Privacy Policy
This policy explains what data eBoard Mídia processes, why, who it is shared with, and how you exercise your rights. It covers our website, the client portal, and our integrations with social networks and the WhatsApp Business Platform.
1. Who is the controller
eBoard Mídia is a service of E-BOARD INOVA SIMPLES (I.S.), CNPJ 58.113.569/0001-43, São Paulo/SP, Brazil. Contact for privacy matters and data protection officer (DPO): econtato@eboard.com.br.
2. What data we process
| Category | What it includes | Purpose |
|---|---|---|
| Client account | name, email, phone, company, tax ID, billing data | provide and bill the service |
| Connected accounts | access tokens and identifiers for Instagram, Facebook, LinkedIn, TikTok, X, Google and WhatsApp Business | publish and reply on the client’s behalf |
| WhatsApp messages | phone number, profile name, content of messages exchanged with the client’s number, and delivery status | allow the AI assistant to reply, qualify and record the conversation in the client’s dashboard |
| Social comments and messages | public and private content sent to connected accounts | reply and record the contact as an opportunity |
| Usage and security | IP address, browser, access date and time, approximate city | access trail, fraud prevention and support |
We do not request or use sensitive data (health, biometrics, religious or political beliefs). If a person spontaneously sends such information in a conversation, that content remains under the responsibility of the client operating that channel.
3. Automated AI service
Replies in messaging channels are generated by artificial intelligence, and the assistant identifies itself as such when asked. At any time a person may ask to speak to a human, and the conversation is handed over to the client’s team. Messages are sent to language model providers solely to generate the reply, and are not used to train models.
4. Who we share with (subprocessors)
| Company | Purpose |
|---|---|
| Meta Platforms | delivery of WhatsApp Business Platform messages and of posts and messages on Instagram and Facebook |
| OpenAI, Google, Anthropic | text and image generation and service replies |
| LinkedIn, TikTok, X | publishing to connected accounts |
| Analytics and Search Console for connected sites | |
| Stripe | payment processing (we do not store card data) |
We do not sell personal data or share it for third-party advertising. Some providers are located outside Brazil; in those cases the international transfer relies on contractual clauses and on the safeguards of article 33 of the Brazilian LGPD.
5. How long we keep it
- Messages and conversations: while the client keeps the service active, and for up to 12 months after termination.
- Connected account tokens: deleted as soon as the account is disconnected.
- Access trail and security logs: 12 months.
- Tax documents: for the period required by Brazilian law.
6. Your rights and how to exercise them
The Brazilian LGPD grants you the right to confirm processing, access, correct, anonymise, port and delete your data, and to withdraw consent. To exercise any of these rights, write to econtato@eboard.com.br. We respond within 15 days. If you spoke to a company that uses eBoard Mídia, we may need to forward the request to them, as they control that relationship — and we will tell you when that happens.
You may also disconnect any social account at any time, on your own, through the client portal: this revokes our access and deletes the corresponding token.
7. Security
Access tokens are encrypted at rest (AES-256-GCM) and all traffic uses HTTPS. Dashboard access is individual, with a record of who signed in, when and from where. In case of an incident with relevant risk, we notify data subjects and the Brazilian authority (ANPD) as required by the LGPD.
8. Requests from public authorities
When a public authority requests personal data from us, we always follow this process:
- We review the legality of the request before any disclosure, verifying the legal basis, the authority’s competence and the existence of a valid order.
- We challenge in court any request we consider unlawful, excessive or unfounded.
- We disclose the minimum necessary: only the data strictly described in the request, never a data subject’s or client’s full record.
- We document every request, our response, the legal reasoning applied and who took part in the decision.
Whenever the law allows, we notify the affected data subject and client before disclosing any data.
9. Changes to this policy
We may update this policy. The date at the top indicates the current version, and material changes are announced in the client portal before taking effect.
See also our Service Agreement and Terms of Use.