OneIA Privacy Policy

Effective date: October 29, 2025 · Last updated: October 3, 2026

1. Who we are

ONE TECNOLOGIA E AUTOMACAO LTDA, CNPJ 62.210.140/0001-41 (“OneIA”, “we”, “us”, or “our”) builds and runs B2B outbound prospecting for other companies on WhatsApp, with AI agents, through the official API (Meta Cloud API).

Location: São Paulo – SP, Brazil

Email: contato@oneiasolucoes.com.br

This Privacy Policy explains how we collect, use, and protect information when you visit the website or request a diagnosis (section 2A), when OneIA prospects on its own behalf (section 2B), and when you connect your WhatsApp Business account through our Embedded Signup flow, in accordance with Meta Platform requirements (sections 2 to 8).

2A. Website, diagnosis form and cookies

This section covers visitors to www.oneiasolucoes.com.br and anyone who fills in the diagnosis booking form. In these cases, OneIA is the data controller.

• Data you provide: name, email, WhatsApp number, company or website, role, your answers to the four questions, the optional fields about your prospecting and how you found us, and your choice about receiving WhatsApp messages.
• Visit source data: campaign parameters (UTM), ad click identifiers (such as gclid and fbclid), landing page and referrer, language and your cookie choice.
• Why we use it: to contact you about the diagnosis and schedule the call; and, only with your cookie consent, to measure our ads on Google and Meta.
• Who we share it with: providers that run the website and the booking on our behalf, such as Vercel (hosting and storage), Cal.com (scheduling), Formspree (form delivery) and, with consent, Google and Meta (ad measurement). Some of these providers process data outside Brazil.
• How long we keep it: as long as needed to handle your request and keep the business relationship, or to meet legal obligations. You can ask for deletion at any time.
• Cookies: measurement cookies stay off until you accept them in the cookie notice. You can change your choice at any time under “Cookie preferences” in the footer.
• Data subject contact (DPO channel): contato@oneiasolucoes.com.br.

2B. OneIA’s own prospecting (Bia)

Bia is the AI OneIA uses for its own prospecting. If she messaged you, OneIA is the controller of that data. You can ask her to stop at any time, in the conversation itself, and request access to or deletion of your data at contato@oneiasolucoes.com.br.

2. Data we collect (Embedded Signup and operation)

When you use our WhatsApp Embedded Signup integration, we may collect:

2.1 Business account data

• WhatsApp Business Account (WABA) ID
• Phone numbers linked to the account
• Business display name
• Access tokens and session data

2.2 Message data

• Messages sent and received
• Message templates
• Metadata, including timestamps and delivery status

2.3 Contact data

• Recipients’ phone numbers
• Contact names, when provided
• Interaction history

3. How we use data

• Provide the service: Process, send, and receive WhatsApp messages through the API.
• Automation and AI: Run automated prospecting, qualification, and scheduling workflows.
• Reporting: Generate campaign dashboards and metrics.
• Maintenance: Monitor, maintain, and improve the platform.
• Communication: Inform you about changes to the platform or terms of service.

4. Controller and processor roles

Client as data controller: When you use OneIA to message your leads and customers, you are the data controller for those individuals. OneIA acts only as a processor and processes data according to your instructions.

OneIA as data controller: We are the controller of data collected during Embedded Signup, including your business account data, and of data required to maintain our contractual relationship with you.

5. Data retention

• Business account data: Retained while you use our service. Access tokens are renewed as required to operate the integration.
• Message history: Retained for the term of the contract, so you can audit the conversations, and for as long as legal obligations require.
• Contact data: Retained while your account relationship remains active unless you request earlier deletion.

6. Data sharing

We may share data with:

• Meta Platforms: To operate the WhatsApp integration.
• Infrastructure providers: Cloud hosting and database services, such as Google Cloud Platform.

We do not sell personal data to third parties.

7. International transfers

Some of our cloud providers process data outside Brazil, for example in the United States. In those cases, the transfer follows the safeguards provided for in the LGPD, such as contractual clauses.

8. Security

We take reasonable technical and organizational measures to protect data, including encryption in transit (TLS) and access limited to the people who need the data to provide the service.

9. Your rights

Under the LGPD and other applicable privacy laws, you may:

• Access the data we hold about you
• Request correction of inaccurate data
• Request deletion of data
• Withdraw consent at any time
• Request data portability

To exercise these rights, email contato@oneiasolucoes.com.br.

10. Data deletion

For detailed instructions, see our Data Deletion Instructions.

11. Changes to this policy

We may update this Privacy Policy periodically. If we make material changes, we will notify you by email or through a platform notice at least 30 days in advance.

12. Contact us

If you have questions about this Privacy Policy or how we handle your data: