Lead2Sales Marketing e Inteligência Artificial LTDA(Brazilian company registry — CNPJ 44.127.714/0001-30) (“Lead2Sales”, “we”) treats your privacy seriously. This Policy describes how we collect, use, share and protect information when you use our software, applications, websites and services (the “Services”), and how the Brazilian General Data Protection Law (LGPD — Law 13,709/2018) protects you.
Your data is processed in accordance with the legal bases described in this Policy (section 3). Where processing depends on consent, it will be requested specifically.
1. Who we are and how to contact us
Lead2Sales is a Brazilian company specialized in marketing and artificial intelligence solutions for the real-estate sector.
- General contact: contato@lead2sales.com.br
- Data Protection Officer (DPO): contato@lead2sales.com.br
For questions about this Policy or to exercise your rights, use the channels above.
2. Our relationship with you (controller and processor roles)
To understand our duties and your rights, identify your relationship with Lead2Sales:
- User: a person who provides data through our website or services (e.g., creates an account, subscribes to a newsletter). Here Lead2Sales acts as controller.
- Client: a user who has contracted the Services. As to the data they enter into the Platform about third parties, the Client is the controller and Lead2Sales is the processor.
- Client End User: people (e.g., leads, contacts) who relate directly to the Client, not to Lead2Sales. The Client is the controller of this data and Lead2Sales is the processor, processing it in accordance with the Client’s instructions.
In summary: for the Client’s own registration and billing data, we are the controller. For the data of leads and contacts that the Client captures and enters into the Platform, the Client is the controller and we are the processor.
3. Legal bases for processing
We process personal data based on one or more of the following LGPD legal bases:
- Performance of a contract: provision of the Services, account management, support and billing.
- Legitimate interest: security, fraud prevention, improvement and maintenance of the Services, access records (logs).
- Compliance with a legal or regulatory obligation: keeping tax records and responding to competent authorities.
- Consent: marketing communications, non-essential cookies and optional integrations (e.g., Google Calendar), which may be withdrawn at any time.
4. What data we collect
Provided by you / by the Client:
- Registration data: name, e-mail, photo and basic information to set up the account.
- Transaction and payment data: information necessary to process payments, handled by a third-party processor (Asaas). Card data is handled directly by the payment processor and is not stored by us.
- Content: data entered or generated by the Client during the use of the Services (e.g., contacts, properties, property owners, flows, messages).
- Communication: data provided in surveys, support or other interactions.
Collected automatically:
- Logs: browser type, IP, device identifiers, date and time of access.
- Usage: actions performed in the Services, device data and traffic patterns.
- Cookies and similar technologies: as per section 13.
From external sources: we may receive data from channels and networks connected by the Client, according to the permissions granted (see section 5).
5. Messaging channel data (WhatsApp / Meta)
As a central part of the Services, the Platform integrates with messaging channels and Meta products. In this context, the following may be processed:
- Content of conversations exchanged between the Client and their contacts through the WhatsApp connected to the Platform.
- Contact data of leads/end users (e.g., phone number, name).
- Lead origin and attribution datafrom ads (e.g., click identifiers of ads that lead to WhatsApp — “Click to WhatsApp”), used for campaign attribution and measurement.
This data is processed by Lead2Sales in its capacity as processor, following the instructions of the Client (controller), to enable customer service, qualification, automation and measurement. The connection to these channels is made by the Client’s choice, and the Client is responsible for having an adequate legal basis and consent with respect to their contacts.
6. How we use the data
We use the data to:
- provide, operate and maintain the Services;
- provide technical and customer support;
- process payments and manage the subscription;
- perform qualification, automation and AI-powered customer service (see section 7);
- perform audits and ensure the security of the Services;
- run marketing campaigns, subject to consent;
- comply with legal and regulatory obligations.
7. Artificial Intelligence and language model (LLM) processing
The Services use artificial intelligence models (LLMs), our own or provided by third parties, to qualify leads, suggest responses and automate customer service.
For this purpose, content and messages may be sent to AI providers (subprocessors, currently OpenAI and Google) responsible for the processing. These providers process the data under contractual confidentiality and security obligations, exclusively to enable the functionalities of the Services. Some of these providers may operate outside Brazil (see section 9).
