JotaDuo
Privacy Policy
Last updated: October 11, 2026
JotaDuo is a CRM for customer service over WhatsApp. This policy explains which personal data we process, why, who we share it with, how long we keep it and how you can exercise your rights under Brazil's General Data Protection Law (LGPD, Law No. 13,709/2018).
In short: we use data to provide the service you contracted. We do not sell data, we do not use it for advertising and we do not use Google account data to train artificial intelligence models.
Who we are
JotaDuo is offered by JOTA DUO SOLUCOES TECNOLOGICAS LTDA - ME, registered under CNPJ 37.914.616/0001-88, based in Petrolina, Pernambuco, Brazil ("JotaDuo", "we"). The service is available at jotaduo.com and its subdomains.
The contact channel for JotaDuo's privacy and data protection officer is contato@jotaduo.com.
Who decides about the data
JotaDuo acts in two different ways, depending on the data:
- As a controller, for the data of people who use the platform: account registration, login, subscription billing and security logs.
- As a processor, for the data that a customer company puts into JotaDuo about its own customers: contacts, WhatsApp conversations, appointments, charges and notes. In that case the customer company is the controller and decides how the data is used. If you are an end customer of a company that uses JotaDuo and want to exercise your rights, contact that company first. We help as needed.
Data we process
Your account data
- Name, email, profile photo (if uploaded), language and time zone.
- Password, stored only as a hash.
- Workspace name and logo, team roles and permissions.
Data you and your team enter or receive
- Contacts and companies: name, phone, email, job title and other fields you create.
- WhatsApp conversations: messages, files, audio and the status of each conversation.
- Appointments, reminders, charges, notes, tasks and attached files.
- Emails and calendar events, when you connect a Google account (details below).
Technical data
- IP address, browser and device type, access date and time and error logs, used for security and to keep the service running.
Google account data
Connecting a Google account is optional. When you connect one, we request the permissions below and use each only for the function described:
| Permission | What we access | Why |
|---|---|---|
Email and basic profile (email, profile) |
Your name, photo and primary email address | Identify the connected account and link it to your JotaDuo user. |
Read Gmail (gmail.readonly) |
Messages, headers and attachments | Show the emails exchanged with each customer in that customer's CRM history and create contacts from those conversations, according to the rules you define. |
Send and draft in Gmail (gmail.send, gmail.compose) |
Messages you write in JotaDuo | Send emails and create drafts from the customer record, always on your action or through a workflow you configured. |
Calendar events (calendar.events) |
Events, times and attendees | Show meetings next to customers in the CRM and create events from JotaDuo. |
Access, use, storage and sharing
- Access: we access only the data covered by the permissions shown above, after you authorize the connection on Google's consent screen.
- Use: we use this data only to synchronize emails and events with the CRM and to let you read, write, send or create the items described above. We do not use Google data for advertising, advertising profiling or credit assessment.
- Storage: messages, attachments, events and connection tokens are stored on JotaDuo infrastructure hosted on Oracle Cloud, in a database and files separated by workspace. Transmission uses HTTPS/TLS and access depends on account permissions.
- Sharing: we do not sell Google data. It is processed by Google to run the requested APIs and by Oracle Cloud to host the service. We send only the strictly necessary excerpt to an AI provider when the user themselves starts an AI feature on that content; the providers involved are listed in the Who we share it with section.
How we store and protect it
Imported data stays in your workspace database, with access restricted to the members of your team who have permission. Google access tokens are kept on the service's private infrastructure. All communication uses an encrypted connection (HTTPS/TLS).
What we do not do
- We do not sell Google data or pass it to data brokers.
- We do not use this data for advertising or to assess credit.
- We do not use Google Workspace API data to develop, improve or train generalized artificial intelligence or machine-learning models.
- JotaDuo staff do not read this data, except with your explicit permission for a specific case (for example, a support request), when necessary for security (such as investigating abuse) or to comply with the law.
Revocation, retention and deletion
You can disconnect your Google account at any time in the JotaDuo settings or at myaccount.google.com/permissions. Disconnecting stops new synchronization and invalidates use of the token. Previously synchronized history remains in the workspace to preserve the CRM record until you delete it in the platform or request deletion by email at contato@jotaduo.com. We complete deletion requests within 30 days. Residual backup copies are removed in the next rotation, within 30 additional days, unless retention is required by law.
