Legal
Privacy Policy
1. Who we are
Rabbit Tecnologia e Web3 LTDA, registered under CNPJ 47.544.516/0001-60 and doing business as Rbbt Lab, is a technology provider that develops and operates a platform of customer-service and sales agents integrated with messaging channels, including the WhatsApp Business Platform and Instagram.
This policy describes how we process personal data both regarding our business customers and regarding the consumers who interact with those customers through the channels we operate.
The platform also integrates with e-commerce platforms such as Shopify and Nuvemshop, to look up the store's catalog, build carts and tell consumers the status of their own orders (see section 3.3).
Contact: meta@rbbtlab.ai
Data Protection Officer (DPO): Thiago Freire —
meta@rbbtlab.ai
Address: Rua Aspicuelta, 422, Sala 31B — Parte, Vila Madalena,
São Paulo/SP, Brazil, ZIP 05433-010
2. Our role: processor and controller
The distinction below is essential to understand your rights:
- When we act as Processor: when processing conversations between a consumer and one of our business customers, we act on behalf of and under the instructions of that customer, who is the Controller of the data. The customer defines the purposes of the processing. If you are a consumer and wish to exercise rights over this data, your request will be forwarded to the corresponding Controller.
- When we act as Controller: regarding the registration and usage data of our own business customers and of visitors to our website, we are the Controller.
3. Data we process
3.1 Consumer data in messaging channels
| Data | Source | Purpose |
|---|---|---|
| Phone number | WhatsApp Business Platform (Meta) | Identify the conversation and route replies to the right recipient |
| Public profile name | WhatsApp Business Platform (Meta) | Personalize the service |
| Message content (text, image, audio, document) | Sent by the consumer | Process the request, generate a reply and keep the conversation history so the service can continue |
| Message metadata (date, time, delivery and read status) | WhatsApp Business Platform (Meta) | Channel operation, technical diagnostics and service metrics |
We do not deliberately collect, request or store sensitive personal data as defined in art. 5, II of Brazil's General Data Protection Law (LGPD). If a consumer spontaneously sends such information in a message, it is processed solely to answer the request and is subject to the same retention periods described in section 6.
3.2 Business customer data
Company name, CNPJ, address, contact details of authorized users, platform access credentials and identifiers of the connected accounts (WhatsApp Business Account and phone numbers).
3.3 Order data from connected stores
When a business customer connects its store to the platform — for example, through our apps for Shopify and Nuvemshop — we process, as Processor and on behalf of that customer, the following data from the store's orders:
| Data | Source | Purpose |
|---|---|---|
| Order number, date, status, items and amounts; payment and shipping status; carrier and tracking code | The store's e-commerce platform | Record the sales closed from conversations and answer consumers about their own orders |
| E-mail provided at checkout | The store's e-commerce platform | Solely to verify, on our servers, that the order being looked up belongs to the person who identified it in the conversation (e-mail and order number) |
| Landing page and referrer of the visit, the order's note and attributes (with the buyer's contact details removed) and a cryptographic hash of the buyer's e-mail and phone number | Payment, cancellation and refund notices sent by the e-commerce platform | Relate the payment to the conversation that originated it |
The order's e-mail serves only that verification: it is not stored, does not appear in replies and is not used for contact or marketing. When the e-commerce platform returns other buyer data along with the order — such as address, phone number or documents — it is discarded as it is read, without being stored.
Order data is not used for marketing, profiling, advertising or training artificial intelligence models, and is neither sold nor transferred to third parties.
3.4 AI agents connected by the customer (RBBT Lab)
A user of a business customer can connect their own AI assistant — such as Claude, by Anthropic, or ChatGPT, by OpenAI — to a brand on the platform, through the RBBT Lab connector. The connection exists only after the user signs in to their own account and authorizes, on the consent screen, the brand and the access (read; operate; configure). From then on:
- the assistant reads the brand data the user's role allows — conversations as they are, including what the consumer wrote, the label the brand uses for each conversation (name or phone number), metrics and configuration — and that data reaches the assistant's provider, which processes it under its own terms; the brand's credentials and secrets are never sent;
- the business customer is the controller of that data and chooses the provider;
- every call is recorded in the user's name, with the assistant's name, without keeping the returned content;
- the assistant sends no messages to consumers and makes no payments;
- the connection lasts up to 45 days and can be revoked at any time under Account → Connected agents; a brand administrator can turn external agents off for the whole brand.
4. Legal bases
| Purpose | Legal basis (LGPD) |
|---|---|
| Provide the service requested by the consumer | Art. 7, V — performance of a contract or preliminary procedures |
| Provide the service contracted by the business customer | Art. 7, V — performance of a contract |
| Sending marketing messages | Art. 7, I — consent of the data subject, collected and recorded by the business customer |
| Information security, fraud prevention and auditing | Art. 7, IX — legitimate interest |
| Compliance with legal and regulatory obligations | Art. 7, II — legal obligation |
Promotional messages are only sent upon explicit opt-in. The consumer can withdraw
consent at any time by replying SAIR (stop) in the conversation or through the contact
in section 8.
