CRM Sales AI Privacy Policy

Who we are

CRM Sales AI is operated by SEAX, the trade name of Trophy Inovação S/S Ltda, Brazilian company ID (CNPJ) 48.160.639/0001-60, located at Rua Aluísio Azevedo, 206, Box 1, Santana, São Paulo/SP, CEP 02021-030, Brazil.

This policy covers the application. The contact form on the seax.com.br website has its own policy at https://seax.com.br/en/privacy/.

Who decides about each piece of data

Data about the people who use the application and about the company that subscribes to the plan (sign-up, access and billing) is processed by SEAX as controller.

Data that a client company puts into the CRM about its own customers, such as contacts, WhatsApp conversations, deals and appointments, belongs to the client company, which is the controller. For that data SEAX acts as processor: it processes it only to provide the service, following the client company's instructions and these terms.

Data the application processes

Depending on how your company uses the CRM, the application processes:

• Sign-up and access: name, email, password (stored only as a hash), access level and, if you enable it, the two-step verification factor.
• Company and billing: company name, data needed to issue charges, and the plan's payment history.
• Data the client company puts into the CRM: contacts, messages, photos, audio and documents from conversations, pipeline deals, appointments and the material uploaded to the AI knowledge base.
• Technical records: IP address, access date and time, and the history of actions taken in the system, used for security and auditing.
• Google data, when someone connects their calendar. It is described in detail in the Google Calendar section below.

Why we use the data

We use the data to provide the contracted service (customer service, pipeline, scheduling and AI), maintain the account, bill the plan, provide support, protect the system against abuse and comply with legal obligations.

The legal bases under Brazil's data protection law (LGPD) are performance of the contract with the client company, compliance with legal or regulatory obligations, the regular exercise of rights, and legitimate interest in the security of the service. We do not sell personal data and do not use it for advertising.

Google Calendar data

Connecting Google Calendar is optional. It only happens when a user clicks Connect Google on the CRM's Calendar screen and authorizes their own Google account on Google's consent screen. The application requests these permissions:

• Calendar events (calendar.events): create in Google the event for each appointment booked in the CRM, update it when the appointment changes, and delete it when the appointment is cancelled. Invitations and change notices to attendees are Google's own, and a Google Meet link is added to the event when the appointment is online. With the same permission, the application reads events from the calendars you choose, so that changes you make directly in Google are reflected in the CRM and so that a time slot you are already busy in is never offered to your customers.
• Calendar read access (calendar.readonly): list your calendars so you can choose which ones the CRM uses, identify which Google account is connected (the primary calendar ID is the account email), and check free and busy times before offering a slot. Nothing is changed through this permission.
• Google Meet spaces (meetings.space.created), only when the company turns on open-access Meet: create the open meeting room for the appointment, so the customer can join without waiting to be admitted. The application only manages rooms it created itself.

What we store from Google, and for how long

From events in the calendars you selected, the application stores only the title, start, end, whether it is an all-day event, its status (confirmed, tentative or cancelled) and whether it blocks the time slot. It does not store the description, location or attendee list of events that come from Google. From calendars, it stores the name, ID and time zone.

The access tokens Google issues are stored encrypted in the database. The copy of each event is deleted automatically 90 days after the event ends.

When you disconnect the calendar in the CRM, the application immediately deletes the tokens, the calendar list and the copy of the events. To also remove the authorization on Google's side, open your Google account permissions page. A company manager can disconnect the calendar of someone who has left the team.

• Your Google account permissions

Limited use of Google data

CRM Sales AI's use and transfer of information received from Google APIs will adhere to the Google API Services User Data Policy, including the Limited Use requirements.

In practice: Google data is used only to make scheduling work for you inside the CRM. It is not sold, not used for advertising, not transferred to third parties beyond what the service itself requires, and not used to train artificial intelligence models. Your calendar events are not sent to AI providers: the AI agent receives only the free time slots already calculated, so it can offer them to the customer.

SEAX staff do not read data obtained from Google, except with your consent (for example, in a support request), when necessary for security purposes such as investigating abuse, to comply with the law, or as aggregated and anonymized data for internal operations.

• Google API Services User Data Policy

Artificial intelligence

To reply to a customer, the CRM sends an AI model provider the agent instructions the company configured, the latest messages in that conversation, and the parts of the company's material related to the question. The CRM works with providers such as Anthropic, OpenAI and Google, depending on the account configuration.

When a conversation becomes an example for the company's own AI, phone numbers, emails, CPF (Brazilian taxpayer ID), postal codes and common first names are masked first. SEAX does not use client companies' data to train AI models.

Who the data is shared with

Only with those needed for the service to work:

• AI model providers, under the conditions described above.
• Meta (WhatsApp), through which conversation messages travel.
• Google, when the calendar is connected.
• Payment institutions, to process the plan's Pix, bank slip or card payments.
• Email delivery services, for invitations, password resets and system notices.
• Authorities, when there is a legal obligation or court order.

International transfers

Some of these providers, such as the AI providers, process data outside Brazil. In those cases, the transfer follows what the LGPD allows for the performance of the contract, with suppliers that provide data protection safeguards.

Security

Each company's data is kept separate in the database itself: every query a user makes reaches only the companies they belong to. Photos, audio and documents are kept in private storage and open through temporary links. Every change is recorded in the action history with author and time, and two-step verification is available to every user.

No system is immune to failure. If a security incident creates risk to data subjects, SEAX notifies the client company and Brazil's National Data Protection Authority (ANPD), as the law requires.

How long we keep data

Data is kept while the account is active. If the company cancels, the account is suspended after the paid period and the data is not deleted automatically: the company can export its contacts before leaving and request permanent deletion through the email below.

The action history is kept for five years. Data the law requires us to keep, such as billing data, follows the legal retention periods.

Your rights

Under the LGPD, you can request confirmation that we process your data, access, correction, anonymization, blocking or deletion of unnecessary data, portability, information about who we share it with, and withdrawal of consent.

If you are a customer of a company that uses the CRM, your request should go first to that company, which is the controller of your data; SEAX helps the company fulfill it. From the dashboard, the company can export or anonymize a contact's data. You can also file a complaint with the ANPD.

Cookies

The application uses only the cookies needed to keep you securely signed in. It does not use advertising cookies.

Changes to this policy

When this policy changes, the date at the top is updated. Relevant changes are announced to client companies before they take effect.

Contact and data protection officer

To exercise your rights or ask about this policy, write to atendimento@seax.com.br, the channel of SEAX's data protection officer. Support hours are 9 a.m. to 5 p.m., Brasília time.