Privacy

Privacy Policy

Last updated: October 16, 2026. · Versão em português

In short: on the website, we only receive what you send us through the forms, and Meta measurement only runs with your consent. In the NAVSTEC System, we handle conversations and contacts on behalf of the business that hired us, only to provide the service to it. We do not sell personal data. You can ask to see, correct or delete your data at any time.

1. Who we are and who decides about the data

NAVS TECNOLOGIA E CONSULTORIA LTDA, owner of the NAVSTEC brand, Brazilian company registration (CNPJ) 69.476.914/0001-20, Av. Raja Gabaglia, 1617, sala 501, Luxemburgo, Belo Horizonte, Minas Gerais, Brazil, ZIP 30380-435. Privacy contact: [email protected].

• On the navstec.com website, we are the controller: we decide what is done with the data of people who visit and contact us.
• In the NAVSTEC System (app.navstec.com and the “NAVSTEC Sistema” Meta app), the business that subscribes to the system, our client, is the controller of the data of its own contacts and customers. We are the processor: we handle that data on the client’s behalf and follow the client’s instructions (Brazilian General Data Protection Law, LGPD, Law 13,709/2018, art. 5, VI and VII, and art. 39).
• We are also the controller of the data of the people who use the system (login, security, support and billing) and of the conversations people have with NAVSTEC itself.

2. The navstec.com website

2.1 What data we collect

• Meeting request: name, WhatsApp number, e-mail and company (optional), type of business, preferred day, time of day and format, and whatever you write in the message.
• Diagnosis: the type and line of business, what you want to improve, name, WhatsApp number, e-mail and company. The diagnosis calculations run in your browser; we keep a summary of the result to prepare the conversation.
• Visit source: if you arrived through an ad or a tagged link, the campaign name and the click codes in the address (UTM, gclid, gbraid, wbraid, fbclid), the time you arrived, the page you landed on and the address of the site you came from (referrer). This stays in your browser for up to 7 days and reaches us if you send a form. The WhatsApp buttons carry a short random code (e.g. [ref K7Q2MX]) with no data about you; when you tap one, the site sends us that code with the campaign name (UTM), the arrival time and the page and, only if you accepted cookies, the ad click codes, so we know where the conversation came from.
• Technical data: country, the browser identification (user agent) and the screen size. The IP address is not stored with your request: we keep only a code derived from it with a secret key, to block mass submissions. The exception is the notice to Meta (item 2.4): if it does not go through on the first attempt, the IP and the browser are stored with it until it does, for at most 6 days.

2.2 What we use it for

• To answer your request, arrange the meeting, talk about your business and, if it makes sense, prepare a proposal.
• To know which ads and pages bring in contacts.
• To keep the website secure and working.

We do not sell your data and we do not use it for third-party advertising.

2.3 Legal basis (LGPD)

• Meeting request and diagnosis: your consent, given in the form checkbox (art. 7, I, of Law 13,709/2018), and preliminary steps towards a contract, at your request (art. 7, V).
• Security and abuse prevention: legitimate interest (art. 7, IX).

2.4 Cookies and measurement

Without your consent, the website uses no cookies. Your browser’s local storage (which is not a cookie) holds: your cookie choice, until you change it; the visit source and the WhatsApp code (item 2.1), for up to 7 days; the code of the last request sent, for up to 48 hours, so a repeated request is not counted twice; and, if you accepted cookies, the codes of the notices sent to Meta, for up to 7 days, so we can cancel them if you withdraw your consent. Only in the current tab, until you close it: what you typed in the forms (name, WhatsApp number, e-mail and company, so we do not ask twice), the diagnosis summary, the page you landed on and whether the WhatsApp code has already been sent. Anything expired is deleted on the next page you open.

When you arrive, you choose in the cookie notice: “Accept” or, under “Learn more”, “Decline”. Closing the notice with the Esc key does not count as consent. To change your choice later, tap “Cookies” at the bottom of the page.

• If you accept: we load the Meta Pixel, which uses cookies to know whether a visit came from an ad and turned into a contact. When you send a form, our server also sends Meta (Conversions API) a notice that a contact happened, with your name, e-mail, WhatsApp number and country turned into a code (SHA-256 hash), the ad click identifier (fbclid, _fbc cookie), the browser identifier created by the Pixel (_fbp cookie), the IP address and the browser. If the notice does not reach Meta, we keep it for up to 6 days to try again; the IP and the browser are kept only while it is pending. If you withdraw your consent, the notices from this browser that have not been sent yet are cancelled. Meta uses this to measure and improve our ads.
• If you decline: none of this is loaded or sent. The website works the same.

