Privacy Policy

1. Who the controller is

This policy explains how we process personal data on the Multly website, in the Multly account, in the customer dashboard and on the license server, in accordance with the Brazilian General Data Protection Law (LGPD, Law No. 13,709/2018) and the EU General Data Protection Regulation (GDPR, Regulation (EU) 2016/679).

The data controller is NEXEUS SISTEMAS INTELIGENTES LTDA, CNPJ 58.310.179/0001-63, with its address at Rua Izaurina Braga, 160, Compensa I, Manaus, AM, CEP 69030-000, Brasil. The Data Protection Officer (DPO) can be contacted at [email protected].

This policy does not cover the data kept by the app on your computer (see section 13) or the processing carried out by WhatsApp itself, which is governed by the WhatsApp privacy policy.

2. Data we process, purposes and legal bases

Account

• Data: email, name, language, creation date and the password, stored only as an argon2id hash, which does not allow the original password to be recovered.
• Purpose: to create and maintain your account, allow you to log in on the website and in the app, and contact you about your account.
• Legal basis: performance of a contract (LGPD, art. 7, V; GDPR, art. 6(1)(b)).

CPF or CNPJ

• Data: the full CPF (the Brazilian taxpayer number for individuals) or CNPJ (the Brazilian taxpayer number for companies) and the document type (CPF or CNPJ). Sign-up, on the website and in the app, asks for the document when access is from Brazil, based on the country provided by our content delivery network (see section 6). If the account does not have the document yet, the one entered at the first PIX payment is stored in the same way and becomes the account document; a document different from the stored one is refused for PIX. The document is stored encrypted (AES-256-GCM) on our server. The website and the API never show the full document: the dashboard shows only a masked version (for example, ***.456.789-**), and you can correct it in the dashboard, confirming with your password and, with two-step verification on, with its code.
• Purpose: billing and issuing the invoice (nota fiscal) in Brazil, and payment by PIX: Asaas requires the document of the payer, and the payment uses the document stored in the account, without asking for it again each time.
• Sharing: sent to Asaas for payment by PIX and, when the invoice is issued by an invoicing service, to that service (see section 7).
• Legal basis: performance of a contract and compliance with a legal or regulatory obligation in issuing the invoice (LGPD, art. 7, II and V; GDPR, art. 6(1)(b) and (c)).

Plan and subscription

• Data: plan, billing interval (monthly or annual), payment method (card or PIX), subscription status, currency, amount, the country from which you were accessing the website when the purchase started, for card purchases the issuing country of the card that paid, as provided by the payment processor, end of the paid period, scheduled cancellation, customer and subscription identifiers at Stripe or Asaas, the subscription history and the record of each purchase started (date, plan, payment method, currency, amount, country of access, whether the purchase was completed and when the reminder was sent).
• Purpose: to charge for Pro, unlock the plan features, show the subscription in the dashboard, send the unfinished purchase reminder and prevent fraud in the purchase currency (see section 6).
• Legal basis: performance of a contract, compliance with legal and tax obligations regarding payment records and legitimate interest in preventing fraud and charging the correct price regarding the country of access and the country of the card (LGPD, art. 7, II, V and IX; GDPR, art. 6(1)(b), (c) and (f)).

Payment by PIX

• Data: the full name of the payer, entered on the website for the PIX payment, and the CPF or CNPJ stored in the account (described above) or, if the account does not have it yet, the one entered at the first payment, which is then stored in the account, sent to Asaas together with the account email; the name is not stored on our server. We store the customer identifier at Asaas and, for each PIX charge, the type (monthly Pro or annual Pro), the amount, the due date, the status and the payment and refund dates.
• Purpose: to issue and track PIX charges, unlock Pro, show the payment method, the next charge and the history in the dashboard, send billing notices and handle withdrawal and refund requests.
• Legal basis: performance of a contract and compliance with legal and tax obligations regarding payment records (LGPD, art. 7, II and V; GDPR, art. 6(1)(b) and (c)).

Billing address, taxes and buying as a business

• Data: for card payments, Stripe asks for and stores the full billing address and the name; Multly does not store the billing address. For each paid purchase, we keep as evidence of the country of the tax: the country (and, where applicable, the region) from which you were accessing the website when the purchase started, the tax applied and its percentage, the country of the billing address and the issuing country of the card, as provided by the payment processor. When you buy as a business, we also keep the VAT number entered, its country, the date of the check and the check reference from the official service (VIES, of the European Commission, or the HMRC service, in the United Kingdom), and the number is sent to Stripe to appear on the invoice; the official service may return the registered name and address of the business, which we show on the payment screen.
• Purpose: to calculate and charge the tax of the country of the purchase, prove that country to the tax authorities, check the VAT number, apply the reverse charge to businesses with a valid number and issue the invoice.
• Legal basis: compliance with legal and tax obligations and performance of a contract (LGPD, art. 7, II and V; GDPR, art. 6(1)(b) and (c)).

Activation keys

• Data: the last 5 characters of the redeemed key, the redemption date, the email of the account that redeemed it, what the key unlocked (Pro for a period of time, with start and end) and, if applicable, the revocation date. The full key is not stored: the server keeps only a hash of it. The IP address and the account are used temporarily to limit redemption attempts.
• Purpose: to unlock Pro on the account, show the plan in the dashboard, prevent the same key from being used twice and investigate fraud or unpaid keys.
• Legal basis: performance of a contract and legitimate interest in fraud prevention (LGPD, art. 7, V and IX; GDPR, art. 6(1)(b) and (f)).

Activated computers

• Data: computer name, operating system, app version, installation identifier, dates of activation, last validation and disconnection, and the computer token, stored only as a hash.
• Purpose: to issue the license, apply the plan’s computer limit and show the computers in the dashboard.
• Legal basis: performance of a contract (LGPD, art. 7, V; GDPR, art. 6(1)(b)).

Daily app totals

• Data: for each day, the number of active installations (in the last 1, 7 and 30 days) and their breakdown by app version and by system, calculated from the last validation of each activated computer. Only the totals are stored, with no per-computer record and no link to accounts. The app sends nothing beyond the license validation for this.
• Purpose: to follow the adoption of versions and the aggregate use of the app, without identifying any computer or person.
• Legal basis: legitimate interest in maintaining and improving the app, with minimal data (LGPD, art. 7, IX; GDPR, art. 6(1)(f)).

Website sessions

• Data: session token, stored only as a hash, dates of creation, last use and expiry, and a summary of the browser and system (for example, "Chrome · Windows") derived from the browser at login. The full browser identifier (User-Agent) is not stored.
• Purpose: to keep you logged in, show your open sessions and allow you to end them.
• Legal basis: performance of a contract and legitimate interest in account security (LGPD, art. 7, V and IX; GDPR, art. 6(1)(b) and (f)).

Password reset

• Data: account email and a single-use token, stored only as a hash and valid for 1 hour.
• Purpose: to send you the link to create a new password.
• Legal basis: performance of a contract (LGPD, art. 7, V; GDPR, art. 6(1)(b)).

Email confirmation and change

• Data: the account email, the confirmation date and, for a change, the new address requested, with a single-use token stored only as a hash and valid for 24 hours. The IP address and the account are used temporarily to limit sending and attempts.
• Purpose: to confirm that the account email is yours, unlock the subscription and activation keys, change the email securely and notify the previous address of the change.
• Legal basis: performance of a contract and legitimate interest in account security (LGPD, art. 7, V and IX; GDPR, art. 6(1)(b) and (f)).

Two-step verification

• Data, only if you turn it on: the authenticator app secret, stored encrypted; the 10 recovery codes, stored only as hashes; the date it was turned on, the last accepted code interval and the count of incorrect codes, to prevent a code from being reused and to block attempts. At login, a single-use challenge, stored only as a hash, is valid for 5 minutes.
• Purpose: to protect access to the account on the website, in the app and for sensitive actions.
• Legal basis: performance of a contract and legitimate interest in account security (LGPD, art. 7, V and IX; GDPR, art. 6(1)(b) and (f)).

Pro trial

• Data: the start and end dates and, if you subscribe, the conversion date of the trial, and a code (SHA-256 hash) of the account email in canonical form (lowercase and without the suffix after the "+"; for Gmail, also without the dots), kept for 12 months even after the account is deleted. The code cannot be traced back to the email.
• Purpose: to grant the 14-day trial once per account and prevent the same email from getting a new trial within 12 months.
• Legal basis: performance of a contract and legitimate interest in preventing abuse (LGPD, art. 7, V and IX; GDPR, art. 6(1)(b) and (f)).

Lifecycle emails and marketing consent

• Data: your choice for "News and offers" and the date it last changed, your preference for receiving lifecycle emails and the record of which of these emails have already been sent to the account, with the date; the date of the unfinished purchase reminder is kept in the record of the purchase started. The unsubscribe link carries a signed code that identifies only the account.
• Purpose: to send the welcome email, with the first steps, and the notices that the trial is ending and has ended, which are service notices; the unfinished purchase reminder, when you start a subscription (card or PIX, Pro or Team) and do not complete it within 1 hour, with the link to resume the purchase and its coupon, if there was one, at most one every 7 days; and, only with your consent, the offer email sent 7 to 14 days after a subscription ends, which may include a coupon. The record prevents the same email from being sent twice.
• Legal basis: legitimate interest for the service notices about the trial and, outside the European Union and the European Economic Area (EEA), for the unfinished purchase reminder, which you can opt out of with the unsubscribe link or in the dashboard (LGPD, art. 7, IX; GDPR, art. 6(1)(f)); consent for offers, which starts unchecked at sign-up and can be withdrawn at any time in the dashboard or with the unsubscribe link, and for the unfinished purchase reminder on purchases in the European Union or the EEA, that is, in euros or accessed from a country in the European Union or the EEA (LGPD, art. 7, I; GDPR, art. 6(1)(a)).

