | Performance of a contract — art. 7, V |
| Charge, invoice and issue tax documents | Performance of a contract and compliance with a legal obligation — art. 7, V and II |
| Serve, qualify and follow up on consumers on behalf of and under the instructions of the dealership | Processing carried out as a processor, under the legal basis determined by the controlling dealership — art. 39 |
| Operate, maintain, debug and improve the quality of the service provided, including analysing real conversations to correct faults and improve platform performance | Documented instruction of the controlling dealership, set out in the Terms of Use — art. 39 |
| Carry out financing simulations with financial institutions at the person's request | Performance of a contract or preliminary procedure at the data subject's request — art. 7, V |
| Keep application access logs | Compliance with a legal obligation — art. 7, II, together with art. 15 of the Brazilian Internet Act (Marco Civil da Internet) |
| Ensure security, prevent fraud and abuse, investigate incidents | Legitimate interest — art. 7, IX |
| Measure performance, correct faults and improve platform stability | Legitimate interest — art. 7, IX |
| Communicate news and commercial content to customers and prospects | Legitimate interest, with the right to object at any time — art. 7, IX |
| Exercise or defend rights in legal proceedings | Art. 7, VI |
Where we rely on legitimate interest, we assess in advance whether the purpose is legitimate, whether the processing is necessary to achieve it, and whether the data subject's expectations and rights have been preserved. You may request information about that assessment through the DPO channel.
What we do with real conversations, stated plainly. We analyse real conversations to find errors, measure quality and improve the platform. This is how the service gets better, and it is an operation and maintenance activity authorised by the subscribing dealership in the Terms of Use. Access is restricted to the technical team, recorded in an audit trail, and used for that purpose only.
What we do not do, and this is a commitment:
- we do not sell personal data;
- we do not share consumer data between different dealerships;
- we do not use conversation content to train artificial intelligence models, whether our own or third parties';
- we do not provide third parties with data or reports that would allow a dealership or a consumer to be identified;
- we do not carry out behavioural advertising using the data of consumers served.
5. Artificial intelligence and automated decisions
This section exists because transparency about automation is a right set out in article 20 of the LGPD, and because we do in fact make significant use of automation.
What the artificial intelligence does on the platform:
- reads and answers consumer messages on WhatsApp on the dealership's behalf;
- transcribes audio and interprets images and documents sent in the conversation;
- classifies the person's interest and organises the service into stages;
- assembles and sends a summary of the conversation to the responsible salesperson;
- decides which salesperson receives each conversation, according to the distribution rule configured by the dealership;
- identifies an intention to schedule a visit and proposes times;
- re-engages older contacts, when the dealership enables that feature.
What the artificial intelligence does not do: it does not decide on the granting of credit. The financing simulation is sent to the financial institutions chosen by the dealership, and the analysis, the approval and the refusal are decisions of those institutions, made on their own criteria, over which we have no influence.
Right to explanation and to review. If a decision made solely by automated means on our platform affects your interests, you may request review by a natural person and clear information about the criteria used, through the DPO channel. We respond within 15 calendar days.
Human oversight. Any conversation conducted by artificial intelligence can be taken over by a human agent of the dealership at any time, and the dealership retains full access to the history.
6. Who we share it with
We share personal data only where necessary, with the categories below.
6.1 Processors and sub-processors that support us
| Provider | What for | Where it processes |
|---|---|---|
| Meta Platforms | Sending and receiving messages through the official WhatsApp API, authenticating business accounts and measuring advertising results | United States and Ireland |
| Reading and interpreting images and documents, and generating artificial intelligence responses | United States | |
| OpenAI | Transcribing audio and generating artificial intelligence responses | United States |
| Credere | Sending financing simulations to financial institutions | Brazil |
| DinastiAPI | WhatsApp connection for accounts that have not yet migrated to the official API | Brazil |
| Amazon Web Services | Storage of media files exchanged in conversations | Brazil and United States |
| Railway | Hosting of the application and the database | United States |
| Grafana Labs | Technical operation logs and monitoring | European Union |
We maintain a contractual instrument with each of these providers obliging them to process data only in accordance with our instructions and to adopt appropriate security measures.
6.2 Financial institutions
When a person requests a financing simulation, the data they provide is sent to the financial institutions selected by the dealership, which act as independent controllers and apply their own privacy policies.
6.3 The customer dealership
Consumer data is accessible to the dealership the consumer spoke to. That is the purpose of the service.
6.4 Authorities
Upon request from a competent authority, court order or legal obligation, always within the limits of the request and with an internal record of the demand.
6.5 Corporate transactions
In the event of a merger, acquisition or reorganisation, data may be transferred to the successor, which will be bound by this Policy. Data subjects will be notified.
7. International transfers of data
Some of the providers listed in section 6.1 process data outside Brazil, notably in the United States and the European Union.
