Privacy Policy

1. Who we are and who controls the data

Dialoud ("we", "our") is the conversational customer service product operated by G MINARELLO SOLUÇÕES DIGITAIS LTDA, registered under CNPJ 23.125.132/0001-45, with headquarters at Avenida Juscelino K. de Oliveira, 112, Distrito Industrial, Santa Bárbara d'Oeste, São Paulo, Brasil.

• Data Protection Officer (DPO) and privacy: hello@dialoud.com
• Contact: hello@dialoud.com
• Website: https://dialoud.com

When a Dialoud customer (the company that contracts the product) defines the purposes of end-consumer customer service, that customer may act as controller and Dialoud as processor, within the meaning of Articles 5 and 39 of the LGPD. This policy describes processing carried out by Dialoud. The customer must also inform data subjects, where applicable, about the use of messaging channels and AI agents.

2. Scope

This policy applies to:

• Visitors to the Dialoud corporate website.
• Customers, prospects, and authenticated users of the Dialoud platform.
• Individuals who send or receive messages on channels connected to Dialoud, whose conversations are processed by AI agents and/or by the customer's human team.
• Customer representatives who open support tickets with us.

It does not apply to websites, applications, or policies of third-party messaging channel providers, nor to processing those providers carry out as operators of send-and-receive infrastructure. Use of each channel remains subject to the terms and privacy policy of the respective provider.

3. What data we collect

We collect only what is necessary to operate the website, provide the customer service, and comply with legal obligations. The categories below depend on how the service is used.

Data obtained via messaging channels, when a channel is connected:

• Phone number or other conversation identifier, when the channel provides them.
• Profile name, when made available by the channel API.
• Content of messages (text) sent and received.
• Media and attachments, when the user or customer sends them (images, audio, video, documents, and stickers, depending on message type).
• Message metadata: date and time, delivery/read status when available, message identifiers, message type, and reply context.
• Template, interactive button, and flow information, when used in customer service.

Customer service and product data (AI agents and human inbox):

• Conversation history, queue assignment, tags, internal notes, and handoff between AI agent and human agent.
• Dialoud customer account data: name, corporate email, company, agent and connected channel configuration preferences.
• Technical platform usage records (API logs, session identifiers, error diagnostics), for security and operations.

Corporate website data:

• Technical connection data (IP address, date and time, user-agent, pages visited), in server and infrastructure logs, for the time necessary for security and incident investigation.
• Cookies and similar technologies strictly necessary for website operation (for example, session preferences). We do not use third-party advertising cookies on this static corporate website, unless this policy is updated to state otherwise.

We do not request sensitive data (Article 5, II, LGPD) as a matter of business practice. If a data subject voluntarily sends such data in a conversation (for example, health information in a customer service interaction), the content may be processed only to provide that service and should be avoided. We advise customers not to request excessive data through messaging channels.

4. Why we use the data (purposes and legal bases)

We process personal data for the purposes below, with the LGPD legal bases indicated by way of example (Articles 7 and 11):

• Provide the customer service: receive, store, and route messages so that an AI agent and/or a human can respond to the data subject (performance of a contract or preliminary procedures; legitimate interest in the service requested by the data subject).
• Operate Dialoud AI agents: use conversation content, recent context, and customer configuration data to generate automated responses and, when configured, transfer the conversation to a human (performance of contract with the customer; legitimate interest in automating customer service).
• Dialoud customer support, billing, information security, abuse prevention, and compliance with legal obligations (performance of contract; compliance with legal obligation; legitimate interest).
• Communicate changes to this policy or the terms of use (performance of contract; compliance with legal obligation).
• Improve product stability and quality with aggregated or pseudonymized metrics, without using conversation data to train general AI models (legitimate interest, with impact assessment where applicable).

Sending a message to a channel connected to Dialoud generally constitutes a request for customer service. Processing the content is the necessary means to respond.

5. How AI agents process conversations

Dialoud operates a proprietary artificial intelligence agent system that reads the relevant conversation history, instructions configured by the customer (prompt, authorized knowledge base, and tools), and generates a response or action (for example, opening a ticket or transferring to a human agent).

• Content is processed to provide that customer's customer service, on that channel, in that context.
• Individuals authorized by the customer may view the same conversation when there is handoff, supervision, or continuity of service.
• Infrastructure providers and, where applicable, language model providers act as processors/sub-processors, strictly for inference (generating the response) under instructions from Dialoud and the customer, with contractual confidentiality and purpose-limitation measures.

Dialoud does not use conversation data, or data obtained from messaging platforms, to train general, public, or third-party artificial intelligence models. We do not sell personal data. We do not authorize model providers to use the content of those conversations to train their own foundation models, unless an update to this policy and a specific agreement, with additional legal basis and transparency when required, explicitly permit it. At present, such authorization does not exist.

AI-generated responses may contain inaccuracies. They do not replace professional advice when the context requires it (legal, medical, financial, etc.). The customer is responsible for configuring the agent appropriately for its audience and for reviewing high-risk flows.

6. Who we share data with

We do not sell personal data. We share data only with:

• Inbox and human customer service operators, when used for queues, history, and continuity of service, as configured by the customer.
• Messaging channel providers, to the extent necessary to send and receive conversations. Those providers process data under their own policies, as operators of channel infrastructure.
• Infrastructure and hosting: cloud providers, CDN, DNS, transactional email, and monitoring, to the extent necessary to operate the website and product, under data processing agreements where applicable.
• AI model operators (inference), when used to generate agent responses, limited to the purpose of customer service.
• Public authorities, when there is a legal obligation, court order, or valid request.
• Business successors, in the event of corporate reorganization, with the same purpose and equivalent protection.

