Privacy Policy

1. Roles: controller and processor

• Data of those who subscribe to MaxSDR: MaxSDR is the controller of the sign-up, usage, and billing data of its customers (businesses and professionals).
• Data of our customers' contacts: in conversations MaxSDR handles on behalf of a business, that business is the controller of its contacts' data and MaxSDR acts as processor, handling it only to provide the service and according to the business's instructions.

If you talked to a business that uses MaxSDR and want to exercise your rights, the request should go to that business. If you contact us, we will forward it.

2. Data we process

• Sign-up: name, business name, WhatsApp number, city, and industry, provided when creating the account, and email, when you add it in settings.
• Business settings: products, prices, terms, and other information the customer provides for customer service.
• Conversations: messages exchanged between the connected number and the customer's contacts, needed to answer, qualify, and book.
• Usage and billing: dashboard usage records, subscribed plan, and payment status. Card data is handled by payment processors; we do not store full card details.
• Browsing: technical access data (such as IP address, browser, and date and time) and campaign parameters from the first visit, for security and to learn how you found us.

3. Purposes and legal bases

• Providing the contracted service: answering, qualifying, and booking conversations on the customer's WhatsApp — performance of contract (Art. 7, V).
• Personalizing customer service with the customer's business information — performance of contract.
• Billing, support, and operational communications — performance of contract and compliance with legal obligations (Art. 7, II).
• Security, fraud and abuse prevention, and aggregate product metrics — legitimate interest (Art. 7, IX).

We do not sell personal data and do not use it for third-party advertising.

4. Who we share data with

We share data only with partners needed to provide the service, acting as sub-processors:

• Google Cloud / Firebase: hosting, database, and authentication.
• Google (Gemini): language processing to generate the agent's replies.
• Meta / WhatsApp and WhatsApp connection providers: message transport.
• Stripe and Asaas: payment processing.
• Cloudflare and email providers: DNS and sending and receiving email.

We may also share data when required by law or by order of a competent authority.

5. International transfer

Processing and storage take place on servers located in the United States. The transfer is made under Art. 33 of the LGPD, for the performance of the contract and with the contractual safeguards of the providers involved.

6. Retention

We keep data while the account is active and for as long as needed to meet legal obligations (for example, tax records) or to exercise rights in legal proceedings. After that, data is deleted or anonymized.

7. Security

We apply technical and administrative measures to protect data, including encryption in transit, encrypted storage of credentials, isolation of each customer's data, and access control. No system is fully immune to incidents; if a relevant incident occurs, we will notify those affected and the ANPD as required by law.

8. Your rights

Under Art. 18 of the LGPD, you may request at any time:

• confirmation that we process your data, and access to it;
• correction of incomplete, inaccurate, or outdated data;
• anonymization, blocking, or deletion of unnecessary data or data processed unlawfully;
• data portability;
• deletion of data processed based on consent, and withdrawal of consent;
• information about who we share your data with.

Customers can export their account data directly from the dashboard. Deletion requests and other requests can be sent to contato@maxsdr.com and will be answered within the LGPD deadlines. You may also file a complaint with Brazil's National Data Protection Authority (ANPD).

9. Cookies and local storage

This company site does not use tracking cookies or advertising tools. The product site and dashboard use browser storage only to keep you signed in and to remember where your first visit came from.

10. Minors

The service is intended for businesses and professionals and is not directed at anyone under 18.

11. Data protection officer (DPO) and contact

To exercise your rights or ask questions about privacy, contact our data protection officer at contato@maxsdr.com.

12. Changes

We may update this policy. The last-updated date is shown at the top of the page, and material changes will be communicated to customers through the dashboard, WhatsApp, or email.