Discount coupons

• Data: the code of the coupon used or reserved by the account, the payment provider, the status (reserved when payment starts, or used) and the dates.
• Purpose: to apply the discount, ensure single use per account and the coupon’s total usage limit, and calculate revenue and commissions net of the discount.
• Legal basis: performance of a contract (LGPD, art. 7, V; GDPR, art. 6(1)(b)).

Referral program

• About the affiliate: the referral code and link, the dates of joining and of deactivation and, for each commission, the date, the type (payment or refund), the currency, the amount it was calculated on, the commission amount and the date it was marked as paid.
• About the referred account: the affiliate who referred it and the referral date, the date of the first payment and the amounts received from it, to calculate the commission. The affiliate sees only aggregate numbers (clicks, sign-ups, paying accounts) and the commission amounts, never the name, email or other data of the referred accounts.
• Clicks on the link: the referral code is recorded in the visit statistics of the page opened through the link, as described in section 5, and kept in the browser of whoever opened the link, as described in section 4.
• Purpose: to tie new accounts to the affiliate, calculate, show and pay commissions, and prevent fraud, such as self-referral.
• Legal basis: performance of the contract with the affiliate and legitimate interest in operating the referral program, with minimal data about referred accounts (LGPD, art. 7, V and IX; GDPR, art. 6(1)(b) and (f)).

Team plan

• Data: the team name, the seats, the owner account, the members (the account, the joining and leaving dates, the reason for leaving and the end of Pro through the team), the invitations (the invited email, the language, the dates of sending, expiry, acceptance or cancellation, and the link code, stored only as a hash) and the history of changes to the team (creation, changes of name and seats, invitations, joining, leaving and removals, with the account that made each one).
• Who sees what: the owner sees, in the dashboard, the name, email and joining date of each member and the email and dates of the open invitations; a member sees the team name, the owner’s name and email and how many seats are taken. The owner does not see the chats, computers, charges or other data of the members’ accounts.
• Inviting third parties: the invitee’s email is provided by the owner, who represents that they have a legal basis to do so, such as an employment relationship. We use that email only to send the invitation and, if it is accepted, to link the account to the team. An invitation that is not accepted is deleted 30 days after it expires.
• Purpose: to operate the Team plan: charge for the seats, give Pro to the members, send the invitations and the team notices, and show the team in the owner’s dashboard and in the members’ dashboards.
• Legal basis: performance of the contract with the owner and with each member, and legitimate interest in sending the invitation to the email provided by the owner (LGPD, art. 7, V and IX; GDPR, art. 6(1)(b) and (f)).

Sync across computers (Pro)

• Data, only if you turn on sync: the records encrypted on your computer (notes, tasks, quick replies, labels, the CRM and the name, color and group of each account), each with the collection name, a random identifier, the revision, the deletion marker, the key version, the size and the date; the encrypted keyring, the salt and the parameters used to derive the key from the recovery phrase, and a cryptographic digest (hash) of the phrase verifier; and the usage counts, the dates of activation, of the last change and of the key change and, outside Pro, the dates of the 90-day countdown and of the notices.
• What we do not see: the content of the records, the key and the recovery phrase. Encryption (AES-256-GCM) takes place on your computer, and the key derived from the phrase never leaves it. Without the phrase, not even we can read the copy.
• Purpose: to store the encrypted copy and deliver it to your account’s computers, enforce the quota, send notices about and delete the copy outside Pro, and show numbers and dates in the dashboard.
• Legal basis: performance of a contract (LGPD, art. 7, V; GDPR, art. 6(1)(b)).

App incompatibility reports

• Data: only the app version, the WhatsApp Web adapter version, the WhatsApp Web version identifier read from the page, the system, the interface language and the names of the app checks that failed. The report contains no chat content, numbers or account or chat names, and is not linked to your account or to your IP address, which is used only at the time of sending to limit abuse.
• When: only when the app detects that WhatsApp Web has changed and you allow sending after seeing the report, or if you turn on the "Send incompatibility reports automatically" preference, which is off by default.
• Purpose: to know when a new WhatsApp Web version has made the app incompatible and adapt it faster.
• Legal basis: consent, which you can withdraw at any time by turning off the preference or declining to send (LGPD, art. 7, I; GDPR, art. 6(1)(a)).

Server operation logs

• Data: server error responses (date, method, pattern of the address accessed and error code), email sending failures (only the type of email and of error, without recipient or text), runs of the maintenance routines and the operation alerts emailed to our team. These logs contain no account, IP address or content.
• Purpose: to monitor the health of the service and detect and fix failures.
• Legal basis: legitimate interest in keeping the service running (LGPD, art. 7, IX; GDPR, art. 6(1)(f)).

