This Policy explains how Perto processes personal data: for what purpose, whose data, which data, on what legal basis, who it is shared with and how long it is kept, in accordance with the LGPD (Brazil’s General Data Protection Law, Law 13,709/2018). Reading this Policy is not giving consent: when consent is the legal basis, it is requested separately and specifically.
1. Who we are
The data controller is Simplifica Gestao Software LTDA, CNPJ (Brazilian company registration number) 39.560.235/0001-73, headquartered at Rua Julio Abreu, 160, sala 1205, Varjota, Fortaleza, CE, CEP 60160-240, which is responsible for Perto (pertozap.com.br). Data Protection Officer (encarregado): privacidade@pertozap.com.br.
2. Who’s who in this Policy
- Account holder: the adult who signs up for and pays for the subscription.
- Legal guardian: a person with legal authority over the child or adolescent.
- Monitored person: the owner of the connected WhatsApp number.
- Authorized recipient: a person invited by the account holder to receive alerts about specific monitored people.
- Interlocutors: people who chat with the monitored person or take part in group chats with them. They have not signed up for Perto.
- Visitors: anyone browsing the site.
All these people are data subjects with respect to the data that relates to them and have the rights in section 12.
3. Processing by purpose
Each processing activity below has its own purpose. The account holder does not authorize all of them alone: some depend on another legal basis or on the authorization of the person concerned.
3.1 Sign-up, billing and tax invoices
- People
- Account holder.
- Data
- Name, email, WhatsApp number, CPF (Brazilian individual taxpayer number), how many numbers are on each plan, subscription and invoice status, card brand and last digits. The full card number stays with Stripe.
- Legal basis
- Performance of a contract (art. 7, V) and compliance with a legal tax obligation (art. 7, II).
- Who receives it
- Stripe, which processes payments, and the provider we hire to issue tax invoices.
- How long
- For the duration of the contract; tax data for the period required by law.
3.2 Account, access and account security
- People
- Account holder, authorized recipients and the monitored person who opens the My monitoring page.
- Data
- Name, WhatsApp number, email, roles and permissions, a record of the access codes sent (the code itself is stored only in encrypted form and for a few minutes), remembered devices and access logs (date, time and IP address).
- Legal basis
- Performance of a contract; compliance with a legal obligation (for access logs, art. 15 of the Marco Civil da Internet, Brazil’s Civil Rights Framework for the Internet); legitimate interest, for account security.
- Who receives it
- Hosting and email delivery providers, which process the data only on Perto’s behalf.
- How long
- Access logs, 6 months; codes, 10 minutes; all other data, while the account exists.
3.3 Connection and collection of messages
- People
- Monitored person and interlocutors.
- Data
- Messages received and sent after the connection, in one-on-one chats and in the monitored group chats (text, audio, image, video, sticker and document), including those later deleted by the sender; WhatsApp identifiers, display names, group chats, dates and times.
- Legal basis
- Child and adolescent: specific and highlighted consent from one of the parents or the legal guardian (art. 14, § 1). Adult: consent of the adult themselves (art. 7, I), declared by the account holder and confirmed by the adult when Perto asks. Interlocutors: see section 4.2.
- Who receives it
- Infrastructure providers that maintain the connection to WhatsApp and store the files, only on Perto’s behalf.
- How long
- 15 days for numbers on Essential and 60 days for numbers on Complete, counted from the receipt of each message.
3.4 Automated risk analysis
- People
- Monitored person and interlocutors.
- Data
- Chat excerpts with phone numbers, CPF numbers, card numbers, passwords and codes replaced by placeholders; audio transcriptions; descriptions and classification of media; reduced-size images, except those that the check on our servers identifies as sexual.
- Legal basis
- The same as in section 3.3. For sensitive data, see section 4.1.
- Who receives it
- Artificial intelligence and audio transcription providers, contracted to process the data only to carry out the analysis, without using it to train their models.
- How long
- The results follow the retention period of the original message. Providers do not keep the data longer than needed to return the analysis.
3.5 Alerts and notifications
- People
- Authorized recipients, the monitored person and interlocutors, mentioned only minimally.
- Data
- Category, priority, confidence level and reason for the alert; in the app, the excerpt that triggered the alert (the messages behind it). The WhatsApp message and the notification email never include any chat excerpt.
- Legal basis
- Performance of the contract and the basis in section 3.3.
