Delegue Chat Privacy Policy
Effective version: October 15, 2026
This is an English translation provided for convenience. The Portuguese version prevails in case of any conflict.
This Policy explains how DELEGUE AI TECNOLOGIA LTDA (“Delegue.AI”, “we”) collects, uses, stores, shares and protects personal data in Delegue Chat, the multichannel customer service platform available at chat.delegue.ai. It complements the company's general policy, published at delegue.ai/politica-de-privacidade, and follows the Brazilian General Data Protection Law (Law No. 13,709/2018, “LGPD”).
1. Who we are and how to reach us
- Company name: DELEGUE AI TECNOLOGIA LTDA
- CNPJ (Brazilian company ID): 65.782.236/0001-72
- Address: Avenida Paulista, 1636, suite 1105, Paulista Corporate, Cerqueira César, São Paulo/SP, Brazil, ZIP 01310-200
- Data protection officer (DPO) and privacy contact: [email protected]
- Phone: +55 11 99267-5224
2. Who this Policy applies to and our role
- Customers and users: companies that subscribe to Delegue Chat and the people they register as administrators or agents. For these users' account data, Delegue.AI acts as the controller.
- Customers' contacts: people who talk to the companies through the connected channels (WhatsApp, Instagram, Facebook Messenger, Telegram, website chat) or who make bookings. For this data, the customer company is the controller and Delegue.AI acts as the processor, handling the data according to the customer's instructions.
- Visitors: people who access the public pages of Delegue Chat or the chat installed on a customer's website.
3. What data we collect
3.1 Account and user data
Name, email, password (stored only as an irreversible cryptographic hash), profile picture, phone, job title, role and permissions, notification preferences, two-factor authentication settings and company name.
3.2 Conversations and contacts
Name, phone, email, username and public profile picture on the channel, channel identifiers, the content of messages sent and received (text, images, audio, video, documents and shared locations), audio transcripts, labels, internal notes, custom attributes and each contact's service history. When a contact arrives from an ad, such as click-to-WhatsApp ads, we also record the source ad data (identifier, title and link).
3.3 Schedule and bookings
Appointment types, availability hours, blocks and bookings. Each booking may contain the contact's name, phone and email, date and time, location or video call link, status (confirmed, cancelled, attended and so on), notes and the booking's change history.
3.4 Kanban CRM and lead qualification
Cards linked to conversations, pipeline stage, values, dates and qualification information recorded by agents or by the AI agents (for example, interest, event date, requested quote).
3.5 Prospecting
When the customer uses the prospecting tool, Delegue Chat collects, at the customer's request, publicly available business data from portals chosen by the customer (such as business name, contact person and publicly listed contact details), so the customer can make the first commercial contact.
3.6 Technical, usage and security data
IP address, browser and operating system, date and time of access, pages accessed in the app, records of each user's active sessions (IP, browser and last access, used so the user can see and end their sessions and to limit simultaneous logins), audit logs of administrative actions, browser notification subscriptions and technical error reports. In the chat installed on websites, we also record the source page and a visitor identifier.
3.7 Data obtained from Google accounts
Described in detail in section 4.
3.8 Billing data
The customer company's billing data, handled according to Delegue.AI's general policy.
4. Google data
Delegue Chat connects to Google only when a user authorizes the connection on Google's consent screen. Depending on the feature used, we access:
| Feature | Requested scopes | Data accessed and how it is used |
|---|---|---|
| Sign in with Google | email, profile |
Name, email and profile picture, used only to create and authenticate the user's access to Delegue Chat. |
| Google Calendar |
calendar.calendarlist.readonly, calendar.events, email
|
The list of calendars the connected account can write to, so the user can choose where to publish; creating, updating and deleting the events that match the bookings made in Delegue Chat (title, time, location, Google Meet link and the booking's contact details). The email identifies the connected account. Delegue Chat does not read, change or delete any other event in the calendar. |
4.1 Storage and protection
Google access tokens are stored encrypted on our servers and used only by the features above. From Google Calendar we keep only the connected account's email, the list of chosen calendars and the identifiers of the events created by Delegue Chat itself.
4.2 Sharing
Google data is shared only as needed to provide user-facing features: with the users of the same company account in Delegue Chat. We do not send Google data to AI providers. We do not sell Google data, use it for advertising, transfer it to data brokers or use it to determine creditworthiness.
4.3 Human access
Our team does not read Google data, except with the user's express permission (for example, in a support request), when necessary for security purposes such as investigating abuse, to comply with the law, or when the data is aggregated and anonymized for internal operations.
4.4 Artificial intelligence
We do not use data obtained through Google APIs to develop, improve or train generalized artificial intelligence or machine learning models, and we do not allow third parties to do so.
4.5 Revocation and deletion
You can disconnect Google Calendar at any time in Delegue Chat's settings. When you disconnect, the tokens are deleted immediately. You can also revoke access at myaccount.google.com/permissions. Events already created remain in your calendar, under your control, and can be deleted by you. To request deletion of any other data, write to [email protected].
4.6 Limited Use
Delegue Chat's use and transfer to any other app of information received from Google APIs adheres to the Google API Services User Data Policy, including the Limited Use requirements.
