This Privacy Policy describes how Marketing Suite LTDA
(Brazilian company registration (CNPJ) No. 66.249.398/0001-02), hereinafter "Marketing Suite",
collects, uses, stores and protects the personal data of users and visitors of the website
marketingsuite.com.br and of the SaaS platform,
in accordance with Brazil's General Data Protection Law (LGPD, Law No. 13,709/2018)
and other applicable legislation.
1. Data we collect
1.1 Data you provide
- Sign-up and billing: name, email, phone, tax ID (CPF/CNPJ), company name, address, credit card data (tokenized by Pagar.me; we do not store the full number).
- Operational content: captured leads, WhatsApp messages, proposals, targets, AI agent settings.
- Profile picture: a photo you optionally upload.
1.2 Data collected automatically
- IP address, browser type, operating system, pages visited, date and time of access.
- Essential session cookies for authentication.
- Preference cookies (dark/light theme, language) saved locally in your browser.
1.3 Third-party data
When you connect a WhatsApp Business instance, we capture conversation metadata (numbers, texts) to store in your CRM. We do not access personal accounts of end users without explicit authorization.
2. How we use your data
- Provide the contracted services (CRM, lead capture, WhatsApp integration, AI SDR).
- Process payments and issue invoices (via Pagar.me).
- Send operational notifications (new-device login, payment failure, alerts).
- Improve the platform through aggregated and anonymous analysis.
- Comply with legal and tax obligations.
- Communicate product news (optional, with an unsubscribe option).
3. Legal basis (LGPD)
- Performance of a contract (art. 7, V): processing necessary to provide the contracted service.
- Consent (art. 7, I): for sending marketing communications and for non-essential cookies.
- Legitimate interest (art. 7, IX): security analysis, fraud prevention.
- Legal obligation (art. 7, II): retention of tax data for 5 years after termination.
4. Who we share it with
We share strictly necessary data with the following processors:
- Pagar.me (payments) and Z-API (WhatsApp), under confidentiality and LGPD agreements.
- Anthropic (Claude, AI agent), under its privacy terms.
- Hosting infrastructure: Coolify on a server located in Brazil.
- Advertising and measurement platforms (processors): Google LLC (Google Analytics, Google Ads), Meta Platforms Ireland Ltd (Meta Ads, Conversions API) and TikTok Pte Ltd (TikTok Ads). Sharing with these platforms only happens if you accept marketing cookies in the banner; without that consent, nothing is sent to them.
- Authorities: when required by court order or law.
We do not sell your data.
4.1 What we send to advertising platforms
When you accept marketing cookies, we send these platforms only what is necessary to measure conversions and enable remarketing:
- Hashed contact data: email, phone and name are converted into a SHA-256 hash (irreversible encoding) before being sent. The platform receives the hash, never the plain text.
- Campaign identifiers:
fbc, fbp, gclid and ttclid, used only for conversion matching.
We do not sell your data. You can revoke this sharing at any time via the Manage cookies link in the footer.
The CompleteRegistration sign-up event is only sent to Meta (via Conversions API) if you accepted marketing cookies in the banner. The legal basis for this transfer is your consent (LGPD art. 7, I).
If you choose "Essential only" or decline, nothing is sent to Meta. You can revoke this consent at any time via the Manage cookies link in the footer.
5. Storage and retention
- Servers in Brazil (Coolify infrastructure), MySQL database with daily backups.
- Active account: we keep it while you are a customer.
- After cancellation: 30 days to export data, then automatic anonymization. Tax data kept for 5 years (legal obligation).
- Security logs: 180 days.
- Tracking/measurement data (pixel): retained for 12 months and then automatically deleted. The IP address is already anonymized at the time of collection.
6. Security measures
- TLS encryption (HTTPS) on all connections.
- Passwords stored with a bcrypt hash (never in plain text).
- Card data tokenized (PCI-DSS, never passes through our servers).
- Rate limiting, lockout after failed attempts, brute-force protection.
- Multi-tenant isolation: one company's data is inaccessible to others.
- Role-based access control (Administrator / Manager / Sales).
- Auditing of sensitive actions (being expanded).
7. Your rights as a data subject
Under art. 18 of the LGPD, you may:
- Confirm the existence of processing of your data.
- Access the data we hold about you.
- Correct incomplete, inaccurate or outdated data.
- Anonymize, block or delete unnecessary data or data processed in noncompliance.
