FlipDesk Privacy Policy

Introduction and definitions

Conceptual foundation of the document and institutional commitment to privacy.

FlipDesk ("we", "our", or "company"), a private legal entity, is committed to protecting the privacy and personal data of its users ("you", "your", or "data subject"). This Privacy Policy was prepared in compliance with the General Personal Data Protection Law (Law No. 13,709/2018 - "LGPD"), the Internet Civil Framework (Law No. 12,965/2014), and other applicable regulations.

Legal bases

Legal bases supporting the processing of personal data carried out by FlipDesk.

The processing of personal data carried out by FlipDesk is based on the following legal grounds set forth in the LGPD:

• Data subject's consent (Art. 7, I)
• Compliance with a legal or regulatory obligation (Art. 7, II)
• Execution of a contract (Art. 7, V)
• Legitimate interest (Art. 7, IX)
• Credit protection (Art. 7, X)

Personal data collected

Distinction between directly provided information and automatically captured data.

3.1. Directly provided data

• Full name
• CPF/CNPJ (tax ID)
• Full address
• Email
• Phone number
• Banking and payment details
• Company data (when applicable)

3.2. Automatically collected data

• IP address
• Device information
• Cookies and similar technologies
• Platform usage data
• Access logs

Processing purposes

Core and complementary objectives for the use of personal information.

4.1. Main purposes

• Provision of contracted services
• Payment processing
• Customer support
• Compliance with legal and regulatory obligations
• Regular exercise of rights in contracts and proceedings

4.2. Other purposes

• Improvement of our services
• Statistical analysis
• Marketing and promotional communications (with consent)
• Fraud prevention

Data sharing

Scenarios in which information may be shared with third parties and associated contractual safeguards.

Your data may be shared with:

• Essential service providers (payment processing, hosting, etc.)
• Public authorities or official bodies
• Commercial partners (with your consent)
• Companies within the same economic group

All sharing is performed under contracts that ensure the confidentiality and security of the data.

Data obtained through Google APIs

Data accessed when you connect a Google account and the usage limits that apply.

When you connect a Google account to FlipDesk, the platform accesses only the data required for the features below, always after explicit consent and only while the connection is active:

• Gmail read access (gmail.readonly): messages received in the connected account's inbox, so that customer emails become conversations handled by your team inside FlipDesk.
• Gmail send access (gmail.send): sending the replies written by agents in FlipDesk, within the same thread as the original email.
• Google Calendar (calendar.events): creating, updating and cancelling meetings, tasks and events scheduled from a conversation or an automation.
• Google Sheets (spreadsheets): reading, inserting and updating rows in the spreadsheets whose URL you provided in an automation block. FlipDesk does not request Google Drive access and does not list, browse or open files you have not provided.

FlipDesk's use and transfer to any other app of information received from Google APIs will adhere to the Google API Services User Data Policy, including the Limited Use requirements.

Specifically, FlipDesk:

• does not sell this data;
• does not use it for advertising, profiling or any purpose unrelated to the features above;
• does not transfer it to third parties, except to providers strictly necessary to operate the service (hosting and infrastructure), under contract, to comply with a legal obligation, or with your consent;
• does not use it to train, improve or personalise generalised AI models;
• does not allow humans to read this data, except with your explicit consent, for security investigations, to comply with a legal obligation, or when aggregated and anonymised.

You can disconnect the Google account at any time under Settings › Integrations, which removes the stored credentials, or revoke access directly at myaccount.google.com/permissions.

International transfer

Rules applied when data needs to be processed outside Brazil.

Some data may be transferred to other countries, always observing the legal requirements of the LGPD and ensuring adequate security and protection through:

• Specific contractual clauses
• Global corporate rules
• Recognized certifications
• Countries with an adequate level of data protection

Data security

Technical and organizational measures adopted to reduce risks and protect information.

We implement appropriate technical and organizational measures, including:

• Encryption of sensitive data
• Strict access controls
• Continuous monitoring
• Employee training
• Regular backup policy
• Incident response plan

Data subject rights

Rights guaranteed to the data subject under the General Data Protection Law.

Under the LGPD, you have the right to:

• Confirmation of the existence of processing
• Access to data
• Correction of incomplete or outdated data
• Anonymization, blocking, or deletion of unnecessary data
• Data portability
• Deletion of data processed with consent
• Information about sharing
• Revocation of consent

Data retention

Criteria adopted for maintaining personal information for as long as necessary.

We retain your personal data for as long as necessary to:

• Fulfill the purposes for which they were collected
• Meet legal and regulatory obligations
• Exercise rights in judicial or administrative proceedings

Data Protection Officer (DPO)

Primary channel for exercising rights and clarifying questions about data processing.

To exercise your rights or ask questions, contact us at:

• Email: comercial@flipdesk.com.br
• Phone: (48) 98836-3228
• Address: Avenida Prefeito Osmar Cunha, 416 - Room 1108 - Centro, Florianópolis/SC

Policy changes

Future updates may occur and will be communicated through appropriate channels.

This policy may be updated periodically. We will notify you about significant changes through our website or email.

Continued use of our services after changes constitutes acceptance of the updated policy.