Privacy Policy

1. Who we are and our roles

Lubi CRM is offered by COMAL EDTECH LTDA, CNPJ 69.649.487/0001-34, Rua Dr. Pedro Ferreira, 155, Sala 00500, Box 144, Centro, Itajaí-SC, 88301-030 (“COMAL”, “we”).

For the data of your customers and contacts that you handle in Lubi CRM, you are the controller and COMAL is the processor (LGPD, art. 5, VII, and art. 39). For the data of your own account, of use and of security, COMAL is the controller.

Data protection officer: admin@lubi.bot.

2. Data we receive from Meta

Instagram:

• Identifier, user name and name of the connected account, and its counts of followers and media.
• Media, captions and thumbnails.
• Direct messages (text and media), and the identifier, name and user name of who wrote. The profile picture of who wrote is not stored.
• Comments and mentions.
• The profile picture of the connected account, downloaded and stored when you connect it.
• Messages, replies and posts that you send or schedule.
• Metrics of the account and of each post.

WhatsApp and Instagram: when a conversation arrives through an ad, the ad data that Meta sends with the message (ad identifier, title, text and destination address).

WhatsApp:

• Identifiers of the messaging account and of the number.
• Messages sent and received (text and media).
• Phone number or user identifier and profile name of your contacts.
• Message templates and their status.
• Quality and limit of the number.
• History of up to 180 days, imported when you connect, if you accept.
• Delivery status and the cost that Meta reports.

Access tokens are stored encrypted.

3. Data you create

Contacts, tags, fields, notes, funnels and values, templates, campaigns and the lists you send (with the consent statement and its date), scheduled posts, quick replies and settings.

4. Account and usage data

The data of your lubi.bot account (name, e-mail, language, time zone, plan and login) is also handled under the lubi.bot privacy policy.

Access logs, IP address, device and consumption are kept for security, operation and cost.

5. What we use it for

Only to provide the service: to show and organize conversations, send replies and templates, publish what you confirm, measure, keep the service secure and comply with the law. We do not sell data and we do not use it for advertising.

6. AI model providers

The AI provider receives data in these uses, each only for that task:

• Suggesting the columns of an imported spreadsheet (the headers and the first 3 rows).
• Classifying a message that may be a request to leave the list (the text, or the transcribed audio, of a reply to a broadcast).

Nothing is shared between contacts or between account holders.

7. We do not train models

Data from WhatsApp and Instagram is not used to create, train or improve AI models, neither ours nor anyone else's, and the providers we use may not do it either.

8. Who we share it with

• Meta (WhatsApp and Instagram), under its own terms.
• Google Cloud (servers, database and login).
• Cloudflare (processing, and storage of conversations and files).
• AI model providers, when one of the uses of section 6 is in use.
• Authorities, when the law requires.

We do not sell data and we do not hand it to data brokers.

9. Where it is kept

In Europe: the servers, the database and the files are in the Europe region of Google Cloud and in Cloudflare, with the EU jurisdiction for the account object and for files. The login (Google Cloud Identity Platform / Firebase Authentication) and the AI model providers may process data in other countries, including the United States, to provide the service. International transfer is necessary to provide the service (LGPD, art. 33), with the data of each account holder kept apart from the others.

10. Retention, deletion and copies

• Messages, contacts, media and the rest of the CRM stay while your account exists and until you delete them (a contact, a number or account, or everything).
• A daily copy is kept for 30 days, and recovery to an earlier moment is available for 30 days. After that, deleted data also disappears from the copies.
• Real-time events are kept for 7 days.
• Daily metrics of an account are kept for 90 days (Meta also keeps them for that long).
• Tokens are erased when you disconnect the number or account.
• The record of who left a list, and of deleted contacts and numbers, is personal data. The phone number is kept only as a digest (HMAC-SHA256 with a key of the platform) that cannot be read directly. Opt-outs are kept while your lubi.bot account exists, so that whoever left does not receive messages again. The record of deleted contacts and numbers is kept for 30 days plus the retention of the copies.
• Access logs are kept for 6 months (Marco Civil da Internet, art. 15).
• Tax and billing records are kept for as long as the law requires.

11. Your rights and how to exercise them

Under art. 18 of the LGPD you may ask for confirmation of processing, access, correction, anonymization, portability, deletion, information about sharing, and revocation of consent. Account holders exercise these rights in the screens and by writing to the data protection officer, admin@lubi.bot.

A customer of a business that uses Lubi CRM asks the business, which decides and erases, or writes to the data protection officer, and we pass the request on. You may also complain to the ANPD.

12. How to ask for deletion

Account holders have three ways to delete data inside the CRM: one contact, the data of one number or account, or everything. The data deletion page shows where to click.

You can also remove the app in Meta. Meta then sends us the request, we erase within 72 hours the data that came through that connection (the conversations, messages, reactions, comments, mentions, posts, metrics, media and imported history of the numbers and accounts connected through it), and you follow the request with the code that Meta gives you, on a status page that is kept for 90 days.

That removal does not erase the contacts, tags, fields, funnels, templates, campaigns and notes that you created, your other numbers and accounts, or your lubi.bot account. To erase those, use the ways above.

13. Security

• Access by account, with short-lived tokens.
• The tokens of Meta are encrypted by us.
• The text of conversations is stored encrypted at rest by the provider.
• Each account is isolated in an object of its own.
• The platform team does not read the content of conversations: the admin panel and support reading have no table with contact data.
• Notifications on the phone never carry the text of the message.

14. Cookies and tracking

The site and the CRM use only the essential session cookie __session and the language preference, kept in your browser (localStorage). They do not use Meta Pixel, Google Analytics or any other tracker.

15. Children

The service is for companies and for people over 18.

16. Changes

We post changes on this page. For a relevant change we also write to account holders by e-mail, 30 days ahead.

17. Contact

admin@lubi.bot. COMAL EDTECH LTDA, CNPJ 69.649.487/0001-34, Rua Dr. Pedro Ferreira, 155, Sala 00500, Box 144, Centro, Itajaí-SC, 88301-030.