Privacy Policy
Last updated: May 4, 2026 • Versão em português
1. Data Controller
UmCliq is operated by Instituto Innvicton Ltda, registered under Brazilian National Registry of Legal Entities (CNPJ) number 23.285.285/0001-50, headquartered in Itapema, SC, Brazil. We are the data controller for personal data processed on this platform, in compliance with the Brazilian General Data Protection Law (Lei nº 13.709/2018, LGPD) and the EU General Data Protection Regulation (GDPR) when applicable.
2. Data Protection Officer (DPO)
- Email: privacidade@factorya.com.br
- Address: Itapema, Santa Catarina, Brazil
3. Data We Collect
3.1 UmCliq subscriber data: name, tax ID (CPF/CNPJ), email, phone, address, professional registration when applicable, payment method.
3.2 Platform usage data: appointments, WhatsApp messages sent, contacts registered, interaction history.
3.3 Sensitive data (LGPD Art. 11), when applicable: medical specialty, type of procedure, clinical notes. Processed with specific and prominent consent.
3.4 Meta (Facebook and Instagram) data, when the customer connects their Meta account to the Paid Traffic Module:
- Business Manager identifiers, Ad Accounts and Pages selected by the customer
- Long-lived access tokens (encrypted at rest with AES-256-GCM)
- Ad campaign metrics (spend, impressions, clicks, conversions, CPM, CTR, CPL, ROAS) read via Meta Marketing API
- Lead data received via Meta Lead Ads (name, phone, email and any other fields the customer configured in the form)
- Page engagement metrics when authorized by the customer
3.5 Automatic data: IP address, browser, operating system, device identifiers, essential and analytics cookies.
4. Purposes of Processing
- Deliver contracted services (CRM, scheduling, marketing automation, paid traffic management)
- Operate Meta Ads campaigns on behalf of the customer when authorized, including creation, pausing, editing and reading of campaigns
- Capture leads generated by Meta Lead Ads and deliver them to the customer's CRM
- Send automated communications (reminders, confirmations, weekly performance audio summaries) via WhatsApp and email
- Prevent fraud, abuse and Terms of Service violations
- Fulfill legal and regulatory obligations
- Improve the platform based on aggregated and anonymous metrics
5. Legal Basis
- Contract performance: data necessary to deliver the service
- Consent: for non-strictly contractual purposes and sensitive data
- Legal obligation: tax and accounting retention
- Legitimate interest: fraud prevention and platform improvement, balanced against data subject rights
6. Data Sharing (sub-processors)
We do not sell personal data. We share data only with providers that support us in operating the platform, acting as processors, under contract and instructions. This is the complete list, with what each one sees and where it processes:
Who
Contabo Inc.
What for
Hosts the UmCliq application and database.
What data they see
All platform data, because it is stored there: account, campaigns, leads, conversations and content.
Where they process
United States (New York)
Who
Cloudflare, Inc.
What for
Delivers the site with attack protection and caching.
What data they see
Connection metadata: IP address, browser and address accessed.
Where they process
United States, with points of presence in Brazil
Who
OpenAI, L.L.C.
What for
Writes ad copy, pages and content, and supports the supervisor that reviews conversations.
What data they see
The briefing text, the generated content, and excerpts of service conversations when the supervisor reviews them.
Where they process
United States
Who
Anthropic PBC
What for
Generates editorial and GEO content, audits creatives and answers from the customer knowledge base.
What data they see
The briefing, the produced content and the knowledge base the customer registers on the platform.
Where they process
United States
Who
Google LLC (Gemini e Google Ads)
What for
Checks whether the customer brand appears in answers from AI assistants, and connects the Google Ads account when authorised.
What data they see
The brand name and the test questions sent to the model, plus campaign data from the ad account the customer connects.
Where they process
United States
Who
Perplexity AI, Inc.
What for
Checks whether the customer brand is cited in answers from the AI search engine.
What data they see
The brand name and the test questions. Receives no lead or conversation data.
Where they process
United States
Who
ElevenLabs Inc.
What for
Turns weekly performance reports and voiced creatives into audio.
What data they see
The script text that becomes audio. Receives no lead or conversation data.
Where they process
United States
Who
FAL AI, Inc. (fal.ai)
What for
Renders the videos and images of creatives generated on the platform.
What data they see
The scene script and any reference images the customer uploads. Receives no lead or conversation data.
Where they process
United States
Who
Higgsfield AI
What for
Generates the images and videos for creatives. It is the primary provider of the creative studio.
What data they see
The brief the customer writes for the piece and their brand data (business name, industry, palette, typography and tone), which become the art direction sent to the model. Receives no lead, patient or conversation data.
Where they process
United States
Who
TikTok (ByteDance Ltd.)
What for
Verifies and operates the TikTok ad account when the customer connects it.
What data they see
Identification and data of the connected ad account, plus campaign data.
Where they process
United States and Singapore
Who
ManyChat, Inc.
What for
Connects the customer existing message flows, when they use that tool.
What data they see
Identification of the connected page and the contact data the flow exchanges.
Where they process
United States
Who
OpenStreetMap Foundation (Nominatim)
What for
Converts an address into coordinates to set the ad targeting radius.
What data they see
The address or city typed into the campaign settings. Receives no name, phone or lead data.
Where they process
United Kingdom
Who
Apify Technologies s.r.o.
What for
Collects public social media content for brand monitoring and the competitor radar.
What data they see
Public profiles, posts and ads of the accounts the customer chooses to monitor, including their own.
Where they process
Czech Republic (European Union)
Who
Semrush Inc.
What for
Provides keyword research and competition data for the GEO module.
