Privacy Policy.

Lead2Sales Marketing e Inteligência Artificial LTDA(Brazilian company registry — CNPJ 44.127.714/0001-30) (“Lead2Sales”, “we”) treats your privacy seriously. This Policy describes how we collect, use, share and protect information when you use our software, applications, websites and services (the “Services”), and how the Brazilian General Data Protection Law (LGPD — Law 13,709/2018) protects you.

Your data is processed in accordance with the legal bases described in this Policy (section 3). Where processing depends on consent, it will be requested specifically.

1. Who we are and how to contact us

Lead2Sales is a Brazilian company specialized in marketing and artificial intelligence solutions for the real-estate sector.

• General contact: contato@lead2sales.com.br
• Data Protection Officer (DPO): contato@lead2sales.com.br

For questions about this Policy or to exercise your rights, use the channels above.

2. Our relationship with you (controller and processor roles)

To understand our duties and your rights, identify your relationship with Lead2Sales:

• User: a person who provides data through our website or services (e.g., creates an account, subscribes to a newsletter). Here Lead2Sales acts as controller.
• Client: a user who has contracted the Services. As to the data they enter into the Platform about third parties, the Client is the controller and Lead2Sales is the processor.
• Client End User: people (e.g., leads, contacts) who relate directly to the Client, not to Lead2Sales. The Client is the controller of this data and Lead2Sales is the processor, processing it in accordance with the Client’s instructions.

In summary: for the Client’s own registration and billing data, we are the controller. For the data of leads and contacts that the Client captures and enters into the Platform, the Client is the controller and we are the processor.

3. Legal bases for processing

We process personal data based on one or more of the following LGPD legal bases:

• Performance of a contract: provision of the Services, account management, support and billing.
• Legitimate interest: security, fraud prevention, improvement and maintenance of the Services, access records (logs).
• Compliance with a legal or regulatory obligation: keeping tax records and responding to competent authorities.
• Consent: marketing communications, non-essential cookies and optional integrations (e.g., Google Calendar), which may be withdrawn at any time.

4. What data we collect

Provided by you / by the Client:

• Registration data: name, e-mail, photo and basic information to set up the account.
• Transaction and payment data: information necessary to process payments, handled by a third-party processor (Asaas). Card data is handled directly by the payment processor and is not stored by us.
• Content: data entered or generated by the Client during the use of the Services (e.g., contacts, properties, property owners, flows, messages).
• Communication: data provided in surveys, support or other interactions.

Collected automatically:

• Logs: browser type, IP, device identifiers, date and time of access.
• Usage: actions performed in the Services, device data and traffic patterns.
• Cookies and similar technologies: as per section 13.

From external sources: we may receive data from channels and networks connected by the Client, according to the permissions granted (see section 5).

5. Messaging channel data (WhatsApp / Meta)

As a central part of the Services, the Platform integrates with messaging channels and Meta products. In this context, the following may be processed:

• Content of conversations exchanged between the Client and their contacts through the WhatsApp connected to the Platform.
• Contact data of leads/end users (e.g., phone number, name).
• Lead origin and attribution datafrom ads (e.g., click identifiers of ads that lead to WhatsApp — “Click to WhatsApp”), used for campaign attribution and measurement.

This data is processed by Lead2Sales in its capacity as processor, following the instructions of the Client (controller), to enable customer service, qualification, automation and measurement. The connection to these channels is made by the Client’s choice, and the Client is responsible for having an adequate legal basis and consent with respect to their contacts.

6. How we use the data

We use the data to:

• provide, operate and maintain the Services;
• provide technical and customer support;
• process payments and manage the subscription;
• perform qualification, automation and AI-powered customer service (see section 7);
• perform audits and ensure the security of the Services;
• run marketing campaigns, subject to consent (except data obtained from Google APIs, which is never used for this purpose);
• comply with legal and regulatory obligations.

7. Artificial Intelligence and language model (LLM) processing

The Services use artificial intelligence models (LLMs), our own or provided by third parties, to qualify leads, suggest responses and automate customer service.

For this purpose, content and messages may be sent to AI providers (subprocessors, currently OpenAI and Google) responsible for the processing. These providers process the data under contractual confidentiality and security obligations, exclusively to enable the functionalities of the Services. Some of these providers may operate outside Brazil (see section 9).

Data obtained through Google Workspace APIs (including the Google Calendar API) is not sent to AI providers nor used in any LLM processing, as detailed in section 14.

8. Who we share with and our subprocessors

We may share data with:

• Subprocessors that help us develop, maintain and provide the Services;
• Professional advisors (lawyers, accountants) under a duty of confidentiality;
• Legal and tax authorities, when necessary to comply with a legal obligation, an order, or to protect rights and safety;
• Business transfers, in case of a merger, sale of assets or acquisition;
• Third parties with your consent, when applicable.

