Privacy Policy

1. Who decides how data is used

Pulvify decides how to process the data needed to provide your account, charge for the service, protect the platform, and handle support requests. In these cases, Pulvify acts as the data controller. When a business uses Pulvify to communicate with its own contacts, that business decides who receives messages, which data is used, and how long it keeps its lists. In that context, Pulvify processes data according to the business's instructions.

2. What data may be processed

• Account data: name, email address, hashed password, preferences, and authentication information.
• If you sign in with Google: the Google account identifier, name, email address, and profile photo received through that integration.
• Usage and security data: session information, IP address, technical logs, dashboard actions, and error events.
• Billing data: plan, amount, payment status, and transaction identifiers. Data needed for billing is also sent to the selected payment provider.
• Communication data: phone numbers, contact names, groups, recipients, message content, attachments, campaigns, and events received from connected services, depending on how the customer uses the platform.
• If you use Pulvy or another AI feature: requests, relevant context, and responses needed to create or review the requested content.

3. Why we use the data

We use this data to create and protect accounts, connect WhatsApp instances, send messages and campaigns, deliver API responses and webhooks, process payments, provide support, prevent abuse, and meet legal obligations. Where applicable, processing relies on performing a contract, meeting legal obligations, or legitimate interests consistent with these purposes. Customers who add contacts or recipients to the platform must have an appropriate legal basis for communicating with them.

4. Who may receive the data

We share only what is needed to operate the service: with hosting and storage providers, the provider that connects an instance to WhatsApp, payment providers Stripe or AbacatePay, Google when you choose that sign-in method, and AI provider OpenRouter when you use AI features. Messages and recipient data also reach the communication services needed to send them. Some of these providers may process data outside Brazil; in such cases, we follow the applicable rules for international data transfers. We do not sell contact lists.

5. Cookies, security, and retention

The website and dashboard use cookies and similar features needed to maintain sessions, remember preferences, and protect access. We use access controls and other technical measures to protect data, but no internet-connected system is entirely free of risk.

We keep data for as long as needed to provide the service and meet legal obligations. Some operational campaign and conversation records have their own cleanup routines. Deleting an account does not necessarily erase payment records, backups, or data we must keep by law immediately. Deletion requests are assessed according to the type of data and the applicable law.

6. Your rights and how to contact us

You may request confirmation of processing, access, correction, anonymization, blocking or deletion of improper data, portability where applicable, information about sharing, and the reviews provided for under Brazil's LGPD. You may also object to processing where applicable and withdraw consent when consent is the legal basis. To make a request about your account, contact Pulvify through our WhatsApp contact. If your request concerns messages sent by a customer business, contact that business first, as it decides how the list and communication are used. We can also help direct your request.

7. Changes to this policy

We may update this page when the product or applicable rules change. The date at the top shows the published version. We will communicate significant changes through the available service channels.