Security and access logs

• Data: IP address, date and time, method and address of the page or API accessed, and the response code, in the server technical logs, which do not contain passwords, tokens or request content; IP address and email used temporarily to limit login, activation and password reset attempts; after the account is deleted, a hash (cryptographic digest) of the email, which links the access logs to the data subject (see section 9).
• Purpose: to protect the service against attacks, fraud and abuse, diagnose failures and keep the access logs required by law.
• Legal basis: legitimate interest in security and fraud prevention, and compliance with legal obligations, such as keeping access logs under the Brazilian Internet Civil Framework (Marco Civil da Internet, Law No. 12,965/2014), art. 15 (LGPD, art. 7, II and IX; GDPR, art. 6(1)(c) and (f)).

Customer support

• Data: your email and whatever you write to us.
• Purpose: to respond to questions and to support, withdrawal and data subject rights requests.
• Legal basis: performance of a contract, compliance with legal obligations and the regular exercise of rights (LGPD, art. 7, II, V and VI; GDPR, art. 6(1)(b), (c) and (f)).

Withdrawal and cancellation requests

• Data: for each request made on the "Contract" page of the website, the name, the email entered, the contract identification, the type of request (withdrawal, ordinary cancellation or extraordinary cancellation), the reason, if any, the date and time, the account linked to the request, if any, whether you were logged in and the outcome (the subscriptions ended and the refunds).
• Purpose: to carry out the requested withdrawal and cancellation, send the acknowledgment of receipt and the confirmation by email, confirm requests made without being logged in through the account email, and prove that the right was exercised and honored.
• Legal basis: compliance with legal obligations (LGPD, art. 7, II; GDPR, art. 6(1)(c)).

Access by our team

Authorized members of our team can view your account data stored on the server (sign-up details, plan, subscriptions, charges, redeemed keys, computers and recent access) to provide support, prevent fraud and meet legal obligations, based on the performance of a contract, legitimate interest and compliance with legal obligations (LGPD, art. 7, II, V and IX; GDPR, art. 6(1)(b), (c) and (f)). Access requires logging in with an authorized account and two-step verification, and sensitive actions ask for the password and the code again. Actions that change the account, such as blocking, subscription cancellation, refunds and key revocation, are recorded with who performed them, the IP address, the date and the details of the action.

Emails we send

The automatic emails are the confirmation email, sent at sign-up or when you request a new link; the email change link, sent to the new address, and the notice of the change, sent to the previous address; the password reset email, sent when you request it; the notice that two-step verification was turned off by support; and, for those who pay by PIX, billing notices in the language of your account: payment received, new charge available (monthly or annual), charge overdue and Pix Automático debit declined. With sync turned on and the account outside Pro, we send an email notice when the 90-day countdown for the server copy starts and, 7 days beforehand, of its deletion. On the Team plan, we send the invitation to the email provided by the owner, in the language of the invited account, if it exists, or in the owner’s language, the notice to a removed member and, for PIX, the notice that the payment for the seats was received. The lifecycle emails, in the account language, are the welcome email, the notices about the end of the Pro trial, the unfinished purchase reminder and, only with your consent to "News and offers", the offer email after a subscription ends. The reminder goes to those who start a subscription (card or PIX, Pro or Team) and do not complete it within 1 hour, with the link to resume the purchase and its coupon, if there was one, at most one every 7 days; on purchases in the European Union or the EEA (in euros or accessed from a country in the European Union or the EEA), only with your consent to "News and offers". Every lifecycle email has a one-click unsubscribe link, which turns all of them off and withdraws your consent to offers, without having to log in; you can also change this in the dashboard, under Account. We never send these emails to accounts that are blocked, deleted or have an unconfirmed email. For requests made on the "Contract" page, we send to the email entered the acknowledgment of receipt of the withdrawal or the confirmation of the cancellation, with the date and time, and, for requests made without being logged in, the confirmation link to the account email. We may also write to your account email to respond to your requests and to send mandatory notices about the service, such as changes to the price, the Terms of Use or this policy. We do not send offers without your consent.

3. What we do not collect

• Chats, messages, contacts, phone numbers, photos, audio or any other WhatsApp content.
• Notes, labels, tasks, quick replies, the CRM, customer service metrics, the local archive and backups, which stay only on your computer. With Pro sync turned on, notes, labels, tasks, quick replies, the CRM and the name, color and group of each account go to the server end-to-end encrypted, without us being able to read them.
• The text you use in the writing assistant and the chat content used in AI for customer service, which goes from your computer directly to the provider you chose, or stays on it with local AI.
• App telemetry, advertising trackers and third-party analytics tools. The website only counts visits anonymously, as described in section 5, and from the app we keep only the daily totals described in section 2, calculated from the license validation. The incompatibility report, also described in section 2, is sent only with your permission.
• Card details, which you provide directly to Stripe, and the details of the bank account used for PIX, which stay with your bank and with Asaas.

We do not sell or rent personal data.