Dialoud customers (controllers in end-consumer customer service) access conversations from their own operations. Dialoud does not make one customer's content available to another customer.

7. Retention, deletion, and how to request erasure

We retain data for the time necessary for the purposes of this policy, legal retention periods (for example, tax and litigation defense), and legitimate requests from customers who control customer service.

• Customer service conversations (messaging channels, human inbox, and AI agents): as a rule, for the period configured by the customer or, absent specific configuration, for the term of service provision and a reasonable additional period for continuity of service, security audit, and legal obligations, after which they are deleted or anonymized.
• Technical logs from the website and platform: short periods, typically weeks to a few months, unless investigating an incident.
• Dialoud customer registration data: while the account exists and for the legal period after termination.

Data subjects may request deletion of personal data. The step-by-step procedure is at https://dialoud.com/en/data-deletion. In summary: send an email to hello@dialoud.com with a conversation identifier (for example, phone number or profile name), a description of the request, and a contact method. We will confirm identity proportionally (so as not to delete another person's data) and respond within the LGPD deadline, informing you if complete deletion is not possible due to legal obligation or because the Dialoud customer is the controller of that conversation. In that case, we will forward the request or indicate the responsible party.

Dialoud customers may, through the platform itself or support, request deletion of inboxes, contacts, and histories under their account, subject to legal retention requirements.

8. Data subject rights (LGPD)

Under Article 18 of the LGPD, the data subject may request:

• Confirmation of the existence of processing and access to data.
• Correction of incomplete, inaccurate, or outdated data.
• Anonymization, blocking, or erasure of unnecessary, excessive, or unlawfully processed data.
• Portability, subject to ANPD regulation and trade and industrial secrets.
• Erasure of data processed on the basis of consent, when that is the legal basis and no other basis applies.
• Information about public and private entities with whom we share data.
• Information about the possibility of withholding consent and the consequences.
• Withdrawal of consent, when processing is based on consent.
• Review of decisions taken solely on the basis of automated processing, as provided by applicable law, including responses generated exclusively by an AI agent, when this produces legal effects or significantly affects the data subject.
• Opposition to unlawful processing, in cases where consent is not required.

To exercise your rights, write to hello@dialoud.com. You may also file a complaint with Brazil's National Data Protection Authority (ANPD). Requests will be answered without excessive cost, within a reasonable and lawful timeframe, and may be refused only in the cases provided by law, with justification.

9. Children's and adolescents' data

The Dialoud website and product are not directed at children (under 12 years of age) and do not deliberately collect children's data. We do not request minors' data to create accounts.

If a customer uses Dialoud in a context that may involve adolescents or children (for example, school customer service), the customer is responsible for appropriate legal bases, specific and prominent consent from at least one legal guardian when the law requires it (Article 14, LGPD), and for configuring the AI agent in a manner compatible with that audience.

If we become aware that we have collected a child's data in violation of the LGPD, we will delete or anonymize that data, unless legally required to retain it. Please notify us at hello@dialoud.com.

10. International transfers

Dialoud operates with a focus on Brazil. Cloud providers, messaging channel providers, and any language model providers may process data in other countries.

When there is an international transfer, we will adopt one of the grounds under Article 33 of the LGPD, such as a country or organization with an adequate level of protection (when recognized), specific contractual clauses, binding corporate rules, or another safeguard provided by law and ANPD regulation, in addition to proportionate security measures.

11. Information security

We apply technical and administrative measures to protect personal data against unauthorized access, loss, alteration, and improper disclosure, in line with Article 46 of the LGPD. This includes, depending on the service: encryption in transit (TLS), access control, segregation between customer accounts, audit logs, and incident management.

No system is entirely risk-free. In the event of a security incident that may entail relevant risk or harm to data subjects, we will provide the communications required by the LGPD and the ANPD.

12. Cookies and the website

This corporate website is static and uses cookies or local storage only if necessary for operation (for example, technical preferences). Server logs may record IP and user-agent for security.

Your browser allows you to block cookies. If we use them in the future for metrics or marketing, we will update this section and, when required, request consent.

13. Messaging channels and platform data

Dialoud may connect to third-party messaging platforms and request permissions strictly necessary for the product (sending and receiving messages, webhooks, and templates). We use data obtained from those platforms only to operate the customer service and product described in this policy.

• We do not use messaging platform data to train general or third-party AI models.
• We do not sell data obtained from those platforms.
• We do not use platform data for credit, employment, health insurance, or surveillance purposes, in violation of integrated platform policies.
• We comply with connected channel policies, including restrictions on spam, unsolicited messages, and prohibited content.

Each channel provider is independent in the processing it carries out as operator of messaging infrastructure. We recommend reading the privacy policy and terms of the channel used.

14. Changes to this policy

This version takes effect on July 10, 2026. We may update the text to reflect legal, product, or channel changes. The update date will appear at the top of the page. Material changes may be communicated through the website or the customer's registered email.

15. Contact

Questions, data subject requests, and communications to the DPO: hello@dialoud.com. G MINARELLO SOLUÇÕES DIGITAIS LTDA, CNPJ 23.125.132/0001-45, Avenida Juscelino K. de Oliveira, 112, Distrito Industrial, Santa Bárbara d'Oeste, São Paulo, Brasil.