Privacy Policy

1. Who we are

Hepthos CRM is operated by GNS Tech Serviços LTDA, a Brazilian company (CNPJ 40.397.210/0001-80), Rua Antônio Drumond 392, Monte Castelo, Fortaleza – CE, 60325-700, Brazil. Data protection contact: contato@gnstech.com.br.

We are the controller of the data of those who subscribe to Hepthos CRM (businesses and their teams). For the data of the end customers who talk to a business, we act as a processor, on behalf of and following the instructions of that business, which is the controller.

2. Data we process

• Business and team: name, email, phone, role in the account and access logs.
• Billing: name or company name, tax ID where required, billing email, country and subscription status. Card data is handled only by the payment processors; Hepthos CRM does not store it.
• Integration credentials: AI keys and WhatsApp, Instagram and connected-system tokens — always encrypted.
• End customers: phone number or Instagram identifier, profile name and photo, message content (text, audio, images, comments and story replies) and AI-generated transcriptions or descriptions of it.
• Usage: technical logs and records of the AI agent’s actions (for example, a stock check or a booking).

3. How we use it

To provide the service: receive and send messages, generate answers, transcribe audio, describe images, carry out actions requested by the end customer and hand conversations over to the business’s team. Also to bill the subscription, prevent fraud, provide support and show metrics to the business. We do not sell personal data and we do not use conversations for advertising.

4. Legal basis and retention

We process data to perform the contract, for our legitimate interest in operating and protecting the service, to meet legal (including tax) obligations and, where required, based on consent.

Each business sets how long conversations are kept; after that period, data is deleted automatically. Billing data is kept for the period required by tax law.

5. Who we share it with

• Meta Platforms — official WhatsApp Business API and Instagram API, to receive and send messages.
• AI providers chosen by the business (Google, OpenAI, Anthropic or Groq) — receive the content needed to generate an answer.
• Systems connected by the business (calendar, spreadsheets, ERP) — receive only what the requested action needs.
• Cloud infrastructure (Supabase and Amazon Web Services) — database and files, isolated per customer.
• Payments — Paddle.com (outside Brazil, as reseller and Merchant of Record) and Asaas Gestão Financeira S.A. (Brazil).
• Transactional email and error-monitoring services — with no access to conversation content.

6. International transfers

Hepthos CRM is operated from Brazil, and some providers process data in other countries (for example, the United States and the European Union). These transfers rely on contractual clauses and providers that apply data protection safeguards, as required by Brazil’s LGPD and, where applicable, Israel’s Privacy Protection (Transfer of Data to Databases Abroad) Regulations.

7. Security

Each customer’s data is isolated in the database (row-level security), credentials are encrypted with AES-256-GCM and never appear in logs, and notifications received from Meta and payment providers have their signature verified before any processing.

8. Cookies and browser storage

The website and dashboard use only essential storage: your login session and language preference. We do not use advertising cookies or third-party tracking. Paddle’s checkout, when opened, may use its own cookies required for payment.

9. Your rights

Depending on where you are, you may request access, correction, deletion, portability and information about sharing, and withdraw consent. People in Israel have the rights granted by the Privacy Protection Law, 5741-1981 (including after Amendment 13); people in Brazil, those of the LGPD; and people elsewhere, those of their applicable local law.

End customers should direct requests to the business they talked to, stating the phone number or profile used; we support the business in handling them. Businesses can write to contato@gnstech.com.br. Deletion requests made through Facebook follow the data deletion page.

10. Children

Hepthos CRM is a service for businesses and is not intended for anyone under 18 as a subscriber.

11. Changes

We may update this policy. The date at the top shows the latest version; material changes are announced in the dashboard or by email.

12. Google account data (Calendar, Gmail, Sheets and Drive)

When a company administrator connects a Google account under Integrations, Hepthos CRM asks for permission only for the skills they turn on, each one when it is enabled. The access requested is:

• Calendar (calendar.events, calendar.freebusy, calendar.calendars.readonly and calendar.calendarlist.readonly): list calendars so the company can pick one, check free time slots and create booking events requested by the end customer.
• Email (gmail.send): send emails on behalf of the company, such as confirmations and quotes, when the assistant triggers them. We do not read or list the inbox.
• Sheets (spreadsheets.readonly): read only the spreadsheets the company points to, to answer end-customer questions such as prices and stock. We do not modify spreadsheets.
• Drive (drive.file): read only the files the company picks in the Google file-selection window, so the assistant can answer based on them. We have no access to any other Drive files and we do not modify or delete any file.
• Sign-in (openid, email and profile): identify you when you sign in with Google.

How we store it: access tokens are encrypted with AES-256-GCM, decrypted only in memory at the moment of use and never written to logs. The result of each lookup the assistant makes is recorded in the conversation (the "Actions" panel) so the company can audit it.

How we use and share it: we use Google data only to provide these features to the company. We do not sell it, use it for advertising or use it to train AI models. Looked-up excerpts may be sent to the AI provider the company configured (Google Gemini, OpenAI, Anthropic or Groq), using the company's own key, solely to generate the reply to the end customer.

How to remove it: when the account is disconnected under Integrations, we delete the tokens from our system. The company can also revoke access at any time at myaccount.google.com/permissions. To delete the rest of the account data, write to contato@gnstech.com.br.

Hepthos CRM's use and transfer to any other app of information received from Google APIs will adhere to the Google API Services User Data Policy (https://developers.google.com/terms/api-services-user-data-policy), including the Limited Use requirements.

13. Contact

Data protection contact: contato@gnstech.com.br.