4. Cookies and browser storage

The website uses two cookies, sent only to the website itself. mz_session keeps you logged in for up to 30 days; it is strictly necessary for the account to work and cannot be read by scripts on the page. mz_locale is a functional preference cookie: it is set when you choose a language in the selector or in the language banner, stores only the chosen language (for example, en), lasts up to 1 year and keeps the home page from taking you to another language (see section 6). We do not use advertising or analytics cookies: visit statistics work without cookies (see section 5).

The language you choose on the website is also kept in your browser’s local storage (mz.locale). It is sent to the server with requests for prices and payment and, at sign-up, as the account’s initial language. The language is saved only when you choose it in the selector or in the language banner, and the selector states that your choice is saved in this browser. Because it is a preference you set yourself, kept to carry out that request, this storage and the mz_locale cookie do not require consent (Directive 2002/58/EC, art. 5(3)); the legal basis is legitimate interest in keeping the preference you chose (LGPD, art. 7, IX; GDPR, art. 6(1)(f)). You can delete this data and the mz_locale cookie in your browser settings.

When you open the website through an affiliate’s referral link (?ref=), the affiliate’s code is used only to tie the account you create to the affiliate, is sent to the server only at sign-up and does not identify you. What the website does with it depends on the region you access it from, as reported by the content delivery network. In the European Union, the European Economic Area, the United Kingdom and Switzerland, or when the region is unknown, the code is not stored in your browser: it stays only in the page’s memory during the visit, is sent with a sign-up made during that visit and is lost when you close or reload the page; a code stored during an earlier visit from another region is deleted. In other countries, the code is kept in your browser’s local storage (mz.ref), with the date, for up to 60 days, and is removed from the browser after sign-up or after the 60 days. In every case, the click on the link is counted by the cookieless statistics (see section 5). Legal basis: legitimate interest in operating the referral program (LGPD, art. 7, IX; GDPR, art. 6(1)(f)). This is a functional use, with no advertising or tracking; you can delete mz.ref in your browser settings.

Card payment uses the Stripe form, which the website only loads when you start that payment. Stripe may use its own cookies and identifiers, including on the website’s payment page, to process payments and prevent fraud, in accordance with Stripe’s privacy policy.

5. Website visit statistics

To know how many people visit the website, where they come from and which pages work best, we count visits with our own tool, without cookies and without third-party services. The app is not part of this and still has no telemetry.

What is recorded

• For each page opened: date and time, the page address (without parameters), the referring website (only the domain, for example google.com), the campaign parameters utm_source, utm_medium and utm_campaign when the link has them, the website language, the screen size range (phone, tablet or computer), the browser and system name and the country, provided by the content delivery network.
• Some actions, recorded the same way: clicking to download the app (with the chosen system), starting a payment (with the plan), opening the sign-up page and viewing the plans section.
• When the page is opened through a referral link (?ref=), the affiliate’s code, to count clicks on the referral program link.

What is not recorded

• No cookies and no identifier stored in your browser or that follows you.
• The IP address is not stored. To count unique visitors per day, the server computes a code (SHA-256 hash) from the IP address, the browser identifier (User-Agent) and a random value that changes every day, and deletes the previous day’s value. This code cannot be traced back to the IP address and cannot recognize you on another day; someone who returns on another day is counted again.
• Visits are not linked to your account, your email or your login.

How not to be counted

If your browser sends the Global Privacy Control (GPC) or Do Not Track signal, nothing is sent or counted. We also do not count known bots, the administration pages or visits by our team with the administration panel open, which are recognized by a notice kept only in that browser tab and deleted when the tab is closed.

Retention and legal basis

Visit records are deleted after 13 months. The legal basis is our legitimate interest in understanding how the website is used and improving the service, with minimal data and without identifying anyone (LGPD, art. 7, IX; GDPR, art. 6(1)(f)). Because visits are not linked to anyone, we cannot find the records of a specific person; to not be counted, use GPC or Do Not Track.

6. Country, currency and language

The currency of prices and billing follows the country from which you access the website, with no choice of currency: Brazilian reais in Brazil, euros in countries that use the euro, pounds sterling in the United Kingdom, Swiss francs in Switzerland and Liechtenstein, pesos in Mexico, Colombia and Chile, soles in Peru and US dollars everywhere else. To determine the country, the server uses the country code provided by the content delivery network, which the network infers from the IP address. Your browser language and the site language do not change the currency; without the country code (for example, when accessing through the Tor network), the price is in US dollars. If your account has or has had a paid subscription by card, that subscription’s currency applies, and with a PIX subscription in effect, Brazilian reais apply. The currency of each purchase is fixed when payment starts and is recorded with the subscription. The same country (and, where the rate depends on it, the state or province provided by the same network) determines the tax added to the price and whether the purchase is available, as explained in the Terms of Use.