Legal basis for measurement: your consent (art. 7, I, of the LGPD), which you can withdraw at any time through the “Cookies” link.

2.5 Where the data is kept and who we share it with

• Cloudflare: hosts the website and our contact system (Worker and D1 database), where the requests are stored. The request may also go on to the NAVSTEC System (item 3), where we handle our own contacts for the same period as in item 2.6.
• Google (Gmail): we receive an e-mail notice for each request.
• WhatsApp (Meta): if you tap the WhatsApp button, the conversation follows that service’s rules.
• Meta (Pixel and Conversions API): only if you accept cookies, as explained in item 2.4.
• Authorities: when the law requires it.

These services may store data outside Brazil; the transfer follows what the LGPD allows (art. 33).

2.6 How long we keep it

For as long as needed to talk with you. If it becomes a contract, for the period the law requires. If it does not, we delete it within 24 months of your request, or sooner if you ask. Notices to Meta that were not accepted or got no answer are kept for 30 days for checking, without IP or browser. The WhatsApp codes with the visit source (item 2.1) are kept for 30 days.

3. NAVSTEC System

The NAVSTEC System is the CRM and dashboard that businesses subscribe to in order to serve customers and sell. It brings together, on a single screen, WhatsApp, Instagram Direct and Messenger conversations, sign-ups from lead ads (Lead Ads) and website forms, the sales pipeline and ad results. It runs at app.navstec.com and connects to the business’s Meta accounts through the “NAVSTEC Sistema” app, using Facebook Login for Business.

3.1 What data we handle

• From the accounts the business connects: when someone at the business connects Facebook, Instagram or WhatsApp to the system, we receive that person’s name and app-scoped ID, the Pages, Instagram accounts, WhatsApp Business accounts and phone numbers, and ad accounts they selected, and the access tokens Meta issues, which are stored encrypted.
• Conversations: the messages the business’s contacts send and the replies its team sends through WhatsApp, Instagram Direct and Messenger: text, photos, audio, video, documents, reactions, edits, deleted messages and the delivery and read status.
• Contacts and profiles: the profile name, the profile photo when the platform provides it, the phone number, the e-mail and the identifiers each platform gives (on WhatsApp, the phone number or the business-scoped user ID; on Instagram and Messenger, the person’s ID for that account or Page).
• Sign-ups: the answers to Lead Ads forms and to the business’s website forms, with the campaign, ad and form they came from.
• Ad data: spend, reach, clicks and results per campaign and per ad, as aggregated numbers that do not identify people. And, if the business turns it on, the conversion notices the system sends to Meta (Conversions API): the event name and value; e-mail, phone number, country and a contact identifier turned into a code (SHA-256 hash); and the identifiers Meta itself created for the click or the conversation (such as fbc, fbp, the lead ID and the conversation IDs on WhatsApp, Messenger or Instagram). Names, messages and notes are never sent. In health accounts, these notices are off by default.
• What the business’s team records: deals, pipeline stages, amounts, tasks, notes, appointments and tags.
• Health form (medical history): in clinic accounts that use the form, the patient’s answers and signature. This is sensitive personal data (LGPD, art. 11): it stays only in the system, visible to whoever the clinic authorizes, and never goes to ads or to Meta.
• People who use the system: name, e-mail, password (stored only as an irreversible code, Argon2id), the second login step (2FA), sessions, the access log (IP, browser, date and time) and the log of actions taken in the system.

The system uses only the cookie needed to keep the login secure (the session cookie). It uses no advertising or measurement cookies.

3.2 What we use it for

• To provide the service the business subscribed to and configured: receive and answer messages in a single inbox, organize contacts and deals, show the click-to-cash dashboard and, when the business turns it on, send conversion notices to its ad accounts.
• To keep the system secure: login with 2FA, isolation between businesses, access logs and abuse prevention.
• To provide support, only when the account owner approves it, for at most 8 hours at a time.
• To comply with the law, such as keeping access logs for 6 months (Brazilian Internet Civil Framework, Law 12,965/2014, art. 15).
• To manage the contract and billing with the client business.

We do not sell this data, we do not use it in our ads or in anyone else’s, we do not use it to train artificial intelligence, and we do not read the businesses’ conversations, except during support the owner approves or when the law requires it.

