This is a courtesy translation. In case of discrepancy, the Portuguese version prevails. Read the Portuguese version.

Frame Conexa

Privacy Notice

Last updated: July 17, 2026

This Privacy Notice describes how Frame Conexa, operated by Gabriel da Silveira Miranda, CNPJ (Brazilian corporate taxpayer registry) 61.559.385/0001-16, headquartered at Av. Barão de Studart, 300 - LC Corporate Green Tower, Meireles, Fortaleza - CE, Brazil ("Frame", "we"), processes personal data in connection with the Platform, in compliance with Law No. 13,709/2018 (Brazilian General Data Protection Law - Lei Geral de Proteção de Dados, "LGPD").

1. Definitions

The definitions in Article 5 of the LGPD apply, in particular: Data Subject (the person to whom the data relates), Controller, Processor, Processing and ANPD (Brazilian National Data Protection Authority - Autoridade Nacional de Proteção de Dados). "Customer", "User", "End Contact" and "Meta" have the meaning given in the Terms of Use.

2. Scope

This Notice applies to website visitors, contracting Customers and Users designated by the Customer. As for End Contacts, whose data passes through the Customer's operation, the Customer acts as Controller and is responsible for informing its own data subjects.

3. Data we collect

3.1. Provided directly

• identification and contact data (name, e-mail, phone number);
• registration data and credentials for access to the Platform;
• billing data, where applicable.

3.2. Collected automatically

• access logs (IP address, date and time), in accordance with the Brazilian Internet Civil Framework (Marco Civil da Internet);
• cookies and technical identifiers.

3.3. Technical data from the Meta integration

• identifiers of the Customer's account with Meta: App ID, WABA ID and phone_number_id;
• Cloud API access tokens (OAuth), stored encrypted at rest;
• message metadata and content processed via webhooks (messages, history, smb_app_state_sync and smb_message_echoes events), processed on behalf of and under the instructions of the Customer.

4. Purposes of processing

• enable the number on the Cloud API and the operation of the Platform;
• provide technical support and communicate with the Customer;
• ensure security, prevent fraud and comply with legal and regulatory obligations;
• exercise rights in judicial, administrative or arbitration proceedings;
• send institutional communications, on an appropriate legal basis.

5. Legal bases (LGPD)

Processing	Purpose	Legal basis
Registration data and credentials	Performance of a contract	Art. 7, V
Access logs	Legal obligation (Marco Civil da Internet)	Art. 7, II
Security and fraud prevention	Legitimate interest	Art. 7, IX
Marketing communications	Consent	Art. 7, I
End Contact data	Processed on behalf of the Customer (Processor)	Art. 39

6. Data sharing

We may share data with:

• Meta / WhatsApp, as an indispensable part of operating the Cloud API;
• the infrastructure and hosting provider Railway, as a processor;
• the payment processor AmploPay, for intermediation of charges;
• public authorities, upon legal request;
• measurement/analytics tools, with consent.

7. Roles: Controller and Processor

Frame acts as Controller of the Customer's registration data and of the data collected directly through the website and the Platform. As for the Customer's operational data - especially messages and contacts of its End Contacts - Frame acts as Processor, processing such data on behalf of and under the instructions of the Customer at the Meta Tech Provider layer, solely to enable the contracted operation.

8. Retention periods

• registration data: for the term of the contract and for up to 5 years after its end, for defense in any litigation;
• access logs: for at least 6 months (Marco Civil da Internet);
• tokens and credentials: for as long as necessary for operation, being revoked/deleted after termination;
• other data: for the period required by applicable law.

9. Information security

We adopt appropriate technical and organizational measures, including:

• encryption of access tokens at rest (AES-256-GCM) and traffic protected by TLS/HTTPS;
• signature validation of webhooks received from Meta (HMAC-SHA256);
• access control and authentication by API key;
• logging and monitoring of relevant events.

Vulnerabilities may be reported to frameagencyhub@gmail.com.

10. Data subject rights

Under Article 18 of the LGPD, the data subject may request:

• confirmation of the existence of processing and access to the data;
• correction of incomplete, inaccurate or outdated data;
• anonymization, blocking or deletion of unnecessary data or data processed in non-compliance;
• portability and information on data sharing;
• withdrawal of consent and objection to processing;
• review of automated decisions and the filing of a complaint with the ANPD.

Requests must be sent to the contact indicated in section 13.

11. Cookies

We use cookies strictly necessary for operation (based on legitimate interest) and, with consent, optional measurement cookies. The data subject may manage preferences through the cookie banner and browser settings.

12. International transfer

Some processing may involve international data transfer (for example, to Meta and infrastructure providers located abroad), in accordance with Article 33 of the LGPD and with appropriate safeguards adopted, such as standard contractual clauses.

13. Data Protection Officer and contact

Data Protection Officer (DPO - Encarregado pelo Tratamento de Dados): Gabriel da Silveira Miranda.
Contact for privacy matters: frameagencyhub@gmail.com.

14. Changes to this Notice

This Notice may be updated at any time. The current version will always be available at https://frameconexa.com/en/privacy. Material changes will be communicated through the registered channels.