Cadenio Chat Privacy Policy

1. Controller and data protection officer (DPO)

The controller responsible for the processing described in this policy is GGSA Consultoria em TI Ltda., CNPJ 49.390.014/0001-58, headquartered in São Paulo, Brazil, operating under the Cadenio brand. The designated data protection officer (LGPD art. 41 / GDPR art. 37) can be reached through the dedicated form below or at privacy@cadenio.com.

2. Roles: controller and processor

With respect to content exchanged within a workspace (messages, attachments, and files), the contracting organization acts as controller and Cadenio acts as processor, handling such data under the organization's instructions and solely to provide the service. With respect to account and service-operation data (account, authentication, security, and billing), Cadenio acts as controller.

3. Data we collect

We collect the following categories of data, depending on how you use Cadenio Chat:

• Account and identity data: display name, email address, internal user identifier, profile picture (avatar), and status.
• Communication content: messages sent in channels and direct messages, reactions, stickers, and associated metadata (timestamp, sender, recipient).
• Attachments and media: files, photos, and videos sent in conversations or used as an avatar.
• Audio: voice messages you record and send.
• Technical and device data: device type and version, push notification identifiers (FCM/APNs token), and notification preferences (muted channels, do-not-disturb, mentions-only).
• Diagnostics: crash and performance data collected for app stability and improvement.

We do not use this data to track you across third-party apps or websites, and we do not sell personal data.

4. How we use data

• Operate the service: deliver messages, attachments, and notifications to the correct recipients.
• Authenticate and secure accounts, prevent abuse, and detect unauthorized activity.
• Send push notifications according to your preferences, which can be adjusted or disabled at any time.
• Scan uploaded files for malware, where that protection is enabled.
• Diagnose crashes, measure performance, and improve app stability.
• Comply with legal obligations and respond to requests from competent authorities.

5. Legal bases

We process personal data based on contract performance (service delivery), legitimate interest (security, fraud prevention, and product improvement), compliance with legal obligations, and, where applicable, consent (for example, device permissions). When Cadenio acts as a processor, processing occurs under the instructions of the controlling organization.

6. Sharing and sub-processors

We do not sell personal data. We share data only with providers that support the operation of the service, under contractual data-protection obligations, including:

• Storage of attachments, media, and avatars (object storage provider, e.g., Cloudflare R2).
• Push notification delivery (Firebase Cloud Messaging — Google; and Apple Push Notification service).
• Crash and performance monitoring (e.g., Sentry).
• Transactional email delivery, such as account verification and invitations (e.g., Brevo).
• Hosting and database infrastructure used to operate the service.

We may also disclose data when required by law, court order, or to protect the rights, safety, and integrity of the service and its users.

7. Mobile app and permissions

On mobile, the app may request access to notifications, camera, photos, and microphone. These permissions are used only to enable the corresponding features (push notifications, attachments and profile pictures, voice messages) and can be revoked at any time in device settings. The app declares the use of system APIs (such as preference storage and file-metadata reading) solely to support app functionality, as required by the App Store privacy manifest.

8. Retention and deletion

We keep data for as long as necessary to provide the service, meet legal obligations, and honor the workspace retention policy. Messages and attachments deleted by the user or organization are removed according to applicable features and timeframes. Upon closure of the workspace or account, associated content is deleted or anonymized, except where retention is required by law.

9. Security

We apply technical and organizational measures to protect data, including encryption in transit, role-based access control, isolation between workspaces, and malware scanning of attachments. No system is entirely immune to risk; in the event of a material incident, we will act in accordance with applicable law and notify the relevant parties and authorities where required.

10. International transfers

Some sub-processors may process data outside Brazil or the European Economic Area. In such cases, we adopt appropriate safeguards under the LGPD and GDPR (such as standard contractual clauses) to ensure an equivalent level of protection.

11. Your rights

You may request access, correction, portability, anonymization, or deletion of your personal data, as well as information about the processing, under the LGPD and GDPR. Where data is processed under the responsibility of the controlling organization (workspace content), we may forward the request to it. Requests can be made via the form below or at privacy@cadenio.com.

12. Children and minors

Cadenio Chat is intended for business use by individuals aged 18 or older and is not directed at children or minors. We do not knowingly collect data from minors.

13. Updates to this policy

We may update this policy to reflect changes in the service or in legislation, communicating material changes with reasonable advance notice. The date of the latest update appears at the top of this page.

14. Contact

To exercise your rights or ask questions about privacy in Cadenio Chat, use the privacy form or write to privacy@cadenio.com. See also the Chat Terms of Service.