3.3 Legal basis

• Data about the businesses’ contacts: the legal basis is chosen by the client business, which is the controller (for example, performance of a contract, legitimate interest or consent, art. 7; and, for the health form, health protection or specific consent, art. 11). We handle this data only on the client’s instructions (art. 39). Children’s data, such as patients, only with the consent of a parent or legal guardian, collected by the business (art. 14).
• Data about people who use the system: performance of the contract with the client business and legitimate interest, to provide the service and keep the system secure (art. 7, V and IX); and compliance with a legal obligation, such as keeping access logs (art. 7, II).

3.4 Who we share it with

• Amazon Web Services (AWS): servers, database and the system’s e-mails, in the São Paulo region, Brazil. The automatic backups are also stored, encrypted, in an AWS region in the United States, to recover the system in case of disaster.
• Meta Platforms (WhatsApp, Instagram, Messenger and Facebook): the channel through which messages come and go and from which sign-ups and ad data come. The relationship with Meta belongs to the client business, which accepts Meta’s and WhatsApp Business’s terms; whatever goes through Meta is also subject to Meta’s privacy policy.
• Cloudflare: the system’s domain name service (DNS) and, on the websites we host, the forms: sign-ups are stored there (Worker and D1 database) and go on to the system.
• Artificial intelligence: today the system uses no AI provider. If an AI feature is offered, it stays off until the business turns it on in its own account; only that account’s data goes to the provider, and the provider is added to this list beforehand.
• Google and TikTok: only if the business turns on those integrations (items 3.8 and 3.9). The relationship is between the business and each of them, and each one also follows its own privacy policy.
• Authorities: when the law or a court order requires it.

Changes to this list are communicated to client businesses before they take effect.

3.5 International transfer

The system’s data is kept in Brazil (AWS, São Paulo). What leaves the country: the encrypted disaster recovery backup (today in an AWS region in the United States) and whatever goes through the platforms the business connects, which operate in several countries: Meta and, if the business turns them on, Google and TikTok. The basis for each transfer (LGPD, art. 33) and what we do when a provider does not offer the ANPD standard clauses are in the Data Processing Agreement, section 8.

3.6 How long we keep it

• Conversations, contacts, deals and forms: while the client business keeps them in the system and the contract lasts. The business can delete them at any time.
• End of the contract: the business has 30 days to export its data; after that, we delete everything within 30 days, and the backups expire on their own at the end of their retention period. Only what the law requires is kept.
• Notices that come from Meta: the original copy of each notice (webhook) is deleted 8 days after it arrives, once processed; the working copy in the system’s queue, 30 days after it is completed.
• Access logs: at least 6 months, as required by the Brazilian Internet Civil Framework.
• Server technical logs: 30 days, with no names, phone numbers, e-mails or messages.
• Data about people who use the system: while the person has access; after that, only the access and action logs, for the periods required by law.

3.7 Data from Meta’s platforms

We use the data we receive from Meta only to provide the service to the business that connected the account, as required by the Meta Platform Terms. We do not sell it, we do not pass it to data brokers and we do not use it for any other purpose. Anyone can remove the “NAVSTEC Sistema” app’s access in their Facebook settings, under Business integrations; the business can also ask us to disconnect a channel at any time.

3.8 Google data (when the business turns on the integration)

These integrations are planned and not yet available. When they exist, they stay off until someone at the client business connects its Google account to the system, on Google’s own authorization screen, and they apply only to that business. For each one, we ask only for what is needed:

• Google Ads (scope https://www.googleapis.com/auth/adwords): send the business’s ad account its conversion notices (for example, “became a customer”), with the click identifier (gclid, gbraid or wbraid), the time, the conversion name and the value; and, only if the business turns on enhanced conversions, the e-mail and phone number as a code (SHA-256 hash). From Google Ads we read only the names and numbers of the accounts and conversion actions, so the business can choose.
• Google Analytics 4 (scope https://www.googleapis.com/auth/analytics.edit): list the business’s properties, so it can choose one, and create the sending key. Conversions are sent through the Measurement Protocol, with the GA4 browser identifier (client_id), the event name and the value. We do not read reports or visitor data.
• Google Calendar (scopes https://www.googleapis.com/auth/calendar.app.created and https://www.googleapis.com/auth/calendar.freebusy): create a “NAVSTEC” calendar in the business’s account and add to it the appointments made in the system (date, time and the title the business chooses); and see only whether other time slots are free or busy, without details, so as not to double-book.
• Google Drive (only the scope https://www.googleapis.com/auth/drive.file): save to the business’s Drive the files it chooses to export, and open the files it picks in Google’s file picker. The system does not see any other Drive files.
• Google account (scopes openid and email): know which account was connected, to show it to the business.

