1. Introduction & Data Controller
Welcome to ContatoCRM ("we", "our", or "platform"). We are committed to protecting your privacy and ensuring the security of personal data processed through our SaaS platform.
In the context of data protection laws (including the EU GDPR and global privacy standards), ContatoCRM operates as a Data Processor for clinic client/patient records, while your registered clinic acts as the Data Controller.
🔒 Security Guarantee: All clinic data is isolated via multi-tenant architecture with encrypted communication and strict access controls.
2. Information We Collect
- Account Information: Clinic name, slug, administrator full name, email address, password hash, and billing information.
- Staff & Professional Data: Names, contact numbers, email addresses, and assigned procedures.
- Client & Patient Records: Full name, nickname, phone/WhatsApp number, date of birth, address, tax identification (NIF/CPF), appointment history, and notes entered by your team.
- Communication Logs: Message logs exchanged via WhatsApp integration (Evolution API) for scheduling and automated notifications.
3. Purposes of Data Processing
We process data exclusively for legitimate operational purposes:
- Providing and maintaining the ContatoCRM multi-tenant scheduling platform.
- Automating WhatsApp notifications, appointment reminders, and follow-ups.
- Processing plan subscriptions, upgrades, and billing via payment gateways (Asaas).
- Sending transactional emails (trial notices, expiration warnings, payment confirmations).
- System performance monitoring, debugging, and security audits.
4. Third-Party Integrations & Sub-Processors
We work with trusted third-party providers bound by strict confidentiality and data protection obligations:
- Asaas Gateway: Processing of subscriptions, Pix, Credit Card, and bank slip payments.
- Evolution API: Official and automated WhatsApp messaging dispatch.
- SMTP Email Providers: Secure transmission of transactional emails (PHPMailer).
5. Data Retention & Multi-Tenant Security
Your data is stored in secure database environments with automatic backups. In the event of trial expiration or subscription cancellation, your records are retained safely for a period of 30 days to allow account reactivation, after which data may be permanently sanitized upon request.
6. Your Rights
You and your patients have the right to access, rectify, export, or request the deletion of personal data at any time. To exercise your rights, contact our support team at suporte@contatocrm.com.br.