Privacy Policy

Who processes your data

This policy is issued by CCX COMPANY INTERMEDIAÇÃO DE NEGÓCIOS LTDA, CNPJ 69.602.757/0001-51, which operates the CCX Messages platform. Whenever "we" appears here, it refers to that company.

The platform is a communications infrastructure used by other companies to talk to their own customers. This creates two distinct roles, and the difference between them determines almost everything that follows in this policy.

If your data is here because a company sent you a message, that company is the controller. We can forward your request to it, but we have no authority to decide about that data.

What we collect when we are the controller

As controller, we process only what is necessary to operate the service, bill for it, pay the partners in the partner program, and comply with legal obligations. We do not buy databases, we do not enrich data with third parties, and we only use advertising tracking on the website with your consent.

In the partner program, the tax and payment details are required by the partnership contract and by Brazilian law: without them, the commission is still calculated, but it accrues until the partner sends them. Where this table says legal and tax obligation, the law is Brazilian law; for those in the European Union or the European Economic Area, that processing relies on the contract and on our legitimate interest in complying with the law we are subject to (GDPR art. 6(1)(b) and (f)).

Cookies and measurement

On the public website we use cookies strictly necessary for operation — such as storing your cookie choice and remembering the site language. These do not need permission.

Beyond those, we use Google Analytics 4 to measure page audience, and Google Ads plus the Meta pixel and Conversions API (Facebook and Instagram) to measure ad performance. Each category has its own legal basis:

• Audience measurement (Google Analytics 4): consent for visitors from the European Union, the European Economic Area, the United Kingdom or Switzerland, or from a location we cannot identify; legitimate interest (LGPD art. 7, IX) for visitors from any other country, Brazil included, always with a one-click opt-out.
• Advertising (Google Ads, the Meta pixel and Conversions API, and our own record of which campaign brought you): consent, in every country. Never on by default. With it on, the email address and phone number of a submitted form are sent to Meta as a hash (SHA-256), to measure whether the contact came from a Facebook or Instagram ad.

You can change your choice at any time under “Cookie preferences” in the website footer. The list of cookies, with who sets each one, its duration and its purpose, is in the Cookie Policy.

When we are the processor

Message content, contact lists, and conversation history belong to the customer that hired the platform. We process this data only to deliver the contracted service, following the instructions documented in the contract and in the data processing agreement.

• We do not use message content for any purpose of our own: not for commercial analysis, not to train artificial intelligence models, and not for product improvement based on identifiable content.
• We do not share, sell, or transfer one customer's contact list to another customer or to third parties.
• Internal access to content is restricted, requires justification, and is recorded in an audit log — it normally happens only when the customer itself asks for help on a specific case.
• It is the customer's responsibility to ensure the legal basis for contacting the data subject, including consent when the communication is marketing.

Google user data (Google Ads connection)

When a customer's user connects Google Ads under Ads › Connections in the dashboard, they sign in with their own Google account and authorize access.

Through Google APIs, CCX receives that Google account's email address and identifier; the list of Google Ads accounts it can access (number, name, currency, time zone and status); whether auto-tagging is on; and, for the accounts chosen, the campaigns, ad groups and asset groups (name, type and status), with each day's cost, impressions and clicks.

We use this data only to show the customer itself what each campaign spent next to the conversations and deals it generated, and to warn when auto-tagging is off. CCX only reads: it does not create, change, pause or delete campaigns, ads, budgets or bids.

The data is not sold, is not used for advertising, does not train artificial intelligence models, is not sent to the AI agent and is not shared with other customers. No one on the CCX team reads this data, except at the customer's express request, for security or to comply with the law.

The data stays on the platform's own infrastructure, in São Paulo. The access token granted by Google is stored encrypted and never appears in the dashboard or in logs. When the user disconnects, the token is deleted and, when no other company on CCX uses the same Google account, revoked at Google; the user can also delete the spend already read.

Access can be revoked at any time at myaccount.google.com/permissions, and closing the customer's account deletes everything.

CCX's use and transfer to any other app of information received from Google APIs will adhere to the Google API Services User Data Policy, including the Limited Use requirements.

Artificial intelligence

When the customer enables the AI agent, the conversation messages (including images received), the agent's instructions and the excerpts of its knowledge base are sent to sub-processors to generate the response for that interaction.

