Bright Digital AI Privacy Policy

Provisional version, under legal review. Published on 4 October 2026.

Version: 1.0 (provisional)
Effective from: 4 October 2026
Portuguese version: Política de Privacidade. If the two versions differ, the Portuguese version prevails.

1. Who we are

Bright Digital provides Bright Digital AI, a WhatsApp customer service and sales platform with artificial intelligence (AI) assistants and a CRM. Our clients are companies that use the platform to talk to their own customers.

2. Quick summary

• If your company is a Bright Digital AI client, we look after your account, security and billing data. The conversations with your customers belong to your company: we only process them to provide the service, on your instructions.

• If you chatted on WhatsApp with a company that uses Bright Digital AI, that company decides about your data. Contact it first. We help the company handle your request.

• We do not sell personal data. We do not use the conversations of our clients' customers to train AI models or for our own purposes.

• Data is hosted in Brazil, in São Paulo. Some providers, such as the AI providers, are in other countries. The list is in section 8.

• You can ask for access, correction, deletion and other rights. We answer within 15 days (LGPD) or within one month (GDPR).

3. Our role: controller or processor

The law distinguishes whoever decides about data (the controller) from whoever processes it on someone else's behalf (the processor, called operador in the LGPD). Bright Digital has both roles, depending on the data.

Where we are the processor, the client company is the controller. It decides what the data is used for, how long it is kept and how the AI assistant behaves. We follow its instructions under the contract and the data processing agreement (LGPD art. 39; GDPR art. 28).

4. What data we process

4.1 Data for which we are the controller

4.2 Data for which we are the processor (on behalf of the client company)

The client company decides what data it collects from its customers. We do not ask for sensitive data, but an end customer may volunteer sensitive information in a conversation (LGPD art. 11; GDPR art. 9). It is protected like the rest of the conversation and follows the company's rules.

5. Why we use data and on what legal basis

This table covers data for which we are the controller. For data we process as a processor, the legal basis is set by the client company.

Where we rely on legitimate interest, we first assess whether it respects your rights (LGPD art. 10). You can ask for that assessment by writing to the DPO.

6. Artificial intelligence

• What the AI does. When a client company turns on an assistant, the conversation's messages are sent to the AI model chosen by the company to generate the reply. Audio is transcribed to text and images may be analysed to understand the request.

• Who chooses the model. Each company chooses the model for each assistant, from the providers in section 8. The company is told where each model processes data before it chooses.

• No training. We do not use the conversations of our clients' customers to train AI models. We contract the AI providers on terms that do not allow that use.

• Disclosure as AI. Each company configures how its assistant introduces itself: as an AI from the start, only when asked, or without mention. The company is responsible for that choice.

• Automated decisions. The AI helps with customer service and may suggest tags or pipeline stages. Bright Digital does not take decisions with legal effects on you based solely on automated processing. If a client company does so, you may ask it to review the decision (LGPD art. 20; GDPR art. 22).

7. Who we share data with

We do not sell or rent personal data. We share it only:

• with the sub-processors in section 8, to provide the service;
• with the client company, which owns its own conversations and contacts;
• with authorities, when the law or a court order requires it;
• with our accountant, to meet tax obligations (billing data only).

8. Sub-processors and international transfers

8.1 List of sub-processors

This list is kept up to date. Under the contract, we notify client companies before adding a new sub-processor that will process their data. Last updated: 4 October 2026.

Meta's messaging charges are billed by Meta directly to the client company. Bright Digital does not handle that payment.

8.2 International transfers

• From the European Economic Area to Brazil. The European Union has recognised Brazil as providing an adequate level of protection (Commission Implementing Decision (EU) 2026/179, January 2026), and Brazil has recognised the European Union in the same way. European buyers' data can therefore come to our servers in São Paulo without additional clauses (GDPR art. 45).

• From Brazil to other countries, such as the United States, we use the LGPD mechanisms (art. 33), in particular the standard contractual clauses approved by the ANPD.

• Data of people in the European Union sent outside Brazil and the EU: we use the European Commission's standard contractual clauses or another valid mechanism (GDPR art. 46), or the provider's certification under the EU-US Data Privacy Framework where it exists.

You can ask the DPO for a copy of the safeguards we use.

