Privacy Policy

Last updated: October 7, 2026

This policy explains, in plain language, what data Clauditor keeps about you and about the people who talk through the channels you connect, including WhatsApp, email, Instagram and Messenger, what it is used for, and how to request access or deletion — in accordance with Brazil's General Data Protection Law (LGPD).

1. Who is responsible for your data

Clauditor is a Design Master product, operated in Brazil by A DE BORTOLO SOLUÇÕES EM INTERNET LTDA (DesignMaster Agência Digital), CNPJ 10.620.937/0001-13, based in Colatina (ES), Brazil. For your account data, we are the controller, as defined by the LGPD.

For the data of the people who talk to you through the channels you connect, you decide what to do with it: you are the controller, and we act as the processor, handling that data on your behalf and only to provide the service you set up. The rules of this relationship are in the Terms of Use.

Privacy channel: info@designmastersolutions.com. Use it to exercise the rights in section 9, ask questions and file complaints. We reply within 15 days.

Data protection officer (art. 41 of the LGPD): Alan de Bortolo, through the same channel, info@designmastersolutions.com. He receives complaints and requests from data subjects and communications from Brazil's National Data Protection Authority (ANPD).

2. What data we process

It depends on what you use. In short:

• Sign-up and account: name, email, password (stored only in irreversible form), two-step verification, the emails of people you invite to your team and, when you buy credit, your CPF or CNPJ for billing and the invoice.
• Channels you connect: the conversations, contacts and messages of the channels you authorize. On Instagram and Messenger, this includes the identifiers of the Page, of the professional account and of the people who talk to it, profile names, and the content and dates of the messages. This data lets us show the conversation and reply to it; the agent only responds when you turn it on.
• WhatsApp: Clauditor joins your account as a linked device, the same way WhatsApp Web does, and receives your conversations, contacts and media, including the history WhatsApp itself delivers when you connect.
• Email: the messages in the mailbox you connect, from the very first one, with attachments up to 10 MB and the text of PDFs, so the agent can look things up.
• People who talk to you: name, phone or email, message content, voice messages and their transcription, files, location when the person shares it, and the notes and summaries the agent writes about each contact and conversation to remember the context. Also people who fill in your booking page (name, email and phone) and who chat through your website chat.
• Calendar, contacts, reminders and tasks you create in Clauditor or sync from Google, Microsoft, iCloud or your computer, and the meetings you record or upload (the audio, the transcript and the summary).
• Computer app, if you install it: only what you authorize when pairing, such as SMS and iMessage messages from the Mac, contacts, calendar, reminders and the quota of the machine's Claude accounts. If you turn on screen view, the computer sends images of the screen that only you see through Clauditor; we keep only the latest image, deleted when you stop or after 20 seconds with no one watching, and it is never sent to the artificial intelligence.
• Connection with Meta: we store the access token of the Page you choose, to read and reply to messages through the official API. We never receive or store your Facebook or Instagram password.
• Files you or your contacts send through the connected channels, saved for you to look up later.
• Usage and technical data: your actions in the dashboard, the credit used by each conversation, your session's IP address and browser, the access log (IP, date and time) and, when you report a problem, the report text, the screenshot (if you leave it checked) and the IP.
• Payment data: processed directly by Asaas (Pix) and Stripe (card), we don't store card numbers.

3. What we use it for, and on which legal basis

So the AI agent can reply through the channels you connected, show the product screens (conversations, contacts, files, usage reports), calculate and charge for the credits used, and notify you by email, WhatsApp, or push notification about what needs your attention.

The LGPD legal bases we rely on are: performance of our contract with you, to run the product and charge for credit (art. 7, V); legitimate interest, to keep things secure, prevent fraud and abuse and improve the product (art. 7, IX); and compliance with legal obligations, for access logs and tax records (art. 7, II). For your contacts' data, the legal basis is defined by you, as the controller.

We don't sell data, we don't use your conversations for advertising and we don't use their content to train artificial intelligence models.

4. Artificial intelligence

To reply, summarize, suggest reminders, read files and transcribe voice messages and meetings, Clauditor sends the necessary part of messages, audio and files to the artificial intelligence providers: Anthropic (Claude models) and Google (Gemini models, in the free engine and in features such as summaries, suggestions and transcription).

We use both on paid commercial terms, under which they contractually commit not to use that content to train models. Anthropic deletes inputs and outputs within 30 days, except when it needs to keep them because of a violation of its usage policy; Google keeps them for a limited time, only to detect abuse. If you use your own AI key, the contract between you and the provider also applies.

The agent only replies on its own when you turn it on, and you can turn it off whenever you want. Everything it does is logged in Behind the scenes for you to review.

