Privacy Policy

This Privacy Policy describes how MIBRA CONSULTORIA EM TI LTDA (“Mibra”, “we”, “us”) processes personal data when you use our websites, accounts, products, and digital services, including Mibra Timely (“Timely”).

1. Who we are and how to contact us

Related documents: Cookies, DPA, Subprocessors.

2. Scope and definitions

This policy applies to personal data processing by Mibra in delivering contracted services, account registration and use, support, billing, and Timely operations. English technical terms (for example, webhook, OAuth, WABA) carry their usual industry meaning.

“You” may be a site visitor, subscriber (professional), administrative user, or a person whose data the subscriber enters and that appears in an event on the subscriber’s Google Calendar. In the MVP, the subscriber’s customers do not message Mibra’s WhatsApp number.

3. Data we process

We process categories of data depending on the service used:

• Account and identity: name, email, authentication credentials, language preferences, session records, and access logs.
• Contract and billing: plan, subscription history, payment identifiers, and records required by law.
• Timely and integrations: the subscriber’s own messages and identifiers, received on the phone number and WhatsApp Business (WABA) account owned by Mibra; OAuth tokens and connection metadata for the subscriber’s Google Calendar; assistant configuration; scheduling correlation identifiers; and the data the subscriber supplies to create events on that calendar. The subscriber does not connect their own number or WABA. In the MVP, Mibra does not receive the subscriber’s customers’ messages on that number.
• Support and security: technical logs, IP address, user agent, audit trails, and evidence needed to prevent fraud and abuse.

Conversation history: we do not store WhatsApp message content or conversation history for consultation or operational replay. For Meta webhook integrity, we retain the raw webhook body for up to 14 days, after which raw content is deleted while retaining hashes and outcome classification when needed for idempotency, security, and compliance.

4. Purposes and legal bases (LGPD)

We process personal data under the legal bases of Brazilian Law No. 13,709/2018 (LGPD), according to purpose:

When processing relies on consent, refusing non-essential consent does not block core contracted functionality unless the data is strictly necessary.

5. WhatsApp, Meta, and automated assistant

The Timely assistant is a private channel on the WhatsApp Business Platform (Meta), on a phone number and a WhatsApp Business (WABA) account owned by Mibra. Only the subscriber (the professional) talks to that number, to manage their own schedule and their own Google Calendar. There is no WhatsApp Coexistence and no Embedded Signup. The subscriber does not connect their own number or WABA. Mibra does not send messages on behalf of the subscriber’s number. In the MVP, Timely does not message the subscriber’s customers, and those customers do not use Mibra’s number. Mibra processes the subscriber’s messages to create or update events on the subscriber’s Google Calendar, without maintaining a conversation archive for later lookup.

• Channel: Mibra operates the number and the WABA. That channel is not the subscriber’s number or account, and it is not a channel for the subscriber’s customers.
• WhatsApp data: as a rule, this is the subscriber’s own data (their conversation with the assistant).
• Third-party data: only to the extent the subscriber enters it or it appears in calendar events. In those cases the subscriber is controller and Mibra is processor, under the DPA.
• Meta policies: the channel is also subject to Meta terms and policies applicable to the WhatsApp Business Platform.
• Data exchanged: message identifiers, delivery metadata, technical webhook payloads (raw retention limited to 14 days per §3), and the data the subscriber supplies to create the appointment on their calendar.

6. Google Calendar and OAuth

With the subscriber’s explicit authorization, Mibra accesses Google APIs to read availability and create or update events on the linked calendar. We store OAuth token references securely (secrets not in plaintext in the application database) and connection metadata.

We will publish final compliance wording for the Google API Services User Data Policy, including Limited Use scope and a public link to the Google user data policy applicable to Timely, when legal review is complete.

7. Artificial intelligence and model providers

Parts of the service may use language models to interpret commands or assist operational flows. We send only what is necessary for the purpose and do not use WhatsApp conversations as a consultable archive. The named LLM provider (subprocessor), processing region, and international transfer basis will be listed when the integration is in production.

8. Sharing and subprocessors

We share data with vendors that help us with hosting, authentication, payments, message delivery, abuse protection, and infrastructure. The current list, including country and international transfer mechanisms, is at Subprocessors.

We do not sell personal data. We do not share with third parties for behavioral advertising.

9. International transfers

Some subprocessors process data outside Brazil. Applicable safeguards (standard contractual clauses, adequacy decisions, or equivalent mechanisms) are described per vendor on the Subprocessors page. You may request additional information from the DPO.

10. Retention

We keep data for as long as needed for the purposes in this policy, including legal, limitation, and audit periods. Highlights:

• Raw Meta webhook body: up to 14 days.
• Account and contractual records: contract term and subsequent legal periods.
• Security logs: a period proportionate to security and incident investigation.

After processing ends, we delete or anonymize data unless a legal exception requires retention.

11. Security

We adopt technical and organizational measures appropriate to the risk, including:

• TLS encryption in transit for communications with our services and APIs.
• Access control and environment segregation.
• Row Level Security (RLS) and authorization policies on the platform database, restricting data access by identity and workspace context.
• Secret management, monitoring, and periodic permission review.

No measure guarantees absolute security; relevant incidents follow §12.

12. Security incidents

We monitor and respond to incidents affecting personal data. When required by the LGPD, we notify the controller (subscriber) and the Brazilian National Data Protection Authority (ANPD) under Article 48, describing the incident, affected data, technical and mitigation measures, and contact channels, within applicable legal timeframes. Data subjects will be informed when there is risk or when law or the controller requires it.

13. Data subject rights (LGPD Art. 18)

You may request, among others:

• confirmation of processing and access;
• correction of incomplete or outdated data;
• anonymization, blocking, or deletion of unnecessary or non-compliant data;
• portability, where applicable;
• information on sharing;
• consent withdrawal;
• review of automated decisions, where applicable.

We respond to requests within 15 days, extendable as permitted by the LGPD, via privacy@mibra.io. For requests about data entered by a subscriber in Timely (for example, a client contact), we may direct you to the professional controller and cooperate under the DPA.

Account and data deletion: operational instructions at Help Center — Data deletion.

14. Children and minors

Our services are intended for people 18 years of age or older. We do not knowingly collect data from children or adolescents. If we learn of improper collection, we will delete the data and take reasonable steps to stop processing.

15. Government and authority requests

We respond to public authority requests under Brazilian law, with processing and operations oriented to Brazil. We assess legality, scope, and necessity before disclosing data and log requests when applicable. Data subjects may contact the DPO for clarification on disclosures made under legal order.

16. Cookies and similar technologies

We use cookies and local storage as described in the Cookie Policy. We do not use third-party analytics cookies on this legal site.

17. Changes to this policy

We may update this policy to reflect legal or operational changes. We publish the effective version with effective date and history on Changelog. Material changes will be communicated by reasonable means (for example, in-product notice or email on file).

18. Governing law and jurisdiction

This policy is governed by Brazilian law. Venue: courts of São Paulo/SP, Brazil, except where mandatory consumer law provides otherwise.