On your first visit to the English home page, at the website’s main address (the Brazilian Portuguese version is at /pt-br/), if your browser is set to another language the website offers, the website takes you to the home page in that language. This uses only the language provided by the browser and stops happening once you choose a language on the website (mz_locale cookie, see section 4). The language selector is always visible.

For auditing and fraud prevention, we keep the country from which you were accessing the website and the currency when each purchase started: for 13 months in the record of the purchase started and, in the subscription, for as long as it exists. For card purchases, we also keep the issuing country of the card that paid, as provided by the payment processor, without any other card data. The IP address is not stored for this. Stripe may decline or review a payment made with a card issued in a country other than that of the purchase currency, and, when the country of the card does not match the currency, our team receives an alert and reviews the purchase. The legal basis is our legitimate interest in preventing fraud and charging the correct price (LGPD, art. 7, IX; GDPR, art. 6(1)(f)).

7. Who we share data with

We share data only with providers that help us operate the service, and only what is necessary for each function:

• Stripe: processes Pro payments, monthly and annual, fraud prevention, invoices and the subscription portal. It receives your email and the payment details you enter in its form and tells us the issuing country of the card that paid. It also receives and stores the full billing address and the name and, when you buy as a business, the checked VAT number, used on the invoice, and tells us the country of the billing address. For some purposes, such as fraud prevention and its own legal obligations, Stripe acts as an independent controller, in accordance with its privacy policy.
• Asaas: issues and collects PIX charges in Brazil and processes refunds. It receives the full name and the CPF or CNPJ of the payer and the account email. Asaas’s own billing notices are turned off: we are the ones who send the notices. For its own legal obligations, Asaas may act as an independent controller, in accordance with its privacy policy.
• Invoicing service: when the invoice (nota fiscal) for purchases in Brazil is issued by an invoicing service, it will receive the data required on the invoice, including the name and the CPF or CNPJ.
• Official VAT number validation services (VIES, of the European Commission, and HMRC, in the United Kingdom): receive only the VAT number entered when you buy as a business, to check whether it is valid.
• Hosting provider: runs the Multly server and database.
• Content delivery network (CDN): delivers the website, protects it against attacks and provides the country of each visit, used for the currency of prices, for recording the country when each purchase starts and for the website statistics, without us storing the IP address.
• Email provider: sends the confirmation and email change emails, the password reset email, the PIX billing notices, the Team plan invitations and notices, the lifecycle emails, including the unfinished purchase reminder, and the operation alerts for our team.

We may also share data when required by law, by order of a competent authority or to defend rights in legal proceedings.

The AI providers you choose for the writing assistant and for AI for customer service are not our service providers: the app sends the text directly to them, using your key and under your agreement with each of them.

8. International transfers

Stripe and our other providers may process data in other countries, including the United States. In these cases, we adopt the safeguards provided for by law, such as standard contractual clauses approved by the Brazilian National Data Protection Authority (ANPD) and the European Commission, adequacy decisions where they exist, and contractual commitments to security and confidentiality.

You can request more information about these safeguards at [email protected].

9. How long we keep data

• Account, plan, subscriptions, PIX charges, the CPF or CNPJ, what activation keys unlocked and computers: for as long as the account exists. When you delete your account, we delete this data from our server, except access records and the record of redeemed keys, which follow the periods below. Invoices (notas fiscais) already issued, with the CPF or CNPJ they contain, follow the retention period required by tax law.
• Website sessions: expire after 30 days, or earlier if you log out or end the session, and are deleted after they expire.
• Password reset tokens: valid for 1 hour and deleted after they expire.
• Email confirmation and change links: valid for 24 hours and deleted after they expire; the challenge for logging in with two-step verification is valid for 5 minutes.
• Two-step verification secret and recovery codes: for as long as it is on. When you turn it off, they are deleted; when you generate new codes, the previous ones are deleted.
• Incompatibility reports: 180 days. Server operation logs: 30 days; alerts sent to our team: 90 days.
• Pro trial, email preferences, record of lifecycle emails sent, coupons used and the account’s referral: for as long as the account exists. The code (hash) of the email that received a trial is kept for 12 months, even after the account is deleted. Coupon reservations that were not used are deleted after 30 days.
• Referral program: the affiliate code and the commissions are kept for as long as the affiliate’s account exists and are deleted with it; commissions linked to a referred account that was deleted remain in the affiliate’s record, without that account’s data. In the browser, the referral code (mz.ref) is kept for up to 60 days, and only outside the European Union, the European Economic Area, the United Kingdom and Switzerland (see section 4).
• Sync across computers: the encrypted copy is kept for as long as sync is turned on and the account exists; deletion markers are kept for 180 days. Outside Pro, the copy is deleted 90 days after the countdown starts. Deleting the copy in the dashboard or in the app, or deleting the account, deletes everything right away.
• Team plan: the team, the members, the invitations and the history are kept for as long as the owner account exists and are deleted with it. The membership of those who left or were removed remains recorded in the team; a member’s deleted account is removed from the team. Invitations never accepted are deleted 30 days after they expire.
• Record of purchases started (date, plan, payment method, currency, amount, country of access, whether the purchase was completed and when the reminder was sent): deleted after 13 months. The country of access at purchase and the card’s issuing country kept in the subscription remain for as long as it exists.
• Withdrawal and cancellation requests made on the "Contract" page: 5 years from the request, and then deleted automatically.
• Evidence of the country of the tax for each paid purchase (described in section 2, including the VAT number when you buy as a business): 10 years from the end of the year of the sale, the period required by European Union tax law, even after the account is deleted.
• Payment records (date, currency, amount, taxes and payment identifiers and, for card payments, the billing address, the name and the VAT number provided): kept by Stripe and, for PIX, by Asaas, for the period required by applicable tax and accounting law, even after the account is deleted.
• Server access logs: for the period required by law, which in Brazil is 6 months from each record (Brazilian Internet Civil Framework, art. 15), even after the account is deleted, and then deleted. After deletion, a hash (cryptographic digest) of the account email is kept for 183 days, solely to link those logs to the data subject when there is a court order, and it is not used for anything else.
• Record of activation keys (the last 5 characters of the key, the redemption date and the email of the account that redeemed it) and record of the actions taken by our team on the account: kept after the account is deleted, for as long as needed to prevent fraud, stop a key from being used again and defend rights.
• Website visit statistics: deleted after 13 months; the random value used to compute the visitor of the day is valid only for the current day.
• Daily app totals: deleted after 25 months.
• Support messages: for as long as needed to handle the request and, after that, for the period in which they may be needed to defend rights.

