Privacy Policy

Two different roles

For the data of people who USE the platform (members of a client company's team: name, email, phone, hashed password, access logs), Prospeek is the CONTROLLER.

For the data of each client company's CONTACTS (its leads and customers, and the conversations with them), the client company decides — it is the controller, and Prospeek is the PROCESSOR: it handles that data on the company's behalf and only to provide the contracted service.

Data we process

• Account: name, email, phone and password (stored only as a hash), company and team role.
• Client companies' contacts: name, phone, email, Instagram handle, city, interest, deal history and whatever the company itself records.
• Conversations: messages, voice notes, images and documents exchanged through the channels the company connected.
• Data from Meta platforms, when a company connects official WhatsApp or official Instagram: the business account ID, username and profile picture of the company's account, and, for people who message it, the sender ID, public name, username and profile picture, and the message content.
• Integration credentials: the access tokens Meta and other services issue when the company authorizes a connection. They are encrypted (AES-256-GCM) and never shown back on screen.
• Technical data: IP address, browser and access logs, for security and troubleshooting.

How we use it

• Deliver and receive messages on the connected channels and show them to the company's team.
• Organize the client company's leads, deals, appointments and sales.
• Reply automatically, when the company turns on a bot or an AI agent, always within each channel's rules.
• Keep accounts secure, bill for the service, provide support and meet legal obligations.

We do not sell personal data, do not use it for third-party advertising, and do not use one client company's data to serve another. Data received from Meta platforms is used only to operate the connection the company authorized.

Legal bases (Brazil’s LGPD)

Performance of the contract with the client company; legitimate interest for security and fraud prevention; compliance with legal obligations; and, where applicable, consent. For contacts’ data, the legal basis is defined by the client company, as controller.

Who we share it with

Only with providers needed for the service to work, under contract and to the extent necessary:

• Meta (WhatsApp and Instagram), to deliver and receive messages on official channels.
• Artificial intelligence providers, to generate replies and transcribe voice notes, when the company uses the agent.
• Infrastructure: cloud servers, file storage and content delivery (Cloudflare), and an email delivery service.
• Authorities, when required by a court order or by law.

Some of these providers are outside Brazil; international transfers follow LGPD requirements.

How long we keep it

For as long as the client company's account is active, or as long as the law requires. When a channel is disconnected, that channel's access token is discarded. Deletion requests are completed within 30 days; backups are erased on their own 30-day retention cycle.

Your rights

You may request confirmation of processing, access, correction, anonymization, portability and deletion of your data, and withdraw consent, by writing to [email protected]. If you are a contact of a company that uses Prospeek, you may also ask that company directly — and if the request reaches us, we forward it and help them fulfil it.

Anyone who asks in a conversation to stop receiving messages ("stop", "don’t message me anymore") is flagged and removed from the company’s campaigns and automated outreach, with no further step needed.

Security

Encrypted connections (HTTPS), passwords stored only as hashes, encrypted integration credentials, per-company data separation and access logging. No system is infallible; if an incident poses relevant risk, we notify those affected and the Brazilian data protection authority (ANPD) as required by law.

Cookies and local storage

The app uses the browser's local storage to keep you signed in and remember screen preferences. We do not use advertising cookies.

Changes

When this policy changes, the date at the top changes with it. Material changes are announced to client companies before they take effect.