SGuard System · Painel SGuard ASI
Privacy Policy — SGuard ASI Dashboard
Version 1 (2026-11) · Effective 06/11/2026 (Courtesy translation. The Portuguese text prevails in case of conflict.)
1. Who we are and scope
The SGuard ASI Dashboard (the "Service") is provided by SGUARD SYSTEM (trade name SGUARD BLOCKCHAIN), Brazilian company registered under CNPJ 47.705.473/0001-58, headquartered at Av. Brigadeiro Faria Lima, 1572, rooms 1022 and 3157, Jardim Paulistano, São Paulo, SP, Brazil, ZIP 01451-917, with customer service in Rio Claro, SP ("SGuard", "we").
This policy covers two situations: - We act as controller for data about the business that subscribes to the Service and its users (sign-up, billing, communications, access security). - We act as processor for personal data that the subscribing business puts into or receives through the Service, such as its conversations with its own customers on WhatsApp, Instagram and Facebook. In that case the subscribing business is the controller and we process the data on its behalf and under its instructions, under the data processing agreement that is part of our Terms of Use (Brazilian General Data Protection Law, Law 13.709/2018, "LGPD").
If you are a customer of a business that uses the Service, that business is the controller of your data. See section 9.
2. Data we process
As controller: names and e-mails of users, company name, tax ID, phone, plan; billing data and payment status (we do not store full card numbers); access logs (date, time, authorized device, IP address) and usage logs; support messages.
As processor (channels connected by the business): when a business connects its own accounts, we receive from Meta Platforms, Inc. and its affiliates ("Meta"), only through the permissions that business granted: - WhatsApp Business: the business's phone number and display name, number status and quality rating, message templates, and the messages exchanged with the business's customers (text, media, sender's phone number and profile name, timestamps, delivery status). - Instagram (professional account): profile name, username and picture of the connected account; direct messages sent and received; content the business approved for publishing. - Facebook Pages: the list of the business's Pages, Messenger messages sent and received by the Page, and content the business approved for publishing. - Access credentials (tokens) issued by Meta for the connection.
We do not access accounts, Pages or numbers the business has not connected. The Service is intended for businesses; we do not knowingly collect data from persons under 18.
3. Purposes and legal bases
Provide the Service and maintain accounts (performance of contract, LGPD art. 7, V); billing and tax documents (contract and legal obligation, art. 7, V and II); security, fraud and abuse prevention (legitimate interest, art. 7, IX; legal obligation for access logs, art. 7, II); support and service notices (contract); and, as processor, handling channel conversations and content on the controller's instructions, the controller being responsible for the legal basis.
What we do not do: we do not sell data; we do not share data received from Meta with third parties for their own purposes; we do not use it for advertising, commercial profiling or building contact lists; we do not use it to train artificial intelligence models.
4. AI assistants
The Service runs AI assistants that work on behalf of the subscribing business. They identify themselves as AI assistants in the first message and confirm it if asked. The person talking to an assistant can ask for a human at the business at any time. Sensitive sends (billing, prices, contracts, bulk sending) require the business's approval, and recipient limits apply per send and per hour.
5. Who we share data with (processors and sub-processors)
We engage technology providers as sub-processors under data protection obligations equivalent to this policy, in these categories: infrastructure and hosting; AI text processing; voice (audio) processing; messaging and communication channels (including Meta itself when the business connects its channels); billing and payments; transactional e-mail and support. The named list of sub-processors is provided to the controller on formal request through the contact in section 11, and we notify the controller of relevant changes; the controller may object on reasonable grounds.
We may also disclose data when required by law, court order or competent authority, and to defend our rights in proceedings, to the extent necessary.
6. International transfers
Some sub-processors (AI text processing, voice, infrastructure) and Meta are located in other countries, such as the United States and European Union countries. Transfers rely on the safeguards of LGPD art. 33, such as contractual clauses with equivalent protection and, where applicable, the standard contractual clauses of ANPD Resolution CD/ANPD No. 19 of 23 August 2024, and cover only the data necessary for the Service. These sub-processors may keep data for a short period (generally up to 30 days) for security and abuse prevention and then delete it. Voice processing is subject to the sub-processor's own terms, available in the sub-processor list.
7. Retention
Sign-up and billing data: for the life of the contract and then as required by law. Conversation history and channel content: while the account exists or until the controller requests deletion. Meta credentials: encrypted, and deleted as soon as the business disconnects the channel or cancels the account. After cancellation: data is available for export for 30 days and then deleted, including from backups within the normal rotation period, unless the law requires retention. Deletion requests: handled within 15 days (section 8).
8. Your rights and how to exercise them
Under LGPD art. 18 you may request confirmation of processing; access; correction; anonymization, blocking or deletion of unnecessary, excessive or unlawfully processed data; portability; deletion of data processed on consent; information about sharing; information about the option not to consent and its consequences; and withdrawal of consent. Write to the contact in section 11. We respond within 15 days (LGPD art. 19, II) and may ask for information to verify your identity.
Deleting data received from Meta: see our Data Deletion page ([URL]/exclusao-de-dados), which explains the steps, including requests made from Facebook or Instagram.
9. If you are a customer of a business that uses the Service
Data you sent to that business (for example by WhatsApp, Instagram or Messenger) is processed by it as controller, and we act on its behalf. Send access, correction or deletion requests to that business first. If you contact us directly, we forward your request to the controller and let you know.
10. Security
Each account runs in an environment separate from the others, with its own network, user and storage, and access limited to authorized devices. Meta credentials are encrypted in a dedicated vault and are never exposed to the business's own workspace. Only people who need it to provide the Service have access, under confidentiality duties. If a security incident affects personal data, we notify the controller within 72 hours after confirming it and make the communications required by law.
11. Data protection officer and contact
Data protection officer: Filipi Cardoso. Contact: privacidade@sguardsystem.com [PENDING: mailbox must exist before publishing]. You may also complain to the Brazilian data protection authority (ANPD).
12. Cookies
The portal uses only strictly necessary cookies and storage for login and session security. [CONFIRM with Paulo.]
13. Changes
We may update this policy, recording version and date; relevant changes are notified by e-mail or in the dashboard, and re-acceptance is requested when needed.