LewFlow

Privacy Policy

How we handle your data and your customers' data (Brazil's LGPD — Law 13.709/2018).

This policy explains how LewFlow, operated by NATUVEL EMPREENDIMENTOS LTDA (CNPJ 28.323.425/0001-50), collects, uses and protects personal data. By using the service, you agree to what is described here.

1. Who is the controller

The data controller is NATUVEL EMPREENDIMENTOS LTDA (CNPJ 28.323.425/0001-50). Questions about privacy and exercising your rights: the contact email listed on the site.

2. What data we collect

  • From the subscribing company: name, email, phone and users' (agents') access data.
  • From the contacts served: WhatsApp number, profile name, and the content of the messages exchanged (text, audio, images, documents) — needed to provide the service.
  • Usage data: access and action logs in the panel (audit logs), for security.
  • Payment: when applicable, processed by a payment partner; we do not store full card data.

3. What we use it for

  • Operating the service (sending/receiving messages, organizing queues, history).
  • Artificial intelligence features when triggered by the user (e.g. transcription and audio summary), to speed up service.
  • Security, fraud prevention and compliance with legal obligations.
  • Billing and support.

4. Legal basis

We process data for performance of a contract (providing the service), legitimate interest (security and improvement) and compliance with legal obligations, under the LGPD. The subscribing company is responsible for having a legal basis to serve its own customers.

5. Sharing

To function, the service integrates essential providers, which receive only what is necessary:

  • Meta / WhatsApp — message delivery (official connection or by QR code).
  • AI providers — only the text/audio needed for transcription and summary, when the feature is used.
  • Infrastructure and payment — hosting and billing processing.

We do not sell personal data.

6. Storage and security

Data is kept on servers with restricted access and travels encrypted (HTTPS). Secrets and tokens are protected, never publicly exposed. We keep only what is necessary and for as long as required for the service and legal obligations.

7. Your rights (LGPD)

You may request access, correction, portability, anonymization or deletion of your data, and revoke consent. Just write to the contact email listed on the site. For data of the contacts served, the request is usually forwarded to the subscribing company, which is the controller of that relationship.

8. Retention and deletion

Once the account is closed, data may be deleted or anonymized after the legal retention period. Backups follow their own cycle and are securely discarded.

9. Changes

We may update this policy. Relevant changes will be communicated in the panel or by email. Always check the latest version on this page.