This Policy explains how Qubitx Solutions, the trade name of R DOS SANTOS BRAGA, Brazilian company registration (CNPJ) 34.923.013/0001-54, based in Rio de Janeiro/RJ, Brazil ("Qubitx", "we"), processes personal data of visitors to this website, users of our platform (Qubitx Panel and Qubitx CRM) and contacts served by our clients, including data received from Meta through the official WhatsApp API (WhatsApp Business Platform / Cloud API) and the Instagram API, in accordance with the Brazilian General Data Protection Law (Law No. 13,709/2018 — LGPD).
1. Google user data
Qubitx CRM ("the app") is operated by Qubitx Solutions (R DOS SANTOS BRAGA, CNPJ 34.923.013/0001-54). This section explains how the app accesses, uses, stores, shares and deletes Google user data when a business connects its Google account to the CRM Calendar.
1.1 Data accessed. With the business's authorization, the app accesses only: (a) the email address of the connected Google account (openid, email); (b) the secondary calendars that the app itself creates, one per field technician ("Visitas — technician name"), and the events in them (calendar.app.created); (c) the sharing settings of those same calendars (calendar.acls). The app does not access the account's primary calendar, calendars it did not create, contacts, Gmail or any other Google data.
1.2 How we use it. To create one calendar per technician and add, update or delete in it the visits scheduled in the CRM; to share each technician's calendar, read-only, with the technician's own Google email entered by the business; to read changes made in Google Calendar to those visits, so the CRM stays in sync; to read only the start and end times of other events in those calendars, so no visit is booked over a busy time (titles and descriptions of those events are never read); and to show in the CRM which Google account is connected.
1.3 Storage and protection. We store the connected account email, the Google authorization token (refresh token) encrypted, the identifiers of the calendars and events created by the app, and the technician email each calendar was shared with. Busy times are read on demand and are not stored. Data is protected by encrypted connections (HTTPS), access control by role and by business, and encryption of the token at rest.
1.4 Sharing. Google user data is not sold, not used for advertising, not used to train artificial intelligence models, and not shared with third parties, except: our infrastructure processors (Supabase — database; Hostinger — hosting), solely to run the service; and, when the business enables the scheduling Agent, the free time slots computed from busy times (never event titles or details) are sent to the AI provider configured for the Agent (OpenAI, xAI or Anthropic — see section 5) only to offer available times to the customer in the conversation, under terms that do not allow training on that data.
1.5 Retention and deletion. The business can disconnect Google Calendar at any time in the CRM Calendar: the authorization is revoked at Google immediately and the token is deleted. The calendars created remain in the business's Google account, which may delete them. Access can also be revoked at https://myaccount.google.com/permissions. To request deletion of any stored Google data, email tech@qubitxsolutions.com.br; we delete it within 30 days.
1.6 Limited Use. Qubitx CRM's use and transfer to any other app of information received from Google APIs will adhere to the Google API Services User Data Policy, including the Limited Use requirements.
2. Roles (controller and processor)
Controller: Qubitx is the controller of data from website visitors, people who contact us and platform users, as well as data received from Meta through our app ("Qubitx App").
Processor: regarding the contacts (customers, leads and constituents) served by the businesses that use the platform, Qubitx acts as a processor, processing data on behalf of and according to the instructions of the client business, which is the controller of that data.
3. Data we process
a) Website and sales contact: name, e-mail, phone/WhatsApp and company information you voluntarily provide, and basic browsing data. To know how many people visit the website, which pages and videos are viewed and how many click the WhatsApp button, the website records each visit and click anonymously: no cookies, no stored IP address and no identification of the visitor (we use a code that changes every day and does not allow following the same person across days). These numbers stay with Qubitx only and are not shared with third parties.
b) Platform users: name, e-mail, phone/WhatsApp, access profile and access/security logs (such as two-factor authentication).
c) Data received from Meta (WhatsApp Business Platform):
- WhatsApp Business Account ID (WABA ID) and connected Phone Number ID, phone number, display name, status and quality rating, obtained through Embedded Signup with Facebook Login;
- phone number (WhatsApp ID) and WhatsApp profile name of contacts who message the client businesses;
- message content sent and received: text, images, audio and documents;
- message delivery and read status.
We do not collect name, photo, e-mail or any other personal Facebook profile data. The access token generated during Embedded Signup is used only once, at connection time, and is not stored.
c.1) Data received from Meta (Instagram):
- ID, username (@) and name of the client business's Instagram professional account, obtained when it connects the account with Instagram Login;
- ID, username (@) and name of the profiles that send direct messages to or comment on the client business's posts;
- content of direct messages (text, images, audio and video) and of comments received, and the replies sent by the client business.