5. Sharing and sub-processors
We only share data with:
- Meta Platforms, Inc. — operator of the WhatsApp Business Platform, through which messages necessarily travel. Meta's processing is governed by the platform's own terms and policies.
- Cloud infrastructure provider — Hostinger International Ltd., on virtual private servers located in Brazil, for hosting and storage.
- Artificial intelligence model providers — Anthropic PBC and OpenAI, L.L.C., used to interpret messages and generate replies. See section 9.
- The store's e-commerce platforms (for example, Shopify and Nuvemshop), from which we read the data described in section 3.3 on behalf of the business customer, and to which we send only what is needed to build the cart and the payment link: the items and, when the platform requires it, the buyer's name and e-mail.
- The business customer receiving the conversation, who is the Controller of the data.
- Public authorities, upon a valid legal request.
We do not sell personal data and do not transfer it for third-party advertising.
5.1 International transfer
Data is primarily stored in Brazil, on Hostinger infrastructure.
There is, however, an international transfer in one specific case: message content is sent to the artificial intelligence model providers (Anthropic PBC and OpenAI, L.L.C.), whose processing takes place in the United States. This transfer is necessary to perform the contract and is based on art. 33 of the LGPD, supported by the data protection contractual clauses signed with these providers, which ensure a level of protection compatible with Brazilian law.
6. Retention
| Category | Period |
|---|---|
| Conversation content and metadata | While the contract with the business customer responsible for the channel is in force, or until the data subject or the Controller requests deletion |
| Payment, cancellation and refund records of orders from connected stores (the buyer's contact only as a hash) | While the contract with the business customer is in force, or until the data subject, the Controller or the e-commerce platform requests deletion, except where a legal retention obligation applies |
| Business customer registration data | While the contract is in force and for 5 years after it ends |
| Application access logs | 6 months, under art. 15 of Brazil's Internet Civil Framework (Marco Civil da Internet) |
| Documents subject to tax obligations | 5 years, under applicable law |
Once the relationship with a business customer ends, the data in our custody related to that customer is deleted or returned within 90 days, unless a legal retention obligation applies.
7. Security
- Encryption in transit (TLS) for all communications
- Encryption at rest in the databases
- Identity-based access control, with least privilege and two-factor authentication
- Logical segregation of each business customer's data
- Audit logging of administrative access
In the event of a security incident posing relevant risk to data subjects, we will notify the ANPD (Brazil's Data Protection Authority) and the affected data subjects within the periods set by art. 48 of the LGPD.
8. Your rights and data deletion
Under art. 18 of the LGPD, you may request:
- Confirmation that processing takes place
- Access to the data
- Correction of incomplete, inaccurate or outdated data
- Anonymization, blocking or deletion of unnecessary data or data processed in non-compliance
- Portability
- Information about sharing
- Withdrawal of consent
8.1 How to request deletion of your data
Send an e-mail to meta@rbbtlab.ai with the subject "Exclusão de dados" (data deletion), stating the phone number used in the conversation. We will confirm receipt and reply within 15 days.
If the data is under the control of one of our business customers, we will forward the request to the Controller and inform you of the forwarding.
8.2 Stores connected through e-commerce apps
We also receive and record the data access and deletion requests that the e-commerce platforms
themselves send us on behalf of consumers and stores (for example, Shopify's
customers/data_request, customers/redact and shop/redact
notices), and we fulfill them within the periods those platforms set. When one of our apps is
uninstalled, we stop accessing the store immediately.
9. Use of artificial intelligence
Our platform uses language models to interpret incoming messages and generate automated replies. About this processing:
- Message content is sent to Anthropic PBC and OpenAI, L.L.C. solely to generate the reply to that interaction.
- To answer about an order, we send the model only that order's status, dates, items, amounts and tracking — never the e-mail on the order or any other buyer contact details coming from the store.
- Conversation content is not used to train models. We use these companies through their enterprise APIs, whose terms prohibit using the submitted data for training.
- These providers may retain the transmitted content for up to 30 days for abuse monitoring, under their own terms, after which they delete it.
- There is no automated decision with legal effect or significant impact on data subjects. Consumers can ask for human service at any time.
10. Children and adolescents
Our services are intended for people over 18 and are not directed at children or adolescents. We do not knowingly collect data from minors. If such processing is identified without the specific and prominent consent required by art. 14 of the LGPD, the data is deleted.
11. Changes
This policy may be updated. The date of the last revision is shown at the top of the document. Material changes will be communicated to business customers with reasonable notice.
12. Contact
Rabbit Tecnologia e Web3 LTDA
CNPJ 47.544.516/0001-60
Rua Aspicuelta, 422, Sala 31B — Parte, Vila Madalena, São Paulo/SP, Brazil, ZIP 05433-010
E-mail: meta@rbbtlab.ai
Data Protection Officer (DPO): Thiago Freire
You may also petition Brazil's National Data Protection Authority (ANPD) at gov.br/anpd.