These transfers take place on the basis of articles 33 to 36 of the LGPD and the International Data Transfer Regulation approved by ANPD Resolution No. 19 of August 23, 2024, by means of:
- an adequacy decision, where the destination is the European Union, as recognised by the ANPD; and
- standard contractual clauses approved by the ANPD, incorporated into the contracts with providers located in countries without an adequacy decision.
You may request information about the safeguards applied to a specific transfer through the DPO channel.
8. How long we keep it
The general rule is: we keep data for as long as the purpose that justified its collection lasts, and after that only for the periods the law requires us to retain it.
| Data | For how long |
|---|---|
| Platform customer account and registration | For the duration of the contractual relationship, and thereafter for the period during which the law allows rights arising from it to be disputed |
| Consumer conversations and service data | For the duration of the contract with the dealership, because it is the commercial history the dealership depends on in order to serve its customers. It may be deleted earlier at the data subject's request or by the dealership's determination |
| Audit records of actions in the system | For the duration of the contract, for support and accountability purposes |
| Tax and billing data | 5 years, in accordance with Brazilian tax legislation |
| Records of data subject requests and of incidents | For the period necessary to demonstrate compliance before the authority |
Once the contract with a dealership ends, its data is deleted or anonymised as set out in the Terms of Use, except for data the law requires us to retain. Irreversibly anonymised data may be retained for statistical purposes, in which case it ceases to be personal data.
One relevant note: Meta retains messages carried over the official WhatsApp API on its own servers for a limited period, in accordance with Meta's own policies, over which we have no control.
9. Your rights and how to exercise them
The LGPD guarantees you, free of charge and at any time:
- Confirmation of whether or not we process your data;
- Access to the data;
- Correction of incomplete, inaccurate or out-of-date data;
- Anonymisation, blocking or deletion of data that is unnecessary, excessive or processed in breach of the law;
- Portability to another provider, subject to commercial and industrial secrecy;
- Deletion of data processed on the basis of consent;
- Information about who we share your data with;
- Information about the possibility of withholding consent and the consequences of doing so;
- Withdrawal of consent;
- Objection to processing based on legitimate interest;
- Review of automated decisions, as described in section 5.
How to ask:
- Through the data deletion and management page, which handles all of the requests above, not only deletion. The form is in Portuguese; requests in English are accepted by email;
- Or by email to privacidade@autovendas.ai.
The deadlines we commit to:
- Confirmation of existence and access, in simplified form: immediate;
- A clear and complete statement on origin, criteria and purpose: within 15 calendar days;
- All other requests: within 15 calendar days, extendable once with justification.
If you are a consumer served by a dealership: you may contact us directly. As we are the processor in that case, we will forward the request to the controlling dealership, monitor compliance and keep you informed. You may also contact the dealership directly if you prefer.
Complaint to the authority. You may lodge a complaint with the Brazilian National
Data Protection Authority (ANPD) through its official channels at gov.br/anpd.
10. Security
We adopt technical and administrative measures to protect data, including:
- encryption in transit (TLS) for all communication with the platform;
- passwords stored only as a cryptographic hash, using a key derivation function resistant to brute force;
- third-party integration credentials stored in encrypted form;
- per-customer isolation: each dealership's data is segregated and inaccessible to the others;
- role-based access control and the principle of least privilege;
- audit logging of sensitive operations;
- continuous monitoring, alerting and a technical operations trail;
- periodic backups.
No system is immune to incidents. Should a security incident occur that may result in relevant risk or damage, we will notify the ANPD and the affected data subjects within 3 business days of becoming aware of it, in accordance with ANPD Resolution No. 15 of April 24, 2024, stating the nature of the incident, the data involved, the measures adopted and our recommendations to the data subject.
11. Cookies and similar technologies
On the autovendas.ai website we use:
- necessary cookies, indispensable to the operation and security of the pages;
- measurement cookies, to understand which content is accessed, whenever you consent;
- marketing cookies, to measure campaign results, whenever you consent.
You may accept, refuse or review your choice at any time through the preferences panel available in the site footer, and also through your browser settings. Refusing non-necessary cookies does not prevent you from using the site.
In the app.autovendas.ai application we use only the cookies and local storage
strictly necessary to maintain the user's session and preferences.
12. Changes to this Policy
We may update this Policy to reflect changes in the platform, in legislation or in our providers. Material changes will be communicated to customers by email and highlighted on the website at least 15 days in advance. The date of the last update appears at the top of this document, and we keep the version history available on request.
13. Contact
Data Protection Officer (DPO) Micael Duarte de Amorim — privacidade@autovendas.ai
General contact contato@autovendas.ai
50.016.130 David dos Reis Pereira — CNPJ 50.016.130/0001-90 Rua Caio Pereira, 331, Encruzilhada, Recife, State of Pernambuco, Brazil, ZIP 52041-017