5. What we use the data for
- Providing the service: receiving, organizing and sending messages on the connected channels, running AI agents, kanban, prospecting, scheduling and reports;
- Creating and authenticating accounts, managing permissions and protecting access;
- Sending the message campaigns set up by the customer and tracking delivery and replies;
- Sending app, email and browser notifications about conversations, bookings and the account;
- Providing support and communicating relevant changes to the service;
- Preventing fraud and abuse, investigating technical failures and keeping the service secure;
- Complying with legal and regulatory obligations and orders from authorities.
6. Artificial intelligence agents
When the customer company turns on an AI agent, the content needed for the answer (conversation messages, contact details, knowledge base, catalog and schedule availability) is sent to the configured language model provider, such as OpenAI or Anthropic, only to generate the answer, transcribe audio or index documents. We do not use customers' or their contacts' data to train generalized AI models. AI-generated answers may contain errors; the customer company can set limits, review and handover to human agents.
To monitor the agents' quality, cost and failures, we log the calls to AI models (the content sent and the generated answer) in an AI observability service, with access restricted to our team.
The customer can also authorize external AI apps to access their own Delegue Chat account through our MCP server with OAuth. This access is limited to the accounts the user administers and can be revoked at any time.
7. Legal bases
- Performance of a contract and of preliminary procedures (art. 7, V, of the LGPD);
- Legitimate interest, for security, fraud prevention and service improvement (art. 7, IX);
- Compliance with a legal or regulatory obligation (art. 7, II);
- Consent, when specifically requested, as when connecting Google accounts (art. 7, I);
- For contacts' data, the legal basis is defined by the customer company, which is the controller.
8. Who we share data with
We do not sell or rent personal data. We share data only with:
- Infrastructure providers: cloud hosting, database and file storage;
- Channels and integrations connected by the customer: Meta (WhatsApp, Instagram, Facebook Messenger), WhatsApp connection providers, Telegram and Google Calendar;
- AI and AI observability providers: as described in section 6;
- Email and notification delivery: transactional email services and browser notification services;
- Error monitoring: a service that receives technical failure reports;
- Usage analytics of the public pages: Google Analytics 4, only after you accept the cookie notice (section 10);
- Users of the same account: a company's agents see that company's conversations and contact data, according to the permissions it defines;
- Authorities: when required by law or court order, or to protect the rights of Delegue.AI, its customers or third parties.
These vendors receive only what is needed to provide the service and are bound by confidentiality and security obligations.
8.1 Access by the Delegue.AI team
Members of our team may access a customer company's account, including conversations and contacts, only when needed to: provide support at the customer's request; deploy and tune the AI agents the customer subscribed to, which includes reviewing the conversations the company's agents flag as feedback; investigate failures, security or abuse; and comply with the law. This access is restricted to authorized people bound by confidentiality.
9. International transfers
Some vendors, such as AI providers, the AI observability service, cloud providers and messaging platforms, may process data outside Brazil. In these cases, we adopt the safeguards set out in art. 33 of the LGPD, such as contractual clauses and the choice of vendors with adequate levels of protection.
10. Cookies and local storage
Delegue Chat uses cookies and the browser's local storage to keep the user's session, remember preferences (language, theme and your cookie choice) and, in the chat installed on websites, keep the visitor's conversation. Blocking these cookies may prevent the login or the chat from working.
On the public pages (the home page, this Policy and the Terms of Use), we use Google Analytics 4 to understand how they are used, with Google Consent Mode: no analytics cookie is stored until you accept the cookie notice, and you can review your choice at any time with the Cookies button in the footer. If you decline, we delete the Google Analytics cookies. We do not use advertising cookies.
11. Security
- Encryption in transit (HTTPS/TLS) on every connection;
- Integration tokens (such as Google's) encrypted at rest and passwords stored as hashes;
- Logical isolation of data per customer company and role-based access control;
- Two-factor authentication available to users;
- Audit logs, error monitoring and backups.
In case of a relevant security incident, we will notify the affected customers and the ANPD (the Brazilian data protection authority) as required by the LGPD.
12. How long we keep data
We keep data while the customer's account is active or while it is needed to provide the service. The customer can delete conversations, contacts, bookings and integrations at any time. After the contract ends, the account's data is deleted or anonymized within 90 days, except when the law requires longer retention (for example, access logs for the period required by the Brazilian Internet Civil Framework, and tax documents). Google account access tokens are deleted as soon as the connection is removed.
13. Your rights
Under art. 18 of the LGPD, you can request:
- confirmation that your data is processed and access to it;
- correction of incomplete, inaccurate or outdated data;
- anonymization, blocking or deletion of unnecessary or excessive data;
- data portability;
- deletion of data processed based on consent and withdrawal of consent;
- information about who we share the data with.
Send your request to [email protected]. We reply within 15 days. If you are a contact of a customer company, we will forward the request to that company, which is the controller, and support it in handling the request. You can also file a complaint with the ANPD.
14. Sensitive data and minors
Delegue Chat is intended for businesses and is not directed at people under 18. We do not request sensitive data, but contacts may send it on their own in conversations; in that case, the customer company is responsible for handling it.
15. Changes to this Policy
We may update this Policy. Relevant changes will be communicated to customers by email or inside the app, and the effective date at the top of this page will be updated.