- Who receives it
- Authorized recipients, according to each one’s permissions, and the email delivery provider.
- How long
- The alert, without content, for 12 months after it is resolved; the excerpt follows the retention period of the message or of the preserved evidence.
3.6 Summaries
- People
- Monitored person.
- Data
- Counts, the day’s alerts and general topics (only when the profile allows it), without quotes and without interlocutors’ names.
- Legal basis
- Performance of the contract and the basis in section 3.3.
- Who receives it
- Authorized recipients. The artificial intelligence provider receives only this data, already organized.
- How long
- 12 months.
3.7 Viewing and searching chats (Complete plan)
- People
- Monitored person and interlocutors.
- Data
- Chats and media from the period in which viewing is allowed, except sexual content.
- Legal basis
- Child and adolescent: consent of the legal guardian (art. 14, § 1). Adult: consent of the adult themselves, confirmed through the link in the connection notice (art. 7, I).
- Who receives it
- The account holder and the authorized recipients with this permission.
- How long
- The retention period of the number’s plan.
3.8 Preserving and exporting evidence
- People
- Monitored person and interlocutors, including people who may be the source of a risk.
- Data
- Excerpts, dates, descriptions and digital fingerprints (hashes) of files; media that is not sexual content.
- Legal basis
- Regular exercise of rights (art. 7, VI, and art. 11, II, "d") and protection of life and physical safety (art. 7, VII).
- Who receives it
- The account holder, who exports it; authorities, if the family decides to take the case to them.
- How long
- 180 days after the alert is resolved, or up to 2 years if the family asks to preserve the evidence.
3.9 Sexual content that may involve a child or adolescent
- People
- The child or adolescent and the interlocutors.
- Data
- Minimal record: date, chat, media type, file fingerprint and classification. The file is kept isolated in a restricted environment (section 6).
- Legal basis
- Protection of the life and physical safety of the child or adolescent (art. 11, II, "e"), in their best interest (art. 14), and compliance with a legal obligation when there is a duty to report to the authorities (art. 7, II).
- Who receives it
- Never the family or the team. Only the competent authorities.
- How long
- Until the authority confirms receipt; after that, the file is deleted and only the minimal record remains.
3.10 Viewing and change logs
- People
- Account holder, authorized recipients and monitored person.
- Data
- Who opened which content, when and from where; who changed which setting or permission.
- Legal basis
- Legitimate interest, for accountability and abuse prevention (art. 7, IX), and regular exercise of rights (art. 7, VI).
- Who receives it
- The account holder; the monitored person who received the connection notice, as regards access to their own chats.
- How long
- 12 months.
3.11 Acceptances, declarations, authorizations and consents
- People
- Account holder, monitored adults and authorized recipients.
- Data
- Document and version, content fingerprint, server date and time, action, purpose, access method, IP address, and device and browser type.
- Legal basis
- Proof of consent (art. 8, § 2) and regular exercise of rights (art. 7, VI).
- Who receives it
- No one, except authorities or legal proceedings.
- How long
- While the account exists and for another 5 years.
3.12 Misuse prevention, reports and disputes
- People
- Account holder, anyone who files a report or a dispute, and the monitored person.
- Data
- Statements, documents sent to prove a relationship or authorization, account usage data and measures taken.
- Legal basis
- Legitimate interest (art. 7, IX), protection of life (art. 7, VII) and compliance with a legal obligation (art. 7, II).
- Who receives it
- Authorities, when the law requires.
- How long
- 5 years after the case is closed.
3.13 Support
- People
- Anyone who contacts support.
- Data
- Support messages and account data. Never the content of monitored chats, except on request and with express authorization for a specific alert.
- Legal basis
- Performance of a contract (art. 7, V).
- Who receives it
- The contracted customer service tool, only on Perto’s behalf.
- How long
- 2 years after the last contact.
3.14 Service improvement
- People
- Service users, in aggregate.
- Data
- Aggregate metrics (alerts marked as false alarms by type, time to alert, cost) and the reason the family writes when marking a false alarm. No one on the team reads chats for this, and chat content is not used to train artificial intelligence models.
- Legal basis
- Legitimate interest (art. 7, IX).
- Who receives it
- No one.
- How long
- Aggregates, without identification, for as long as they are useful; the written reason, for the alert’s retention period.
3.15 Site measurement and marketing communications
- People
- Site visitors and account holders who choose to receive news.
- Data
- Marketing pixels on the site; email or WhatsApp for news. Never chat data.