8. Who we share with and our subprocessors
We may share data with:
- Subprocessors that help us develop, maintain and provide the Services;
- Professional advisors (lawyers, accountants) under a duty of confidentiality;
- Legal and tax authorities, when necessary to comply with a legal obligation, an order, or to protect rights and safety;
- Business transfers, in case of a merger, sale of assets or acquisition;
- Third parties with your consent, when applicable.
Main current subprocessors:
- Microsoft Azure — cloud hosting and infrastructure (Brazil / international);
- Meta Platforms (WhatsApp / Ads) — messaging channel, ads and attribution (international);
- OpenAI and Google — language processing for AI (LLM) (international — USA);
- Asaas — payment processing (Brazil);
- Google — Google Calendar integration, when activated (international).
This list may be updated. The current version may be requested through the contact channels. We do not sell personal data.
9. International data transfer
Some subprocessors operate outside Brazil, so data may be stored and processed abroad. In these cases, the transfer takes place in accordance with the LGPD, adopting adequate contractual and technical safeguards to protect the data.
10. Data retention and deletion
- Client account data and content: kept for the duration of the contract. After termination, the data is deleted within up to 30 days from the due date of the last payment, as per the Terms of Use. We recommend exporting the desired data before this deadline.
- Tax and billing data: kept for the periods required by law.
- Logs and security data: kept for a reasonable period for security and legal-compliance purposes.
The data subject may request early deletion of their data, subject to the mandatory retention cases provided by law.
11. Your rights as a data subject
Under the LGPD, you may:
- confirm the existence of processing and access your data;
- correct incomplete, inaccurate or outdated data;
- request anonymization, blocking or deletion of unnecessary data or data processed in non-compliance;
- request portability of the data;
- request deletion of data processed based on consent;
- obtain information about with whom we share your data;
- withdraw consent, when applicable;
- object to processing in case of non-compliance with the law.
To exercise any right, contact us through the channels in section 1. We will respond to legitimate requests within the LGPD deadlines. If you are a Client End User, direct your request to the Client (controller); we may forward it to them.
12. Data security
We adopt recognized security practices to protect data against unauthorized access and breaches. Access is restricted to employees and service providers who need it for their activities, all under confidentiality obligations. No system is completely infallible; the data subject acknowledges the risks inherent to internet communications.
13. Cookies and similar technologies
We use cookies and similar technologies to operate, protect and improve the Services. We may use:
- Essential cookies: necessary for the operation and security of the Platform (e.g., authentication and session). Without them the Services do not work properly.
- Performance and analytics cookies: help us understand usage and improve the Services.
- Preference cookies: store user settings and choices.
You can manage or block cookies in your browser settings. Blocking essential cookies may impair the operation of the Services.
14. Google Calendar integration
When you connect your Google account, Lead2Sales exclusively accesses the Google Calendar data necessary for the integration to work: title, description, date, time, participants and status of the events linked to your account.
This data is used only to synchronize events between the Platform and your Google Calendar (viewing, creating and updating appointments). We do not use it for marketing, behavioral analysis or any purpose other than synchronization.
The data may be stored temporarily to ensure synchronization, and is retained only for the time necessary to provide the Service or until you revoke access, whichever occurs first. It is not shared with third parties, except subprocessors strictly necessary for the technical operation, under confidentiality. We do not sell or assign this data.
You may revoke access through the integrations section of the Platform. After revocation, we immediately terminate access and delete the data from that integration within a reasonable period.
15. Client obligations regarding End Users
The Client is responsible for protecting and respecting the data of their End Users, in compliance with the law. This includes having an adequate legal basis and consent, publishing a compatible privacy policy and responding to requests for access, correction or deletion of their End Users’ data.
16. Third-party links and services
The Services may contain links to third-party websites or applications not operated by Lead2Sales. We are not responsible for their content or privacy practices. When accessing a third-party service, its own policies apply. We recommend reviewing them.
17. Public data
Information you choose to make public (e.g., content published on the website created on the Platform) may become accessible to others and be indexed by search engines. Consider this when deciding what to share.
18. Changes to this Policy
We may modify this Policy at any time. Changes will be published on this page with the update date. Relevant changes may be communicated by reasonable means. We recommend periodic review.