Privacy Policy

Version 1.1 | In effect as of August 29, 2026.

1. Who the Controller is

This Policy describes how Linx Softwares, registered under Brazilian tax ID (CNPJ) No. 63.208.063/0001-58, headquartered at Rua Valença, 18, Novo Hamburgo/RS, Brazil, ZIP 93537-310, collects, uses, shares and protects personal data related to the My AIssistant service (omeuauxiliar.com).

For the personal data of your leads and end customers who chat with the AI assistant on WhatsApp, you (the My AIssistant Customer) are the Controller and Linx acts as the Processor, under the Brazilian LGPD (Law 13.709/2018).

For the Customer's own registration, billing, usage and support data, Linx is the Controller.

2. Data Protection Officer (DPO)

For any request related to your personal data or to data protection law, contact our Officer:

Email: [email protected]

We respond within 15 calendar days, as required by the LGPD.

3. Data we collect

• Registration (Customer): full name, email, phone, tax ID (CPF or CNPJ).
• Company (Customer): legal name, business description, address, website, social media (optional fields).
• RAG knowledge: PDFs, FAQs, spreadsheets, audio, photos and text you upload to train your assistant.
• Messages from connected channels: the content of conversations exchanged between your AI assistant and your leads/end customers, including text, received media (image, audio, document) and metadata (date, time and read status). On WhatsApp, the contact identifier is the phone number. On Instagram Direct, it is the Instagram account identifier provided by Meta, along with the username and profile picture when available. We do not collect a phone number for people who talk to you through Instagram.
• Channel connection: when you connect an Instagram professional account, we store that account's identifier and name and an encrypted access key, provided by Meta, that authorizes My AIssistant to receive and reply to messages on your behalf. You can revoke this authorization at any time under Channels, in the dashboard.
• Payment: card and Pix data are processed directly by the payment providers (today Asaas for Pix and Mercado Pago for card); we only store the subscription and charge identifiers and, for card, the last 4 digits and the brand.
• Usage and technical: IP address, device identifier, browser type, language, pages visited, dashboard actions, error logs.
• Support communication: emails, messages and attachments you send us.

4. Sensitive personal data

My AIssistant does not actively request sensitive personal data (health, biometrics, religion, sexual orientation, political opinion, union membership, etc.). If such data appears in messages received from your contacts, it is processed exclusively to operate the support service, with the same level of security applied to all other data.

You, as the Controller of that data, are responsible for ensuring an adequate legal basis to process it under article 11 of the LGPD.

5. Why we collect data and legal bases (article 7 of the LGPD)

• Contract performance: operate your account, process payments, maintain the AI assistant, send service notices, provide support.
• Compliance with legal and regulatory obligations: issue invoices, respond to requests from authorities, keep tax and access records (Internet Framework Act, art. 15) for at least 6 months.
• Legitimate interest: fraud prevention, platform security, audit logs, aggregated and anonymized metrics to improve the product.
• Consent: sending marketing emails, use of non essential cookies, optional integrations. You may withdraw consent at any time without affecting the continuity of the service.
• Regular exercise of rights: defense in judicial, administrative or arbitration proceedings.

6. Purposes of use

• Authenticate you in the dashboard and protect your account.
• Train your assistant with the documents you upload (RAG/embeddings).
• Process messages received on the connected channels (WhatsApp and Instagram Direct) and generate AI responses.
• Charge the subscription, issue invoices and handle non payment.
• Send notices about the service, quota alerts, updates to the Terms and Policy.
• Generate aggregated and anonymized metrics for product evolution.
• Comply with legal and regulatory obligations and court orders.

7. Where data is stored

Most data is stored on our own infrastructure in a European Union datacenter (Hetzner, Finland, self hosted Postgres), subject to the General Data Protection Regulation (GDPR), with the international transfer safeguarded in line with the LGPD (articles 33 and 35) and with encryption in transit (TLS 1.2+) and at rest. Backups are encrypted and replicated to secure external storage.

Payment tokens, API keys and WhatsApp instance secrets are kept in an encrypted vault with restricted access.

8. Sharing and international transfer

We do not sell your data. We share it only with Processors and partners strictly necessary to deliver the service, under contract and with the safeguards provided by the LGPD (articles 33 and 35) for international transfers.