• The access token Google issues is stored encrypted, like Meta’s, and used only for the functions above.
• We do not sell this data, use it in ads (ours or anyone else’s, including retargeting), pass it to data brokers, use it to assess creditworthiness, or use it to create, train or improve artificial intelligence models.
• No one at NAVSTEC reads this data, except with the business’s authorization for a specific support case, for security (for example, to investigate abuse) or when the law requires it.
• The business can turn the integration off in the system at any time, and anyone can remove access on the page of apps with access to their Google Account (myaccount.google.com/permissions). When it is turned off, we delete the access token.

NAVSTEC’s use and transfer of information received from Google APIs will adhere to the Google API Services User Data Policy, including the Limited Use requirements.

The use of information received from Google Workspace scopes (Google Calendar and Google Drive) will adhere to the Google User Data Policy, including the Limited Use requirements, and to the Google Workspace API User Data and Developer Policy.

3.9 TikTok data (when the business turns on the integration)

This integration is also planned and not yet available. When it exists, it stays off until someone at the business connects its TikTok for Business account and authorizes the NAVSTEC app.

• Marketing API: receive the access token (stored encrypted) and the names and numbers of the ad accounts and pixels the business chooses; and, if the business wants to see them in the Dashboard, spend and results per campaign and per ad, as aggregated numbers that do not identify people.
• Events API: send the business’s account its conversion notices: the event name and the value; e-mail, phone number and a contact identifier as a code (SHA-256 hash); and the TikTok click identifier (ttclid), when there is one. Names, messages and notes are never sent. In health accounts, these notices are off by default.
• The same limits as for Google data apply: only for the functions the business turned on, no selling, no third-party ads and no training of artificial intelligence. The business can turn it off at any time, and we delete the access token.

4. How to delete your data

Send “Delete my data” to [email protected] or to our WhatsApp +55 31 97557-1835, with the name and the phone number or e-mail you used. We delete it within 15 days and confirm in writing.

• If you talked to NAVSTEC (through the website, WhatsApp, Instagram, Messenger, Facebook or one of our ads): we delete everything we have about you, except what the law requires us to keep, such as access logs and contract documents.
• If you talked to a business that uses the NAVSTEC System: that business decides about your data. Ask it; or, if you prefer, ask us, and we will forward the request to the business and delete the data when it instructs us to.
• If you connected your Facebook, Instagram or WhatsApp to the system: remove the “NAVSTEC Sistema” app’s access on Facebook, under Settings and privacy, Settings, Business integrations (or ask your business’s administrator to disconnect the channel in the system). Then send “Delete my data” to [email protected]: we delete the access tokens and the data about your account that we received through them.
• If you use the system at a client business: ask the account administrator to remove your access, or write to us. The access log is kept for the period required by law.

5. Your rights

Under the LGPD (art. 18), you can ask for: confirmation and access; correction; anonymization, blocking or deletion of unnecessary data; portability; deletion of data handled with your consent; information about sharing; and withdrawal of consent. Write to [email protected]. For data we handle on behalf of a client business, we forward the request to that business and help it comply. You can also complain to Brazil’s National Data Protection Authority (ANPD), at gov.br/anpd.

6. Security

• Protected connection (HTTPS) on the website and in the system; we ask only for the data we need.
• In the system: data encrypted in the database and in the backups; passwords stored only as an irreversible code; two-step verification (2FA) required for everyone who signs in to client accounts; Meta access tokens encrypted with a key managed in AWS; each business sees only its own data, with the isolation enforced in the database itself; support only with the account owner’s approval; a log of important actions.
• If an incident happens that may cause relevant risk or harm, we notify the client business within 24 hours with what we know, and support the notice to the ANPD and to the people affected. For the data we control, we notify them ourselves, as the law requires.

7. Contact, data protection officer and changes

Contact channel of the data protection officer (LGPD, art. 41) and for any privacy request: [email protected]. We answer within 15 days.

If this policy changes, the date at the top changes too; important changes to the NAVSTEC System are communicated to client businesses before they take effect. This English version is a translation of the Portuguese version; if they differ, the Portuguese version prevails.