Privacy policy

1. Who we are

Elooo System is a brand operated by ELOOO, established in Portugal ("we", "us"). We are the controller of the personal data of our website visitors, prospects and customers.

For the data our customers store in the platform about their own contacts, the customer is the controller and we act as processor, as described in our Data processing agreement.

For any privacy matter, write to privacidade@elooosystem.com. This address is also the channel to the person responsible for data protection (in Brazil, the "encarregado").

2. What data we collect

• Data you give us: name, email, phone number, company and the messages you send us by WhatsApp, email, chat or forms.
• Account and billing data: details of the users you create, chosen plan, invoices, billing address and tax number. Card details are handled directly by the payment provider; we do not store full card numbers.
• Technical and usage data: IP address, browser, device, pages visited and access and security logs of the platform.
• Support communications: the content of support conversations and meetings. Meetings are only recorded after you are told.

We do not intentionally collect special categories of data (such as health or religion) and ask you not to send them to us.

3. Why we use it and on what legal basis

• To answer you and prepare a subscription: steps taken at your request before a contract (GDPR art. 6(1)(b); LGPD art. 7, V).
• To provide the platform, support and billing: performance of the contract (GDPR art. 6(1)(b); LGPD art. 7, V).
• To meet legal, tax and accounting obligations: legal obligation (GDPR art. 6(1)(c); LGPD art. 7, II).
• To keep the service secure, prevent fraud and improve it: legitimate interest, always weighed against your rights (GDPR art. 6(1)(f); LGPD art. 7, IX).
• To send news and offers: only with your consent or where the law allows it for existing customers, with an easy opt-out in every message (GDPR art. 6(1)(a); LGPD art. 7, I).

4. Who we share it with

We do not sell personal data. We only share it with:

• Providers who help us run the service, under contract and following our instructions: hosting of this website (Vercel Inc., USA), the technology provider of the CRM platform and its cloud infrastructure (USA), the payment provider and email and messaging providers.
• Meta (WhatsApp, Instagram, Facebook), when you talk to us on those channels, under Meta's own terms.
• Google and Meta, as providers of analytics and advertising measurement on this website, only if you accept those cookies in the cookie notice (see the Cookie policy).
• Authorities, when the law or a court order requires it.
• A buyer or successor in a corporate transaction, with the same level of protection.

The up-to-date list of subprocessors is available on request at privacidade@elooosystem.com.

5. International transfers

Some providers are located outside the European Economic Area and Brazil, mainly in the United States. In those cases we use the safeguards required by law: the European Commission's Standard Contractual Clauses, the EU-US Data Privacy Framework when the provider is certified and, for data under the LGPD, the standard contractual clauses approved by Brazil's data protection authority (ANPD Resolution CD/ANPD No. 19/2024).

6. How long we keep it

• Prospects: up to 2 years after the last contact, unless you become a customer or ask us to delete it sooner.
• Customers: for as long as the subscription lasts and afterwards for the periods required by tax and accounting law or needed to defend legal claims.
• Platform data after cancellation: kept for up to 90 days so you can reactivate or export it, and then deleted. Backups are overwritten in their normal cycle.
• Website logs: kept by the hosting provider for short technical periods.

7. Your rights

Under the GDPR you have the right to access, rectify and erase your data, to restrict or object to its processing, to data portability, to withdraw consent at any time and not to be subject to decisions based solely on automated processing that significantly affect you.

Under the LGPD (art. 18) you have the right to confirmation that we process your data, access, correction, anonymization, blocking or deletion of unnecessary or excessive data, portability, information about who we share it with and about the consequences of refusing consent, and revocation of consent.

To exercise any of these rights, write to privacidade@elooosystem.com. We reply within one month under the GDPR and within the legal deadlines under the LGPD (up to 15 days for a complete statement). We may ask you to confirm your identity.

You can also complain to a supervisory authority: in the EU, the authority of your country (in Portugal, the CNPD); in Brazil, the ANPD.

8. Security

We use encrypted connections (HTTPS), access control by role, two-factor authentication on the platform and the principle of least privilege. No system is 100% secure; if an incident puts your data at risk, we notify the authority and the people affected within the deadlines set by law.

9. Artificial intelligence

When a customer uses AI agents, the content needed to generate each reply is processed by the AI services integrated into the platform, following that customer's instructions. Customers must tell their contacts when they are talking to an AI wherever the law requires it, for example under the EU AI Act.

10. Children

The service is for businesses and professionals and is not intended for anyone under 18. We do not knowingly collect data from children.

11. Cookies

This website uses essential storage and, only with your consent, analytics cookies (Google Analytics) and advertising cookies (Google Ads, Meta Pixel). See the details and how to withdraw consent in our Cookie policy.

12. Changes to this policy

When we change this policy we update the effective date at the top. If the change is significant, we tell customers by email or inside the platform before it applies.