- Legal basis
- Separate, optional consent, which can be withdrawn at any time (art. 7, I; sections 13 and 14).
- Who receives it
- The measurement and messaging tools, only after consent.
- How long
- Until consent is withdrawn; measurement data follows each tool’s retention period.
4. Sensitive data, interlocutors, children and adolescents
4.1 Sensitive data
Chats can reveal sensitive data, such as health, sex life, religion, political opinion and racial origin. Perto does not look for or classify these topics, except when they are part of a risk (for example, threats, discrimination or self-harm). When this data appears, processing relies on the specific and highlighted consent of the legal guardian or of the adult themselves (art. 11, I) and, in cases of risk, on the protection of life and physical safety (art. 11, II, "e"). This data is kept for the same short periods and has the same protections as all other data.
4.2 Interlocutors
People who chat with the monitored person have not signed up for Perto, and the account holder cannot authorize the processing of their data alone. Processing relies on the legitimate interest in identifying risks to the monitored person (art. 7, IX), always in the best interest of the child and adolescent (art. 14), with these safeguards:
- we process only what is necessary to identify risks to the monitored person, and we do not build profiles of interlocutors;
- interlocutors’ phone numbers are not sent to the artificial intelligence and are not shown to the family in group chats;
- summaries do not mention interlocutors;
- their data follows the short retention periods and is removed upon deletion;
- interlocutors can exercise their rights by emailing privacidade@pertozap.com.br.
4.3 Children and adolescents
We process children’s and adolescents’ data in their best interest, as art. 14 of the LGPD requires, with specific and highlighted consent from one of the parents or the legal guardian, given when each person is connected. Notifying the child or adolescent through Perto is the legal guardian’s choice. We do not use this data for advertising or to create commercial profiles.
5. Artificial intelligence and automated decisions
We use artificial intelligence models from contracted providers to transcribe audio, read images and documents and analyze the context of chats. We send only what each analysis needs: phone numbers, CPF numbers, card numbers, passwords and codes are replaced by placeholders, and location is not sent. Before anything is sent to providers, images go through a check on our servers, and anything that looks like sexual content is not sent. Providers are contractually bound not to use the data to train their models.
Alerts and summaries are the results of automated processing. They do not decide anything for the family, but they can affect the interests of the monitored person and of interlocutors. Any data subject can request a review of an automated decision (art. 20 of the LGPD) by emailing privacidade@pertozap.com.br. The review is done through a new automatic analysis, with an explanation; a review by a member of the team only happens on request and with express authorization, limited to the alert excerpt, and is logged.
6. Restricted content
- Graphic content (violence, accident, death) arrives covered. On the Complete plan, anyone with access to that number’s chats can open it with a tap, and opening it is logged. On Essential, only the description appears.
- Sexual content is never shown, on any plan. When there is no indication that it involves a child or adolescent, the file is deleted after the analysis.
- Sexual content that may involve a child or adolescent is never made available to the family or the team. The file is kept isolated in a restricted, encrypted environment with no day-to-day access, solely for reporting to the competent authorities, as provided by art. 241-B, § 2 of the Estatuto da Criança e do Adolescente (Brazil’s Child and Adolescent Statute), and is deleted after the authority confirms receipt. Every access to this environment is logged.
7. Sharing and service providers
- With authorized recipients, according to the permissions the account holder gives for each monitored person.
- With providers that process data on our behalf, under contract: payments (Stripe), hosting and database, connection to WhatsApp, file storage, artificial intelligence and audio transcription, email delivery and customer service. The up-to-date list, with the country where each provider processes the data, can be requested from the Data Protection Officer.
- With authorities, when required by law, a court order or the procedure in section 6.
We do not sell data. We do not share chat data with advertisers, schools or other companies.
8. International transfer
Some providers, such as Stripe and the artificial intelligence providers, process data outside Brazil, for example in the United States. In these cases, the transfer follows art. 33 of the LGPD, with contractual clauses that require the provider to ensure protection compatible with Brazilian law.