- Port your data to another provider (export in JSON/CSV).
- Delete data processed on the basis of consent.
- Withdraw consent at any time.
- Obtain information about who we share your data with.
- Lodge a complaint with Brazil's National Data Protection Authority (ANPD).
To exercise any of these rights, email dpo@marketingsuite.com.br. We respond within 15 days.
8. Cookies and tracking
We use the following types of cookies:
- Essential: session authentication, CSRF token, theme preference. They do not require consent (LGPD art. 7, V).
- Analytics (in use): measure how the site is used (most-visited pages, source of access, performance) to help us improve the platform. They work via Google Analytics and Google Tag Manager. Legal basis: consent (LGPD art. 7, I). They only work after your acceptance in the banner and can be revoked at any time.
- Marketing (in use): measure how effective our ads are and enable remarketing on Google, Meta and TikTok. Legal basis: consent (art. 7, I). They only work after your acceptance and can be revoked at any time.
You decide. Analytics and marketing cookies only start working after you accept them in the banner. You can change your mind at any time via the Manage cookies link in the footer, or in your browser settings. Until you accept, only the essential ones are active.
9. Use of artificial intelligence
The AI SDR feature and the blog content generator use Anthropic's Claude model to produce replies and texts. Messages processed by the AI:
- Are not used by Anthropic to train future models (per commercial agreement).
- Are stored in your CRM for auditing and conversation continuity.
- Can be disabled at any time by the account administrator.
Automatic illustration generation also uses Claude (vector SVG only, with no involvement of photos of real people).
10. International data transfer
Anthropic (Claude) and Pagar.me (international card processing) may involve the transfer of data outside Brazil. Both adopt adequate safeguards (standard contractual clauses, SOC 2 certifications).
11. Google Ads API and offline conversions
When an agency connects a Google Ads account to Marketing Suite (via Google OAuth 2.0 authorization), we begin to access that account on the agency's behalf, exclusively for the contracted services. We only access accounts the agency has explicitly connected; we never access third-party accounts without that authorization.
11.1 What we access via the Google Ads API
- Performance metrics (impressions, clicks, conversions, cost, ROAS).
- Configuration of campaigns, ad groups, ads, keywords and conversion actions.
- Identifiers: Customer ID (Google Ads), Campaign ID and GCLID (click identifier).
11.2 Offline conversions and Enhanced Conversions
To attribute real conversions to campaigns, Marketing Suite may send Google offline conversion events (when a lead becomes a sale). In the Enhanced Conversions feature, the consumer's email and phone are converted into SHA-256 hashes (irreversible encoding) before being sent; only the hash is transmitted to Google, never the plain-text data. These hashes are used exclusively for conversion matching.
11.3 Legal basis and responsibilities
- Legal basis: performance of the contract (art. 7, V) and the advertiser's legitimate interest (art. 7, IX) in measuring its own campaigns, always with transparency toward the data subject.
- International transfer: sending events and hashes to Google constitutes an international transfer, with the safeguards described in section 10.
- Agency's responsibility: it is up to the agency to inform its consumers (data subjects) about the use of Enhanced Conversions and to have an adequate legal basis toward them.
11.4 Retention, no-resale and revocation
- We do not resell or share with third parties the data accessed via the Google Ads API outside the scope of the service.
- Synced metrics are kept while the account is connected; after disconnection they follow the retention policy in section 5.
- The agency can revoke access at any time via the panel or the Google console. Upon disconnection, the authorization token is revoked at Google and removed from our servers.
12. Children and adolescents
Marketing Suite is intended for professionals and businesses. We do not intentionally collect data of anyone under 18. If you are a legal guardian and identify improper collection, contact us immediately.
13. Changes to this Policy
We may update this Policy from time to time. Material changes are communicated by email and with a banner in the panel at least 30 days in advance. The current version is always available at this URL.
14. Contact and data protection officer
Any questions about your data, or want to exercise a right? Just talk to us. Our officer responds within 15 days.
Data Protection Officer (DPO): André Tini
Email: dpo@marketingsuite.com.br
Address: R. Patrocínio Paulista, 222 - Cidade Ariston Estela Azevedo, Carapicuíba - SP, 06390-400, Brazil (Marketing Suite LTDA, Brazilian company registration (CNPJ) No. 66.249.398/0001-02).
If you prefer, you may also complain directly to Brazil's National Data Protection Authority at gov.br/anpd.