Privacy Policy

Last updated: September 27, 2026

1. Who we are

DoneTalk is a WhatsApp customer service and sales platform provided by Nuvvun Consultoria e Inovação LTDA, CNPJ 64.290.716/0001-53, Alameda Rio Negro, 503, Barueri, SP, 06454-000, Brazil (“Nuvvun”, “we”).

This policy explains what personal data we process, why, and your rights under Brazil's General Data Protection Law (Law 13,709/2018, “LGPD”). Questions and requests: donetalk@roleplays.com.br.

2. Our role

Processor. Businesses that subscribe to DoneTalk (“customers”) use the platform to talk to their own contacts. For those contacts and conversations, the customer is the controller and Nuvvun is the processor: we process that data only to provide the service and as the customer instructs.

Controller. For the people who use the platform (owners, admins, agents) and for customers' business and billing data, Nuvvun is the controller.

3. Data we process

• Account and access: name, e-mail, password (stored only as a hash), two-step verification data, role, language and access logs (IP address, date, time and browser).
• Customer business: legal name, tax ID, address, contacts, plan and billing data.
• Conversations held through the platform on the customer's behalf: contacts' WhatsApp number and profile name, messages, photos, audio, videos and documents exchanged, delivery and read receipts, fields, labels, internal notes, outcomes and messaging consents.
• Data received from Meta through the official WhatsApp Business Platform: WhatsApp Business account identifiers, connected numbers, display name, message templates and their status, number quality and limits, and the events Meta sends about messages.
• Facebook Login in Meta's Embedded Signup: when a business connects a number, Meta gives us an authorization code, which we exchange for an access token to the business assets the business chose to share. We do not store data from the personal Facebook profile of the person connecting.
• AI features: when the customer turns on assistants or other AI features, the conversation excerpts and knowledge needed for each answer are sent to the AI provider, and we record the usage and cost of each call.
• Cookies: the app uses a single session cookie, needed to keep you signed in. We use no advertising or tracking cookies. This website uses no cookies.

4. Why we use it and legal basis

• To provide the contracted service: send and receive messages, organize customer service, produce reports and costs (performance of contract, LGPD art. 7, V; as processor, on the customer's instructions).
• To keep the platform secure, prevent fraud and abuse, and investigate incidents (legitimate interest, art. 7, IX).
• To keep access logs for six months and meet tax and regulatory duties (legal obligation, art. 7, II; Brazilian Internet Civil Framework, art. 15).
• To contact customers about the service, billing, support and important changes (contract and legitimate interest).
• We do not sell personal data, and we do not use customers' conversation content for advertising or to train AI models.

5. Who we share it with

Only with vendors needed to provide the service, under contract and bound by confidentiality:

• Meta Platforms (WhatsApp Business Platform): delivering and receiving messages.
• Amazon Web Services: hosting, database, file storage and e-mail, in the São Paulo region (sa-east-1).
• AI providers, such as Anthropic and OpenAI, only when the customer turns on AI features.
• Public authorities, when required by court order or law.

6. International transfers

Some processing by Meta and AI providers may happen outside Brazil, mainly in the United States. Those transfers follow LGPD art. 33 mechanisms, such as contractual clauses and the safeguards these vendors provide.

7. How long we keep it

• Account and business data: while the contract is active.
• Conversations and files: for the period the customer sets in its privacy settings (at least 180 days for messages and 30 days for files) or until the contract ends.
• Audit trail: 2 years. Access logs: 6 months, as required by law.
• Technical copies (queues, delivery and event logs): 30 to 90 days. Database backups: 35 days.
• When a contract ends, the customer's data is deleted within 90 days, except what the law requires us to keep.

8. Your rights

You may request confirmation of processing, access, correction, anonymization, blocking or deletion of unnecessary data, portability, information about sharing, and withdrawal of consent (LGPD art. 18).

If you talked to a business that uses DoneTalk, that business is responsible for your data: send your request to it. If you prefer, write to donetalk@roleplays.com.br and we will forward it. The platform lets customers export and delete a contact's data.

You may also complain to Brazil's National Data Protection Authority (ANPD).

9. Security

• Connections always encrypted (HTTPS/TLS) and integration credentials stored encrypted.
• A separate database per customer, role-based permissions and two-step verification for administrators.
• An audit trail of actions on the platform.
• Nuvvun staff enter a customer's account only through a support access with a reason, a time limit and a level, which the customer sees, can end and can turn off.

10. Facebook Login data deletion

See how to request deletion and follow your request on the Data deletion page.

11. Minors

DoneTalk is a service for businesses and is not intended for people under 18.

12. Data protection officer and contact

To exercise your rights or ask about this policy, contact Nuvvun's data protection officer at donetalk@roleplays.com.br.

13. Changes

We may update this policy. The date of the last update is at the top of the page, and customers are told of material changes in advance.