9. How long we keep data
| Category | What for | Period | Counted from |
|---|---|---|---|
| Messages, including those deleted by the sender | Analysis, alert excerpts and chats | 15 days (Essential) or 60 days (Complete) | Receipt of the message |
| Photos, audio, videos, stickers and documents | The same | 15 or 60 days, depending on the number’s plan | Receipt of the message |
| Transcriptions, descriptions and text read from media | The same | The period of the original message | Receipt of the original message |
| Sexual content with no indication of a child or adolescent | — | Deleted after the analysis | Classification |
| Sexual content that may involve a child or adolescent | Reporting to the authorities (section 6) | Until the authority confirms receipt | Classification |
| Alerts, without the content | History and accountability | 12 months | Resolution of the alert |
| Preserved evidence | Exercise of rights | 180 days, or up to 2 years if the family asks | Resolution of the alert |
| Summaries | History | 12 months | Sending of the summary |
| App access logs | Marco Civil da Internet | 6 months | Date of access |
| Content viewing and change logs | Accountability | 12 months | Date of the log entry |
| Acceptances, declarations and authorizations | Proof | While the account exists and for another 5 years | Closure of the account |
| Access codes | Signing in to the account | 10 minutes; the record of sending, 6 months | Issuance of the code |
| Raw technical connection events | Processing | 7 days | Receipt |
| Tax and billing data | Legal obligation | Period required by law | End of the fiscal year |
| Reports and disputes | Abuse prevention | 5 years | Closing of the case |
| Customer service | Support | 2 years | Last contact |
| Account data after cancellation | In case the account holder comes back | 30 days | End of the paid period |
Providers and backups. Deletion also applies at providers. Backups keep data for up to 35 days after deletion, isolated and unused, until they are overwritten.
Exceptions. We may keep data beyond these periods when there is a legal obligation, a court order, a request from an authority or a need for defense in legal proceedings, only for as long as necessary.
10. Canceling, stopping and deleting
- Canceling the subscription ends billing at the end of the paid period. Data follows the periods above and, after the period ends, is kept for 30 days before deletion.
- Stopping the monitoring of a number stops collection immediately. Data already collected follows the periods above, unless deletion is requested.
- Deleting data erases the data of a number or of the account, at Perto and at providers, within 15 days, with the exceptions above.
The monitored person can end the connection at any time from their own WhatsApp, under Linked devices.
11. Security
We take technical and administrative measures to protect data, including:
- each family’s data kept separate from everyone else’s in every query, checked on the server;
- access through a code sent to WhatsApp, with access logs and new sign-in notices;
- logging of every time chat content is viewed;
- encryption in transit and at rest;
- no team access to chat content in internal tools;
- periodic security testing.
12. Your rights
Under the LGPD, any data subject (account holder, recipient, monitored person or interlocutor) can:
- confirm whether we process their data and access it;
- correct incomplete or incorrect data;
- request anonymization, blocking or deletion;
- request portability;
- know who we share data with;
- withdraw consent, when it is the legal basis;
- request a review of automated decisions.
To exercise your rights, write to privacidade@pertozap.com.br. We may ask for information to confirm your identity. We respond within 15 days. You can also contact the ANPD (Brazil’s National Data Protection Authority). Refusing or withdrawing consent never prevents you from canceling the subscription, contacting support or exercising these rights.
13. Acceptances and records
We record each acceptance, declaration, authorization and consent with: who made it, the monitored person (if any), the document and version, a digital fingerprint of the content, the date and time from our server, the action and purpose, the access method used, the IP address, and the device and browser type. We keep a copy of each version presented. These records do not contain chats, passwords or codes. You can read and download, in your account, the documents you have accepted.
Reading this Policy means being informed, not giving consent. Receiving news from Perto is optional, requested separately and with no pre-checked box.
14. Cookies, pixels and site measurement
We store in your browser only your choice about measurement, so that we do not ask again. With your permission, given in the "Privacy and ads" notice, we use marketing pixels (for example, from social networks and search engines) to measure visits and clicks on the sign-up buttons. Without this permission, no pixel is loaded, and you still have access to the whole site.
You can change your choice at any time under "Privacy preferences", in the site footer.
15. Changes to this Policy
We give advance notice of significant changes by email and WhatsApp, and we keep the version and date at the top of this page. When a change affects processing based on consent, we ask for new consent for that processing. Previous versions are kept and remain available to those who accepted them.
16. Contact and Data Protection Officer
- Data Protection Officer (encarregado): privacidade@pertozap.com.br
- Customer service: contato@pertozap.com.br
- Simplifica Gestao Software LTDA, CNPJ 39.560.235/0001-73, Rua Julio Abreu, 160, sala 1205, Varjota, Fortaleza, CE, CEP 60160-240