1. Data Collected

We may collect the following types of personal data:

• Account data: name, email, phone, CPF/CNPJ, address.
• Usage data: access logs, logs, configuration preferences.
• Financial data: information necessary for billing and payment (processed by third parties such as Stripe and PagSeguro).
• External integrations: data from connected services, such as Google Calendar and WhatsApp Business, limited to granted permissions.

2. Purpose of Processing

Data is used to:

• Create and manage user accounts.
• Offer integrations (Google Calendar, WhatsApp).
• Issue invoices, tax receipts and manage subscriptions.
• Comply with legal and regulatory obligations.
• Improve user experience and system security.

3. Third-Party Integrations

3.1 Google Calendar (Google API Services – Limited Use)

• Access is restricted to reading and writing events, exclusively for synchronization and IA Number functionalities.
• We do not sell, share or use Google Calendar data for advertisements.
• Human access is restricted to support, security or legal requirement situations.
• The user can revoke permission at: My Google Account > Security.

3.2 WhatsApp Business (Meta)

• Message sending requires prior opt-in from the recipient.
• We respect opt-out requests ("stop", "cancel").
• Sending illegal, abusive content or content that disagrees with Meta's policies is prohibited.
• Message metadata may be processed by Meta and necessary providers.

4. Legal Basis (LGPD)

We process personal data based on the legal hypotheses provided in the LGPD, including:

• Contract execution.
• Compliance with legal obligation.
• Legitimate interest.
• Data subject consent (when applicable).

5. Data Sharing

We may share personal data with:

• Payment providers (e.g.: Stripe, PagSeguro).
• Infrastructure providers (e.g.: Amazon AWS).
• Communication partners (e.g.: Meta/WhatsApp).
• Legal authorities, when required.

Always under contract and with adequate protection measures.

6. Storage and Retention

• Data is stored on secure servers, hosted on AWS.
• We keep data only for the time necessary to fulfill legal and contractual purposes.
• After deletion request, we remove or anonymize data within 30 days.
• Backups may retain information for up to an additional 90 days.

7. Data Subject Rights

You have the following rights, according to LGPD:

• Access your personal data.
• Correct incomplete or outdated data.
• Request deletion or anonymization.
• Request portability.
• Revoke consent.

Requests can be made to contato@oplena.com.br.

8. Security

We adopt technical and organizational measures to protect data against unauthorized access, loss or misuse, including encryption, access control and security monitoring.

9. International Transfer

Some data may be transferred outside Brazil (e.g.: AWS servers in the USA), always with adequate data protection guarantees.

10. Changes to this Policy

We may update this Privacy Policy periodically. Relevant changes will be communicated reasonably. The most recent version will always be available on our website.

11. Applicable Law and Forum

This Policy is governed by the laws of Brazil. In case of litigation, the forum of the District of São Paulo/SP is elected.