10. Your rights

Under the LGPD and the GDPR, you have the right to confirm whether we process your data and to access it, correct it, receive it in a portable format, request its deletion, anonymization, blocking or the restriction of its processing, object to processing based on legitimate interest, know who we share it with and withdraw consent, where applicable.

You can exercise many of these rights yourself in the dashboard:

• Access and portability: "Download my data" generates a JSON file with your account data, including the full CPF or CNPJ, email preferences, plan, Pro trial, subscriptions, coupons used, PIX charges, redeemed activation keys, computers, active sessions, access logs, the team you manage, with the invitations sent, the teams you have been part of, the sync numbers and dates (the content is encrypted and we do not have the key) and, for an affiliate account, the code and the commissions.
• Consent: "News and offers" and the lifecycle emails can be turned on and off in the dashboard, under Account, and the unsubscribe link in each of these emails turns all of them off, without logging in.
• Correction: your name, language and email can be changed in the dashboard; the email change takes effect after you confirm the new address. The CPF or CNPJ can be corrected in the dashboard, confirming with your password. To correct other data, write to [email protected].
• Deletion: "Delete account" deletes the account and the data linked to it, as described in the Terms of Use. Under Sync, you delete only the encrypted server copy, confirming with your password.

For other requests, write to [email protected], preferably from your account email, so we can confirm that the request is yours. There is no charge. We respond within the legal deadlines: within 15 days under the LGPD and within one month under the GDPR, which may be extended in the cases it allows.

If our team blocks your account, you can no longer log in to the dashboard or the app, and subscription renewal stops, with no further charges: in Stripe, the subscription is canceled at the end of the period already paid; with PIX, the subscription is ended in Asaas, and the Pix Automático authorization, if any, is canceled. Even with a blocked account, you can still exercise all of these rights, such as access, export and deletion of your data, by writing to [email protected].

We do not make decisions based solely on automated processing that produce legal effects concerning you. The currency of the price follows the country from which you access the website, as described in section 6, and a mismatch between the country of the card and the purchase currency only triggers an alert for our team, which decides case by case, with no automatic cancellation.

If you are not satisfied with our response, you can lodge a complaint with the Brazilian National Data Protection Authority (ANPD) or with the data protection authority of the European Union country where you live or work or where the alleged infringement took place.

11. Security

• All communication with the website, the dashboard and the license server is encrypted (HTTPS).
• Passwords are stored only as argon2id hashes. Session, computer and password reset tokens are stored only as hashes.
• Optional two-step verification, with an authenticator app and single-use recovery codes: the secret is stored encrypted, and the codes only as hashes. Email confirmation links are also stored only as hashes.
• There are attempt limits per IP address and per email for login, the two-step verification code, app activation, activation key redemption, password reset requests and sending email links.
• The website has protections against cross-site request forgery, and technical logs do not contain passwords, tokens or request content.
• Card details never pass through Multly. The CPF or CNPJ is stored encrypted with AES-256-GCM, and the website and the API show only a masked version of it; the full document is only included in the export of your data.
• Sync is end-to-end encrypted with AES-256-GCM on your computer; the server has neither the key nor the recovery phrase, and each encrypted record is bound to the account, the collection and the version, so it cannot be moved to another place without decryption failing.

No system is completely immune to failures. If a security incident occurs that may pose a significant risk or harm to you, we will notify you and the competent authorities, as required by the LGPD and the GDPR.