What data they see
The search terms and the domain queried. Receives no lead, conversation or end-customer data.
Where they process
United States
Who
Meta Platforms, Inc.
What for
Delivers and receives ads, lead forms and messages when the customer connects the Meta account.
What data they see
Campaign data, the leads captured in forms (name, phone, email) and the content of official WhatsApp messages.
Where they process
United States
Who
LinkedIn Corporation
What for
Publishes content to the company page when the customer connects the account.
What data they see
The published content and the identification of the connected page.
Where they process
United States
Who
8x8, Inc. (Jitsi Meet)
What for
Provides the video room used in remote consultations, when the customer enables the module.
What data they see
Call audio and video, in transit, and the room name. The call is not recorded by the platform.
Where they process
United States
Who
Asaas Gestão Financeira S.A.
What for
Processes the UmCliq subscription billing.
What data they see
Billing data of the contracting customer. Receives no lead or conversation data.
Where they process
Brazil
Who
Conversas e Evolution (Instituto Innvicton Ltda)
What for
Our own WhatsApp connection service, used when the customer connects the number by scanning the QR code.
What data they see
Message content and phone number, in transit.
Where they process
Same infrastructure as UmCliq (United States)
We do not sell, rent or share personal data with third parties for direct marketing purposes without explicit consent from the data subject.
6.1. How we keep this list current
The list above is the single source of truth for the product: it lives next to the code, and our test pipeline refuses to publish any version in which the system calls an external provider that is not declared there. This exists so that this document does not age while the software moves.
Before adding a new sub-processor that handles third-party data, we notify customers with reasonable notice so they can assess and, if appropriate, object.
6.2. Where artificial intelligence is used
The platform uses artificial intelligence at specific points, and you have the right to know exactly which ones:
- Content and ad generation: the briefing you write and the produced text are sent to the model providers listed in the table above.
- Conversation supervision: excerpts of handled conversations are reviewed by a model to flag incorrect information and improper promises.
- AI assistant visibility checks (GEO): we send your brand name and test questions to AI search engines to measure whether you are cited. No lead or conversation data is sent in that check.
- Audio and video for creatives: the script becomes voice-over and imagery at the synthesis providers listed above.
What artificial intelligence does not do here: it is not used to train models on your data, because we require providers to commit to not training on what they receive; it does not make automated decisions with legal effect or significant impact on people, and should that ever exist, it will be disclosed beforehand and will observe the right to review under LGPD art. 20; and it does not receive data the system already knows how to answer, because whatever is queryable in the database is not sent to a model provider.
7. Data Retention
- Customer registration data: while the contractual relationship lasts plus 5 years (Brazilian civil prescriptive period)
- Financial data (invoices, receipts): 5 years
- Leads captured via Meta Lead Ads: 90 days by default (configurable by customer), then automatic purge
- Campaign metrics: 24 months aggregated, 90 days granular
- Access and audit logs: 24 months
- Meta access tokens: while the connection is active, encrypted
- Backups: automatic rotation 7 to 30 days depending on data type
8. Data Subject Rights (LGPD Art. 18 / GDPR)
- Confirmation that processing exists
- Access to data
- Correction of incomplete, inaccurate or outdated data
- Anonymization, blocking or deletion of unnecessary, excessive or non-compliant data
- Data portability
- Deletion of data processed based on consent
- Information about entities with which data was shared
- Information about the possibility of refusing consent and its consequences
- Withdrawal of consent
- Opposition to processing based on other legal grounds
- Review of automated decisions that affect the subject's interests
To exercise any right, email privacidade@factorya.com.br. We respond within 15 days maximum.
9. Data Deletion Request
To request complete deletion of your data, you can:
- Email privacidade@factorya.com.br
- Access the deletion status page at umcliq.com.br/data-deletion-status
- If you are a Meta user whose account was connected by a UmCliq customer, your automatic deletion request arrives via Meta callback at
/api/meta/data-deletion
Maximum completion time is 30 calendar days, retaining only legally required data.
10. Security
- Encryption in transit (TLS 1.3) and at rest (AES-256-GCM for sensitive data and Meta tokens)
- Role-based access control (RBAC) with Row-Level Security in the database
- Multi-factor authentication (MFA) for administrator users
- Continuous audit of accesses and actions (audit log retained 24 months)
- Daily isolated and tested backups
- Documented incident response plan
- Notification to ANPD within 48 hours in case of incident with risk to subjects (LGPD Art. 48)
11. Cookies and Tracking Technologies
UmCliq uses essential cookies (necessary for operation) and analytics cookies (with consent). You can manage your preferences via the cookie banner or browser settings.
12. International Data Transfers
The infrastructure hosting the platform, including the database, is located in the United States. Other providers listed in section 6 also process data outside Brazil, as indicated in the country column. There is therefore an international transfer of data, and this applies to all platform data, not only to what is sent to artificial intelligence providers.
In these cases we adopt safeguards compatible with LGPD art. 33, requiring from providers contractual guarantees of protection equivalent to Brazilian law, including data processing clauses, confidentiality commitments and limitation of use to what is strictly necessary to deliver the service.
13. Children
UmCliq is not intended for users under 18. We do not intentionally collect data from children. If we identify inadvertent collection, data will be deleted immediately.
14. Competent Authority
For non-compliance complaints, the data subject can file with Brazil's National Data Protection Authority (ANPD): www.gov.br/anpd. EU data subjects may also file with their local DPA.
15. Changes to This Policy
This policy may be updated to reflect legal, regulatory or operational changes. We will notify subjects via email and/or prominent notice on the platform at least 15 days before material changes.
This policy is also available in Português.