9. How long we keep data

The periods below are the platform's current settings. They are still under legal and accounting review and may be adjusted. Any change will be published on this page.

9.1 During the contract

9.2 When a company closes its account

1. Export. The company receives a full copy of its data, in an open format.

2. Read-only window of 30 days. Staff can still see everything, without changing it, and download the export.

3. Deletion. When the window ends, we delete the conversations, media, contacts, CRM records and the raw Meta archive from the platform. The company's encryption keys are destroyed, which makes any remaining encrypted copy unreadable.

4. Backups. Backup copies expire by rotation within 35 days of the deletion.

5. Certificate. The company receives a deletion certificate, and an addendum when the backups expire.

A company may instruct us in writing to keep its archive longer, for example to meet a legal obligation of its own. In that case we keep it on its behalf and on its instruction.

9.3 What Bright Digital keeps after closure, by legal obligation or for defence

Users of the closed company have their account deleted, unless they belong to another company on the platform.

10. Security

A summary of our measures (LGPD arts. 46 to 49; GDPR art. 32):

• Isolation between companies. Each company sees only its own data. Isolation is enforced in the database as well as in the application, and is tested automatically on every change to the system.

• Encryption. Connections protected by HTTPS. Credentials and sensitive files encrypted with a separate key for each company. Encrypted backups.

• Two-step verification (2FA), mandatory for administrators and available to everyone.

• Audit logs that cannot be altered once written.

• Our staff's access. Only authorised Bright Digital staff can enter a company's account, through time-limited support access with a recorded reason, audited. The company can see that access.

• Private media, served only through temporary links.

• Incidents. If an incident may cause significant risk or harm, we notify the ANPD and the data subjects where the law requires it, and we notify affected client companies without undue delay so they can meet their own obligations.

No system is 100% secure, but we review these measures continuously.

11. Cookies

• Essential cookies. The platform uses cookies needed to log you in, keep your session, remember a trusted device and protect forms against fraud. The platform does not work without them, so they do not require consent.

• Analytics and marketing. We do not use analytics or advertising cookies. If we ever do, we will ask for your consent first, and you can change your choice at any time.

• This website. www.brightdigitalai.com uses no cookies and no tracking tools. It is hosted by Cloudflare, which processes technical connection data, such as your IP address, to deliver the pages securely.

12. Your rights and how to exercise them

12.1 What they are

Under the LGPD (art. 18) and the GDPR (arts. 15 to 22), you may ask for:

• confirmation that we process your data, and access to it;
• correction of incomplete, inaccurate or out-of-date data;
• anonymisation, blocking or deletion of data that is unnecessary or processed unlawfully;
• portability of your data;
• deletion of data processed on the basis of your consent;
• information on who we share data with;
• information on the option not to consent and its consequences;
• withdrawal of consent;
• objection to processing, including processing based on legitimate interest;
• restriction of processing (GDPR);
• review of decisions taken solely by automated processing.

Some data cannot be deleted while the law requires it to be kept (section 9.3). In that case we explain the reason and the period.

12.2 How to exercise them

To protect you, we may ask you to confirm your identity before acting, for example by replying from your account's email address.

12.3 Deadlines

• LGPD: we confirm immediately in simplified form, and send the full answer within 15 days of the request (art. 19).

• GDPR: we answer within one month. For complex requests, this may be extended by two further months, with notice and reasons within the first month (art. 12(3)).

There is no charge.

12.4 Complaints

If you are not satisfied, you can complain to the Brazilian National Data Protection Authority (ANPD) at www.gov.br/anpd. If you are in the European Union, you can also complain to the data protection authority of your country.

13. Children and teenagers

Bright Digital AI is a business service and is not intended for children. Platform accounts are for people aged 18 or over only. We do not knowingly collect children's data. If a client company chats with children or teenagers on WhatsApp, it is responsible for meeting the specific rules for that data (LGPD art. 14; GDPR art. 8). If you learn that we have received a child's data improperly, write to the DPO.

14. Changes to this policy

We may update this policy when the service or the law changes. The version date is at the top of the page. Important changes are announced by email to client companies and on the platform, in advance whenever possible.

15. Contact

• Data Protection Officer: privacidade@brightdigitalai.com
• General contact: contato@brightdigitalai.com
• Data deletion instructions: www.brightdigitalai.com/en/data-deletion

Back to top