dobeo

Legal document — LGPD

Privacy Policy

Last updated: November 1, 2026

This is a translation. In case of any discrepancy, the Portuguese (Brazil) version prevails.

This policy describes how R F A R CARAPETO INFORMATICA (trade name DOBEO), CNPJ 33.766.592/0001-06, headquartered in São Paulo/SP, Brazil (“Dobeo”, “we”), processes personal data in connection with this website and the apps it develops for e-commerce platforms such as Nuvemshop, in accordance with Brazilian Law No. 13,709/2018 (General Data Protection Law, LGPD).

1. Roles

With respect to store data and the data of the store’s end customers accessed by our apps, the merchant is the controller and Dobeo acts as processor, processing the data according to the merchant’s instructions. With respect to the merchant’s own account and contact data, Dobeo is the controller.

2. Data collected

  • Store data: store identifier, name, URL, email and contact details of the person in charge, provided by the platform at installation.
  • Data accessed through the platform’s API: only the scopes authorized at installation, such as products, orders and end-customer data required for the app to work (for example, name, email, phone number and the date/time chosen in a booking).
  • Technical data: access logs (IP address, date and time), kept for 6 months as required by Brazil’s Internet Civil Rights Framework (Marco Civil da Internet).
  • Communications: messages sent to our support.
  • Lead Flow Guard (HighLevel / GoHighLevel): the names and IDs of the agency’s sub-accounts; hourly counts of new leads per lead source and of inbound messages per channel (for example Facebook, Google, WhatsApp, SMS); the connection status of integrations (for example whether a connected Facebook or Google account has expired, and how many phone numbers a sub-account has); the alerts raised from these signals; and the email addresses the agency chooses as alert recipients. The app does not store contact records, message content or phone numbers, and it never emails the agency’s clients.

3. Purposes and legal bases

  • Providing the features of the contracted app (performance of a contract).
  • Billing and compliance with legal and tax obligations (legal obligation).
  • Support, security and fraud prevention (legitimate interest).

We do not sell personal data or use it for third-party advertising.

4. Sharing

Data may be processed by infrastructure providers (cloud hosting) and by the e-commerce platform itself, only to the extent necessary. Lead Flow Guard alert emails are sent to the agency’s chosen recipients through an email delivery provider (Resend). These providers may be located outside Brazil, subject to the safeguards of Article 33 of the LGPD. We may also share data under a court order or where required by law.

5. Retention and deletion

  • Data is kept while the app is installed in the store.
  • When the app is uninstalled, the access token is revoked and the data of the store and its customers is deleted within 30 days, except data we are required to keep by law.
  • Agency Report Card (HighLevel / GoHighLevel): when the app is uninstalled from an agency, HighLevel’s UNINSTALL webhook triggers immediate deletion of the OAuth tokens; the agency’s stored data (sub-account names, aggregate daily metrics, grades, thresholds, alerts and report email address) is permanently deleted 30 days after uninstall, or sooner on request to support@dobeo.com. The app stores aggregate counts only, not contact records.
  • Lead Flow Guard (HighLevel / GoHighLevel): there is no uninstall webhook for this app, so the app treats HighLevel revoking its OAuth tokens as an uninstall, usually detected within 24 hours; the tokens are then deleted immediately and the agency’s stored data (sub-account names, hourly lead and inbound-message counts, integration status, thresholds, alerts and recipient email addresses) is permanently deleted 30 days after uninstall, or sooner on request to support@dobeo.com. While the app is installed, hourly counts are kept for 35 days and closed alerts for 90 days. The app stores aggregate counts only, not contact records or message content.
  • We act on data deletion requests sent by the platform (for example, Nuvemshop’s LGPD webhooks) and by the merchant.

6. Security

We adopt reasonable technical and organizational measures, such as encrypted communication (HTTPS), access control and least-privilege access to data.

7. Data subject rights

Data subjects may request confirmation of processing, access, correction, anonymization, portability, deletion, information about sharing and withdrawal of consent (Article 18 of the LGPD). End customers of a store should preferably contact the merchant (controller); we will assist in handling the request. It is also possible to lodge a complaint with the ANPD (Brazil’s National Data Protection Authority).

8. Data protection officer and contact

Privacy requests: support@dobeo.com.

9. Changes

This policy may be updated; the date at the top indicates the current version.