Artificial intelligence processing by language models is performed by Anthropic, PBC, in the United States, which constitutes an international data transfer. Amazon Web Services (Bedrock), also in the United States, only generates the numerical representations (embeddings) used to search the knowledge base, and does not use the content to train models.

Anthropic does not use content sent through the API to train models. Anthropic deletes inputs and outputs within 30 days. Content that its safety systems flag as a violation of its usage policy may be kept for up to 2 years.

No conversation on the platform trains a model — neither ours nor a third party's. Knowledge base documents only serve to retrieve context for the customer's own responses. Each interaction is recorded, with the incoming message and the response, so the decision can be traced.

If your internal policy requires it, we state in writing which model providers are in use at the time of contracting and in which region inference takes place.

Who we share with

We share data only with parties necessary for the service to exist and, in the partner program, in the cases listed after the table, always with a limited purpose. The complete, up-to-date list of sub-processors is available on request, and relevant changes are communicated as set out in the contract.

• Partner program: the partner's data goes to Brazil's Federal Revenue Service (Receita Federal) and eSocial, in the filings for the commission paid and the taxes withheld from it; to the municipality, when municipal service tax (ISS) is withheld; and to the banks that make the payment: the Pix key or, for partners who live outside Brazil, the bank details and what the foreign exchange for the transfer requires.
• Company referred by a partner: the partner sees in the Partner Portal the company's name, the contact the partner logged, the account status and its dates, the plan, the monthly fee and the amount spent on messages in the year, to check the commission and the bonus. The partner does not see message content, the company's contacts on the platform or its conversations.

We may also share data to comply with a court order or a request from a competent authority. When the law permits, we notify the affected customer before responding.

International transfers

The platform's application, database, files, backups, cache and queue are in a Brazilian region (São Paulo).

International transfer happens in five defined situations: message delivery by a channel provider with global infrastructure (Meta); push notifications (Apple, Google and browsers); Cloudflare's global network, which answers domain DNS, proxies the website and relays WhatsApp voice call audio when the customer uses calls; artificial intelligence processing when the customer enables the AI agent, which currently takes place in the United States, by Anthropic, PBC (language models) and Amazon Web Services (knowledge base embeddings); and the commission payment to a partner who lives outside Brazil, which carries to the banks involved, including the partner's bank abroad, the data the payment requires.

The data protection clauses that apply to these transfers are being formalized with each vendor. In Anthropic's case, the transfer relies on Anthropic's Data Processing Addendum, automatically incorporated into its Commercial Terms (effective February 24, 2025), with standard contractual clauses. Alignment with the ANPD standard clauses is being formalized.

The payment to a partner abroad does not rely on those clauses: it goes to the account the partner designates and is necessary to perform the partnership contract (LGPD art. 33, IX, with art. 7, V).

How long we keep data

The retention period depends on the nature of the data. Message content is retained on a schedule the customer configures, from 30 days to 5 years; tax records follow the statutory period, which cannot be negotiated by contract.

Your rights as a data subject

The LGPD grants you a set of rights, and we respond to all of them within 15 days — usually well before. We do not charge for the response and do not require justification for the request.

• Confirm whether we process data about you and access that data.
• Correct data that is incomplete, inaccurate, or out of date.
• Request anonymization, blocking, or deletion of data that is unnecessary or processed in breach of the law.
• Request portability to another provider, in accordance with the applicable regulations.
• Withdraw consent, where processing relies on it, and be informed of the consequences of withdrawal.
• Object to processing based on legitimate interest, stating the reason.
• Petition the ANPD against us as controller. If you are in the European Union, the European Economic Area, the United Kingdom or Switzerland, you can also lodge a complaint with the data protection authority of the country where you live or work.

If the data is on the platform on behalf of a customer company, we forward your request to it within 2 business days and inform you of the forwarding.

Security and incidents

We apply encryption in transit and on sensitive fields, role-based access control, two-factor authentication that the organization can require from every member, and action audit logs. The technical details and the responsibility model are described on the security page.

In case of a security incident with material risk to data subjects, we notify the affected customers within the timeframe set in the contract, covering the scope of what happened, the data potentially involved, the containment measures taken, and the recommended action. This exists so the customer can meet its own obligations before the ANPD and the data subjects.

Changes to this policy

When we amend this policy, we update the effective date at the top and keep prior versions available on request. A change that reduces rights or expands purposes is communicated to customers by email at least 30 days in advance, so there is time to evaluate and, if appropriate, terminate the contract at no cost.