5. Who we share it with

We never sell your data. We only share it with those needed for the product to work:

• Anthropic PBC and Google LLC (United States): artificial intelligence, as described in section 4. Google also handles sign-in with Google and calendar and contact sync, if you connect them.
• Railway Corporation (United States), with file storage by Tigris Data: the servers, the database, the files and the WhatsApp connection.
• Resend (United States): sending the product's emails, such as alerts, summaries and booking confirmations.
• Asaas (Brazil) and Stripe (United States): payment by Pix and by card.
• Cloudflare (United States): bot check at sign-up.
• Browser and phone notification services (Apple, Google and Mozilla): they deliver Clauditor's alerts; the content is encrypted and they can't read it.
• Meta, Microsoft and Apple (iCloud): only when you connect Instagram, Messenger, a Microsoft account or iCloud.
• External tools you connect to the agent yourself: they receive what you tell the agent to use, under your responsibility.
• Public authorities: only when the law or a court order requires it.

6. International data transfer

Part of the data is processed outside Brazil, in the United States, because that is where the hosting, the artificial intelligence providers and the email service listed in section 5 are. The data travels encrypted over the internet and is used only to provide the service: keeping your account, replying, summarizing, transcribing, alerting and billing.

The data stays there for as long as your account exists, and with the artificial intelligence providers for the period in section 4. These vendors are contractually bound to keep it confidential, protect it with security measures and use it only to provide the service to us. You can ask for more information about these transfers, including the contractual clauses that govern them, through the privacy channel.

7. Security

Email passwords, the access tokens of the accounts you connect, API keys and your CPF or CNPJ are stored encrypted in the database. The WhatsApp session and the history it downloads are kept on a separate server, outside the database, with restricted access. The connection to Clauditor is always encrypted (HTTPS), dashboard access requires a strong password, and you can turn on two-step verification in your account settings.

Nobody at Design Master opens your conversations unless you ask, and every access is logged for you to see. When you ask support for help and a conversation needs to be looked at, who opened it and why show up in Settings → Your details.

If a security incident happens that may cause you relevant risk or harm, we notify you and Brazil's National Data Protection Authority (ANPD), as the law requires.

8. How long we keep it

For as long as your account exists. If the account sits idle for a long time with no credit, the channels are paused and nothing is deleted (see the Terms of Use).

When you ask to delete your account, the deletion runs seven days after the request, and you can change your mind before then. Then we delete the account data, including conversations, contacts and files. The copy kept by the WhatsApp connection is gone within seven more days, and the server's automatic backups expire on their own within four weeks.

We keep for longer only what the law requires: access logs (IP, date and time) for six months, as Brazil's Internet Civil Framework (Marco Civil da Internet) requires, even after the account is deleted, and payment tax records, which stay in our billing system and with the payment providers for the legally required period. The file with the copy of your data stays available for download for 48 hours.

9. Your rights

Under the LGPD (art. 18), you can request at any time, through the privacy channel:

• confirmation that we process your data, and access to it;
• correction of incomplete or outdated data;
• anonymization, blocking or deletion of unnecessary or excessive data, or data processed in breach of the law;
• deletion of the data, within the limits of section 8;
• portability of the data to another provider;
• information about who we share your data with;
• information about the possibility of not giving consent and what happens if you don't;
• withdrawal of the consent given.

You can download a copy of your data and delete your account yourself in Settings → Your data. If you're not satisfied with our answer, you can also file a complaint with the ANPD.

If you talked to a business that uses Clauditor, by WhatsApp, email, Instagram, Messenger, website chat or booking page, that business decides about your data, and you exercise your rights with it first. You can also write to the privacy channel: we will let the business know and help as far as we can.

How to delete your Instagram and Facebook data

To stop the connection, sign in to Clauditor, open Settings → Instagram and Facebook and remove the Page. You can also revoke Clauditor's access in Facebook's business integrations settings. Disconnecting stops the integration, but does not delete the history already stored in Clauditor.

To request deletion of the data of a Page, a profile or a conversation, send an email to info@designmastersolutions.com with the subject “Meta data deletion at Clauditor”. Tell us the Page or the @profile and, if you have a Clauditor account, the email you signed up with. Do not send passwords or tokens. We will confirm the identity and the scope of the request before deleting the data and will reply to the same email when the request is completed. Anyone who sent a message to the business can also use this path, even without a Clauditor account.

To delete your whole account and the associated data, go to Settings → Your data → Delete my account. After you confirm, the deletion is scheduled for seven days later; you can cancel it during that period. Only records whose retention is required by law remain, as described in section 8. Deleting in Clauditor does not delete the Page, the profile or the messages in Meta's apps.

10. Children and teenagers

Clauditor is for people aged 18 or over, and we don't create accounts for children or teenagers.

11. Cookies and local storage

We only use what's essential for the product to work: keeping you logged in and remembering your light/dark theme preference. We don't use advertising or third-party tracking cookies.

The Clauditor website loads fonts from Google and an animation library from jsDelivr, which receive your browser's IP address to deliver those files. At sign-up, Cloudflare's bot check analyzes the browser to block automated access.

12. Changes to this policy

We may update this policy as the product evolves. Relevant changes are announced by email or inside the product before they take effect.