12. Children and adolescents

Multly is not intended for anyone under 18, and we do not knowingly collect their data. If we learn that an account belongs to someone under 18, it will be deleted. If you become aware of such a case, let us know at [email protected].

13. The app on your computer

App data, such as profiles, notes, labels, tasks, quick replies and the local archive, stays on your computer, in databases encrypted with SQLCipher. On Windows, the key to these databases is protected by Windows DPAPI, tied to your Windows user account. If the account goes back to the free plan, this data remains on your computer, and nothing is deleted because of the change of plan: what is exclusive to Pro becomes read-only or unavailable, as explained in the Terms of Use. There is no telemetry. WhatsApp Web pages communicate directly with WhatsApp, as in any browser.

With or without an account, the app makes two requests to our website, without sending personal data or chat content. As with any connection, our server receives the IP address, and the content delivery network provides the country, as in a visit to the website:

• prices: without an account, or with an account whose email has not been confirmed yet, the app checks, once after it opens, the number of days of the Pro trial and whether sign-up asks for the CPF or CNPJ, sending only the interface language and the app version;
• updates, on Windows: about 1 minute after it opens and then every 24 hours, while the app is open, it downloads the list of released versions, sending only the installed version; a new version is only downloaded and installed with your confirmation, and the automatic check can be turned off in the app settings.

With an account, the app also sends our server what is necessary for the license and, if you turn on Pro sync, its encrypted data:

• when logging in or creating an account: the email and password (the password only for verification, over the encrypted connection), with two-step verification on also the authenticator app code, only for verification, at sign-up also the name, the language and, when accessing from Brazil, the CPF or CNPJ, plus an installation identifier, the computer name, the operating system and the app version;
• at each validation, when the app opens and then every 6 hours: only the computer token;
• with sync turned on: the encrypted records and the data described in section 2, never the recovery phrase or the key.

The spell checker runs on your own computer.

When it detects that WhatsApp Web has changed and stopped working as expected, the app asks whether it may send an incompatibility report and shows the report before sending. The "Send incompatibility reports automatically" preference is off by default. What the report contains is described in section 2; without your permission, nothing is sent.

Writing assistant

The Pro assistant is optional and turned off by default. You choose where the AI runs. With a program on your own computer, such as Ollama or LM Studio, the text does not leave the machine. With a cloud provider of your choice, such as Anthropic, OpenAI, Google Gemini, Groq, Mistral, DeepSeek, OpenRouter, xAI or another compatible provider, turning it on requires accepting a notice about sending text to that provider and entering the key for your account with it. The text typed or pasted into the assistant goes to the provider only when you choose an action, and its processing is governed by your agreement with that provider. To show the available models, the app also queries the provider’s model list, using your key; no chat content is sent in that request. WhatsApp chats are never read or sent automatically, and the keys are protected in the same way, by Windows DPAPI.

AI for customer service (Pro)

AI for customer service summarizes the open chat, suggests a reply and suggests a label and funnel stage, using the same provider chosen for the writing assistant. It reads the chat only when you request an action, and beforehand it shows how many messages will be sent, from when to when, from where and to which provider and address; nothing leaves without you confirming the sending. With a cloud provider, there is a specific notice, separate from the assistant notice, for each provider, with the date of acceptance and revocable in the settings, because this content is personal data of third parties. With AI on your own computer (Ollama or LM Studio), there is no notice and nothing leaves the machine.

• What goes to the provider: fixed instructions from the app and the text of the selected messages, with their time, in which people appear only as Contact (numbered when there is more than one) or Agent; for the label and stage suggestion, also the names of the account’s labels and funnel stages. Whatever is written inside the messages is sent as is.
• What does not go: the chat name, the names and numbers of the participants, photos, audio, files and deleted messages.
• What is stored: none of the content. What was read stays in memory until it is sent or canceled, and the result only while it is on screen. We do not receive this content; processing by the provider is governed by your business’s agreement with that provider.
• Who is responsible: if you use AI for customer service with a cloud provider for chats with customers, your business is the controller of that data under the LGPD and the GDPR, with the legal basis, the duty to inform customers and the choice of what to send, as explained in the Terms of Use.

Customer data in the local archive

If you use the local archive to store customer messages, including deleted ones, you are the controller of that data and are responsible for its processing, as explained in the Terms of Use.

14. Changes to this policy

We may update this policy to reflect changes in the service or the law. The effective date appears at the top of the page. Material changes will be announced by email and on the website before they take effect.

Previous versions of this policy can be requested at [email protected].

15. Contact and Data Protection Officer

Controller: NEXEUS SISTEMAS INTELIGENTES LTDA, CNPJ 58.310.179/0001-63.

Address: Rua Izaurina Braga, 160, Compensa I, Manaus, AM, CEP 69030-000, Brasil.

Data Protection Officer (DPO) and contact for privacy matters: [email protected].