Main current subprocessors:

• Microsoft Azure — cloud hosting and infrastructure (Brazil / international);
• Meta Platforms (WhatsApp / Ads) — messaging channel, ads and attribution (international);
• OpenAI and Google — language processing for AI (LLM) (international — USA);
• Asaas — payment processing (Brazil);
• Google — Google Calendar integration, when activated (international). Data from this integration is not shared with OpenAI or any other AI provider.

This list may be updated. The current version may be requested through the contact channels. We do not sell personal data.

9. International data transfer

Some subprocessors operate outside Brazil, so data may be stored and processed abroad. In these cases, the transfer takes place in accordance with the LGPD, adopting adequate contractual and technical safeguards to protect the data.

10. Data retention and deletion

• Client account data and content: kept for the duration of the contract. After termination, the data is deleted within up to 30 days from the due date of the last payment, as per the Terms of Use. We recommend exporting the desired data before this deadline.
• Tax and billing data: kept for the periods required by law.
• Logs and security data: kept for a reasonable period for security and legal-compliance purposes.

The data subject may request early deletion of their data, subject to the mandatory retention cases provided by law.

11. Your rights as a data subject

Under the LGPD, you may:

• confirm the existence of processing and access your data;
• correct incomplete, inaccurate or outdated data;
• request anonymization, blocking or deletion of unnecessary data or data processed in non-compliance;
• request portability of the data;
• request deletion of data processed based on consent;
• obtain information about with whom we share your data;
• withdraw consent, when applicable;
• object to processing in case of non-compliance with the law.

To exercise any right, contact us through the channels in section 1. We will respond to legitimate requests within the LGPD deadlines. If you are a Client End User, direct your request to the Client (controller); we may forward it to them.

12. Data security

We adopt recognized security practices to protect data against unauthorized access and breaches. Access is restricted to employees and service providers who need it for their activities, all under confidentiality obligations. No system is completely infallible; the data subject acknowledges the risks inherent to internet communications.

13. Cookies and similar technologies

We use cookies and similar technologies to operate, protect and improve the Services. We may use:

• Essential cookies: necessary for the operation and security of the Platform (e.g., authentication and session). Without them the Services do not work properly.
• Performance and analytics cookies: help us understand usage and improve the Services.
• Preference cookies: store user settings and choices.

You can manage or block cookies in your browser settings. Blocking essential cookies may impair the operation of the Services.

14. Google Calendar integration and Limited Use of Google API data

Lead2Sales’ use and transfer of information received from Google APIs adheres to the Google API Services User Data Policy, including the Limited Use requirements.

When you connect your Google account, Lead2Sales requests only the following scopes:

• calendar.events.owned: allows creating, updating and deleting in your calendar only the events generated by the Platform itself. We do not access the content of personal events created by you or by third parties.
• calendar.freebusy: allows querying only the busy time slots of your calendar, with no access to title, description or participants, so that the AI agent can propose available times without creating conflicts.
• openid and userinfo.email: account identification during authentication.

This data is used exclusively to provide and improve user-facing features of the Platform — appointment synchronization and availability checking for scheduling.

Lead2Sales does NOTuse data obtained from Google Workspace APIs to develop, improve or train generalized or non-personalized artificial intelligence and/or machine learning models, whether our own or third parties’. This data is not sent to external LLM providers.

We also do not use, sell, transfer or share this data for: targeted, personalized, retargeting or interest-based advertising; sale to data brokers; provision to resellers; creditworthiness determination or lending purposes; or the creation of databases.

Human access to this data occurs only with the user’s explicit consent, for support purposes requested by you, security, compliance with a legal obligation, or when the data is aggregated and anonymized.

The data may be stored temporarily to ensure synchronization, and is retained only for the time necessary to provide the Service or until you revoke access, whichever occurs first. You may revoke access at any time through the “Disconnect” button in the Calendar section of the Platform, or at https://myaccount.google.com/permissions. After revocation, we immediately terminate access and delete the data from that integration within a reasonable period.

15. Client obligations regarding End Users

The Client is responsible for protecting and respecting the data of their End Users, in compliance with the law. This includes having an adequate legal basis and consent, publishing a compatible privacy policy and responding to requests for access, correction or deletion of their End Users’ data.

16. Third-party links and services

The Services may contain links to third-party websites or applications not operated by Lead2Sales. We are not responsible for their content or privacy practices. When accessing a third-party service, its own policies apply. We recommend reviewing them.

17. Public data

Information you choose to make public (e.g., content published on the website created on the Platform) may become accessible to others and be indexed by search engines. Consider this when deciding what to share.

18. Changes to this Policy

We may modify this Policy at any time. Changes will be published on this page with the update date. Relevant changes may be communicated by reasonable means. We recommend periodic review.