• Asaas Gestão Financeira Instituição de Pagamento S.A. (Brazil): Pix charge processing and antifraud. Asaas Policy.
• Mercado Pago (Brazil): card payment processing, under the PCI DSS standard. Mercado Pago Policy.
• Mailjet (Sinch Email, France): sending transactional emails (welcome, password recovery, alerts, invoices). Mailjet Policy.
• Cloudflare, Inc. (USA): content delivery and site protection. Every visit to omeuauxiliar.com goes through it before reaching our servers, to speed up loading and block malicious traffic. Data handled ephemerally, without cross session tracking. Cloudflare Policy.
• Google LLC (USA), via Google AI / Gemini API: processing of messages by the AI model. Data sent via the Gemini API is not used to train Google's public models. Gemini API Terms.
• Meta Platforms, Inc. (USA): WhatsApp and Instagram are Meta services and every message exchanged on those channels goes through its infrastructure, under its own applicable policy. When you connect an Instagram professional account, you grant the authorization directly to Meta, through the official login flow, and My AIssistant only receives a revocable access key. We never ask for your Instagram password.
• WhatsApp routing providers: technical delivery of the WhatsApp channel messages.
• Meta Platforms, Inc. (USA), for ad measurement: the omeuauxiliar.com site loads the Meta pixel on every page, including for people who are only visiting and have no account. We send Meta the page view, sign up, subscription start and purchase events. With each event go the advertising identifiers stored in your browser, the IP address and the browser used and, on sign up and purchase, your email and phone converted before sending into a scrambled code, so that they do not leave here in readable form. This is used to measure the results of our ads and to target My AIssistant ads. Meta Policy.
• PostHog Inc. (USA) (optional): aggregated dashboard usage analytics. You can turn it off in item 12 of this page.
• Public authorities: when required by law, court order or valid administrative request.

International transfers occur to the countries where the above providers operate (especially the United States), always supported by contractual clauses that ensure a level of protection compatible with the LGPD.

9. Retention

• Active account: data kept for as long as the contractual relationship lasts.
• Cancelled account: 30 days in a suspended state, then permanent deletion (hard delete), except for legal retention.
• Messages from connected channels: stored while the account is active, to allow context, history and auditing. You may request early deletion of the history through support.
• Channel access keys: deleted when you disconnect the channel in the dashboard or when the account is deleted.
• Access logs: 6 months, under article 15 of the Brazilian Internet Framework Act.
• Tax and accounting data: 5 years, under tax law.
• Backups: the daily copies last a few days and are replaced by newer ones. In addition to those, we keep a monthly encrypted copy, with restricted access, used only to restore the service after a disaster. Monthly copies already taken are not rewritten, so they may still contain data you have asked us to delete in production. The deletion you request is applied immediately on the live system.

10. Your rights as a data subject (article 18 of the LGPD)

You may, at any time, exercise the following rights:

• Confirm the existence of personal data processing.
• Access your data.
• Correct incomplete, inaccurate or outdated data.
• Anonymize, block or delete unnecessary or excessive data, or data processed in breach of the LGPD.
• Request data portability in a structured format (JSON).
• Delete personal data processed based on your consent, subject to legal retention.
• Obtain information about the public and private entities with which Linx shared the data.
• Be informed about the possibility of not providing consent and its consequences.
• Withdraw consent at any time.
• Object to processing based on one of the exemptions from consent, in case of breach of the LGPD.
• Request a review of automated decisions that affect your interests.

To exercise any right, use the "Export data" and "Delete my account" buttons in the dashboard or email [email protected]. We respond within 15 calendar days.

You may also file a complaint with the Brazilian Data Protection Authority (ANPD): gov.br/anpd.

11. Information security

We adopt reasonable technical and administrative measures to protect data, including encryption in transit and at rest, role based access control (RBAC), Row Level Security in the database, audit logging, continuous monitoring, encrypted backups, server hardening, network isolation, fail2ban, rate limiting on public forms, email ownership confirmation on sign up and periodic security audits.

In the event of a security incident that may pose a relevant risk or harm, we will notify the ANPD and the affected data subjects within a reasonable timeframe, as required by the LGPD (article 48).

12. Cookies and similar technologies

We use cookies and similar technologies for different purposes:

• Essential: keep you logged in and protect against fraud. Cannot be disabled.
• Functional: remember dashboard preferences.
• Analytics (optional): PostHog to understand aggregated dashboard usage. You can turn it off with the button below.
• Advertising and measurement: the Meta pixel, described in item 8, used to measure the results of our ads and to target My AIssistant ads. It loads on every page of the site. Today it is not turned off by the button below, and you can block it through your browser settings or a blocking extension.

We do not sell your data and we do not use these cookies to build a profile about subjects outside My AIssistant.

13. Children and adolescents

My AIssistant is not intended for people under 18. We do not knowingly collect data from children or adolescents. If you identify improper processing, contact the DPO for immediate removal.

14. Automated decisions and AI

The AI assistant generates responses automatically based on the knowledge you upload and the conversation history. These responses are informational and do not replace human decisions on sensitive matters (legal, medical, financial). You may, at any time, take over the conversation manually and, where applicable, request a review of the automated decision under article 20 of the LGPD.

15. Changes to this Policy

This Policy may be updated to reflect legal, regulatory or operational changes. Material changes will be communicated at least 15 days in advance by email and by notice in the dashboard. The current version is always available at omeuauxiliar.com/privacidade.

16. Contact

Officer (DPO): [email protected]
General support: [email protected]
Address: Rua Valença, 18, Novo Hamburgo/RS, Brazil, ZIP 93537-310
CNPJ: 63.208.063/0001-58