JotaDuo's use and transfer to any other app of information received from Google APIs will adhere to the Google API Services User Data Policy, including the Limited Use requirements.
What we use the data for
| Purpose | Legal basis (LGPD, art. 7) |
|---|---|
| Create and maintain your account and provide the contracted service | Performance of a contract |
| Synchronize connected accounts, such as Google and WhatsApp | Performance of a contract, at the user's request |
| Prevent fraud and abuse and maintain security | Legitimate interest |
| Send service notices, such as security alerts and changes to the terms | Performance of a contract and legitimate interest |
| Keep access logs and meet tax obligations | Compliance with a legal obligation (Brazil's Internet Civil Framework and tax law) |
Artificial intelligence
JotaDuo has an AI agent that answers messages and helps the team. To generate a reply, the necessary part of the conversation and the information you registered for the agent are sent to a language model provider, which returns the suggested text.
- We send only what is necessary for the function you are using.
- Processing may use the OpenRouter router and models from Anthropic, MiniMax or Hugging Face, depending on the feature and the model enabled for the workspace. These vendors act as processors to generate the requested reply and are subject to their own commercial and privacy terms.
- Google account data is sent to the AI provider only when you use an AI feature on that email or event, and never to train models.
- The administrator can turn off the agents in Settings → JotaDuo → Agents. When turned off, they stop processing new messages; the team can still handle conversations without AI.
Who we share it with
We do not sell personal data. We share it only with vendors that help us provide the service, under contract and with a confidentiality obligation:
- Hosting and database: Oracle Cloud, São Paulo region.
- WhatsApp: Meta Platforms, to send and receive messages.
- Google APIs: Google LLC, only to authenticate the connection and run the Gmail and Calendar functions authorized by the user.
- AI models: OpenRouter, Anthropic, MiniMax and Hugging Face, depending on the model enabled and only when an AI function is used.
- Transactional email: JotaDuo's own mail server hosted on Oracle Cloud.
- Payments: Asaas, when the customer company enables the integration to issue and track charges.
We may also share data when required by law or a competent authority, or in a merger or sale of the company, in which case you will be notified beforehand.
International transfers
Some vendors, such as AI providers, may process data outside Brazil. In those cases we adopt the safeguards provided in art. 33 of the LGPD, such as contractual clauses requiring a level of protection equivalent to Brazil's.
How long we keep it
- Account and workspace data: while the subscription is active and for up to 30 days after cancellation, to allow reactivation or export. After that we delete or anonymize the data, except what the law requires us to keep.
- Access logs: 6 months, as required by Brazil's Internet Civil Framework.
- Tax documents: for the period set by tax law.
- Google account data: as described in the Google account data section.
How we protect it
- Encrypted connections (HTTPS/TLS) throughout the service.
- Passwords stored only as hashes.
- Data access limited by role and permission within each workspace.
- Administrative access to servers restricted to the responsible team.
- Backups with restricted access, used only for service continuity and recovery and deleted according to the retention cycle in this policy.
If a security incident occurs that may pose a relevant risk to you, we will notify you and Brazil's National Data Protection Authority (ANPD), as the law requires.
Your rights
Under the LGPD (art. 18), you may request at any time:
- Confirmation that we process your data and access to it.
- Correction of incomplete, inaccurate or outdated data.
- Anonymization, blocking or deletion of unnecessary data or data processed in breach of the law.
- Portability of the data to another provider.
- Deletion of data processed on the basis of your consent, and information about the possibility of refusing consent.
- Information about who we share your data with.
- Withdrawal of consent.
To exercise any right, write to contato@jotaduo.com. We reply within 15 days. You may also complain to the ANPD at gov.br/anpd.
Cookies and local storage
We use only essential cookies and local storage: to keep you signed in, remember the workspace and store preferences such as theme and language. We do not use advertising cookies. This page loads fonts from Google Fonts.
Children and teenagers
JotaDuo is a tool for businesses and is not intended for people under 18. We do not knowingly collect data from children as users of the platform.
Changes to this policy
When we change this policy, we will update the date at the top. If the change materially affects how we use Google account data or other data, we will notify you by email or within the platform before it takes effect.
Contact
JOTA DUO SOLUCOES TECNOLOGICAS LTDA - ME
Petrolina, PE, Brazil
Privacy and data protection officer:
contato@jotaduo.com