Kavio CRM Privacy Policy
1. Overview
Kavio CRM ("we", "our", "Platform") is an omnichannel CRM SaaS platform that enables businesses ("Customer") to manage conversations with their end consumers ("End Users") through multiple channels, including Instagram Direct, Facebook Messenger, TikTok Business Messaging and WhatsApp. This Policy describes how we collect, use, store and protect personal data.
Feffer Negócios Digitais LTDA is responsible for operating the Platform, its integrations and the processing of data covered by this Policy.
For account access and operational administration data, Feffer Negócios Digitais LTDA acts as the controller. For contact and conversation data managed by each Customer, the Customer is the controller and Feffer acts as the processor on their behalf.
2. Data We Collect
2.1 Customer Data (Platform administrators)
- Full name, email and phone number
- CNPJ/CPF (Brazilian tax identifiers) and legal business name
- Access credentials (password encrypted with bcrypt)
- Payment data (processed by a PCI-DSS gateway; we do not store card numbers)
2.2 End User Data (Customers' consumers)
When a Customer connects their channels (Instagram, Facebook, TikTok, WhatsApp) to Kavio, we receive the following data from the respective providers about End Users who start conversations:
- Account identifier (Instagram/Facebook/TikTok ID)
- Username and display name
- Profile picture (public URL)
- Content of exchanged messages (text, media, reactions)
- Conversation metadata (timestamps, read status)
When the Customer enables the comments inbox for a connected account, we also process the text of public comments on their posts, the name and identifier provided by the platform, post and comment references, dates, and the history of replies published by the team. Capture is optional for each account. Receiving a comment does not by itself enable private messages or automatic replies. This data stays in the Customer workspace and is subject to this Policy's access and deletion controls.
2.3 Technical Data
- IP address, user agent and access logs
- Session cookies (essential for operation)
- Platform usage events (aggregate analytics)
3. Legal Basis and Purposes
We process personal data on the following bases (LGPD Article 7 and GDPR Article 6):
- Performance of a contract: providing the service contracted by the Customer
- Legitimate interest: security, fraud prevention and product improvement
- Consent: sending marketing communications (optional)
- Legal obligation: tax retention and responding to authorities
4. Data Sharing
We do not sell personal data. We share exclusively with:
- Infrastructure providers: Supabase (database and media storage), Railway (API and services), Vercel (CRM interface) and Cloudflare (website, content delivery and email forwarding), according to the services used by the Customer
- Technical monitoring: Sentry receives API failure diagnostics. Before sending, Kavio filters each event to remove message content, credentials, contact data and request details.
- Voice features: depending on the Customer configuration, text for speech synthesis may be sent to xAI or ElevenLabs, and audio for transcription to OpenAI, only to perform the requested feature.
- Messaging platforms: Meta Platforms, Inc. (Instagram/Facebook), TikTok Pte. Ltd., only what is necessary to send/receive messages through official APIs
- AI providers: Anthropic, OpenAI, when the Customer activates automated AI service, messages may be processed by these APIs (without model training)
- Public authorities: pursuant to a court order or legal requirement
5. International Transfers
Some providers are located outside Brazil (United States, European Union). We ensure transfers comply with LGPD Article 33 and GDPR Chapter V, with Standard Contractual Clauses (SCCs) and technical adequacy.
6. Data Retention
- Active Customer data: for the duration of the contract plus 5 years for tax purposes
- End User messages: according to the retention policy defined by the Customer (default: 24 months)
- Technical logs: 6 months
- Backups: 30 days after logical deletion
7. Your Rights (LGPD/GDPR)
As a data subject, you may:
- Confirm whether processing takes place
- Access your data
- Correct incomplete or outdated data
- Anonymize, block or delete unnecessary data
- Request portability
- Withdraw consent
- File a complaint with the ANPD or an equivalent authority
To exercise these rights, email [email protected] or use the form at kaviocrm.com/en/exclusao-de-dados/.
8. Data Deletion
To request complete deletion of your data (including data obtained through Meta or TikTok), visit kaviocrm.com/en/exclusao-de-dados/. We respond to requests within 15 days.
9. Google Data (Google Calendar and Gmail)
When a Customer connects their Google account to Kavio CRM using the Google button, we use Google authorization (OAuth 2.0), without asking for the account password. The alternative IMAP or SMTP setup may require an app password, depending on the provider's rules; that credential is encrypted.
9.1 What We Access and Why
- Google Calendar: reading busy and free times, listing the account's calendars and creating, changing or canceling events. The sole purpose is scheduling and managing meetings between the Customer and their contacts within the CRM.
- Gmail: identifying the authorized address and sending messages on the Customer's behalf. The Google email button requests only sending authorization, without access to read the mailbox through the Gmail API. Inbox reception is configured separately through forwarding or IMAP.
9.2 Limited Use
Kavio CRM's use of information received from Google APIs complies with the Google API Services User Data Policy, including Limited Use requirements. In direct terms:
- We use data only to provide the functions described in 9.1, within the Customer's account;
- We do not sell this data or use it for advertising, profiling or any purpose unrelated to the CRM;
- We do not transfer this data to third parties, except as necessary to provide the service to the Customer, as legally required, or with their express consent;
- We do not allow human reading of this data, except with the Customer's express authorization, to resolve a problem they reported, as legally required, or for aggregated and anonymized data used in internal operations.
9.3 Artificial Intelligence Models
Data obtained from Google is not used to develop, train or improve our own or third-party artificial intelligence models. When a CRM AI feature processes text at the Customer's request, the content is sent to the model provider only to generate that response, and the provider is contractually prohibited from using it for training.
9.4 Storage and Deletion
Authorization tokens are encrypted at rest (AES-256). In the email integration, disconnecting sending removes outbound credentials stored by Kavio and prevents new sends through the channel. Reception and conversation history are preserved. To also revoke authorization granted to Google, the Customer may use myaccount.google.com/permissions. CRM data deletion is requested through the procedure in section 8.
10. Security
- Encryption in transit (TLS 1.3) and at rest (AES-256)
- Access tokens stored encrypted
- Multi-factor authentication available
- Access audit logs
- Periodic security testing
11. Cookies
We use essential cookies (session, authentication) and analytics cookies (aggregate usage). Marketing cookies require active consent through a banner.
12. Children and Adolescents
Kavio CRM is not directed at people under 18. We do not intentionally collect data from minors.
13. Changes
We may update this Policy. Material changes will be communicated to Customers by email 30 days in advance.
14. Contact
Feffer Negócios Digitais LTDA
CNPJ: 48.520.343/0001-03
Data Protection Officer (DPO): [email protected]