The Instagram access token is required to receive and reply to messages while the account is connected: it is stored encrypted, renewed automatically and deleted when the client business disconnects the account.
c.2) Google data (Google Calendar):
When a client business connects its Google account to the CRM Calendar, Qubitx accesses that account's Google Calendar only to: (i) create a separate calendar for each technician ("Visitas — technician name") and add, update or delete in it the visits scheduled in the CRM; (ii) share that calendar, read-only, with the technician's Google email provided by the business; (iii) read changes made in Google Calendar to those visits, to keep the CRM in sync; and (iv) read only the start and end times of other events in those same calendars, so no visit is booked over a busy time. Qubitx does not read the account's primary calendar or calendars it did not create, and does not read titles or descriptions of events not created by the CRM.
We store the connected Google account email, the Google authorization token (refresh token) encrypted, the identifiers of the calendars and events created by the CRM, and the technician email the calendar was shared with. Busy times are read on demand to suggest time slots and are not stored. When the business enables the scheduling Agent, the free time slots computed from those busy times (never the title or details of events) are sent to the Agent's artificial intelligence provider (section 5), solely to offer available times to the customer in the conversation; this data is not used to train models. The business can disconnect Google Calendar at any time from the CRM Calendar: the authorization is revoked at Google immediately and the token is deleted; the calendars created remain in the business's Google account, which may delete them. Access can also be revoked at https://myaccount.google.com/permissions.
Qubitx's use and transfer to any other app of information received from Google APIs will adhere to the Google API Services User Data Policy, including the Limited Use requirements. Google data is not sold, not used for advertising, not used to train artificial intelligence models, and not transferred to third parties, except to the infrastructure processors listed in section 5 and, for the scheduling Agent, the artificial intelligence provider described above, solely to provide the service.
d) Contacts registered by the client: data entered or imported by the client business into the CRM (such as name, phone, e-mail, company and city).
4. How we use data
- to answer contact requests and present our services;
- to provide the contracted service: allowing the client business to receive, send and organize WhatsApp conversations with its contacts in the CRM, track opportunities and send messages and e-mails;
- to automatically transcribe audio messages received via WhatsApp or Instagram into text, through an artificial intelligence provider, when the client business enables this feature;
- when the client business enables these features, to use artificial intelligence providers to: automatically reply to contacts through a service Agent configured by the business, which hands the conversation over to a salesperson when needed; give each opportunity a priority score (Opportunity Scoring); and suggest the reason for a lost sale based on the conversation;
- to send automatic replies configured by the client business when a message or comment contains a keyword;
- to keep the technical visits scheduled in the CRM in sync with the client business's Google Calendar, when it connects its Google account;
- to provide support, keep the platform secure and comply with legal obligations.
Data received from Meta is used only to provide the service to the client business that owns the WhatsApp Business Account or the Instagram account. We do not sell data, do not use it for advertising and do not use it to train artificial intelligence models.
5. Sharing and processors
We do not sell personal data. Data is accessed by the client business responsible for the conversation and shared only with the providers required to operate the platform:
- Supabase Inc. — database and authentication (cloud storage);
- Hostinger International Ltd. — server hosting the platform and media files (Brazil);
- xAI Corp. — automatic audio transcription, service Agent and lost-sale analysis, when enabled (USA);
- OpenAI, L.L.C. — service Agent and opportunity priority score, when enabled (USA);
- Anthropic, PBC — service Agent, when enabled (USA);
- Meta Platforms, Inc. — sending and receiving messages through the official WhatsApp API and the Instagram API;
- Resend — platform e-mails and client newsletters (receives no WhatsApp data).
- Google LLC — Google Calendar, when the client business connects its Google account to the CRM Calendar (USA).
These providers process data only to provide the contracted service, under confidentiality and security obligations. Artificial intelligence providers receive only the part of the conversation needed for each task, through their commercial API, which does not use the data to train models.
Requests from public authorities: we only share data when required by law or by order of a competent authority. Every request undergoes a mandatory review of its legitimacy and legal basis; requests deemed unlawful or excessive are challenged; we disclose only the minimum information necessary to fulfill the request; and we keep a record of each request, including the response given, the legal reasoning and the people involved.
6. International transfers
Some providers process or may access data outside Brazil, mainly in the United States and the European Union (such as Lithuania, for technical support). These transfers are based on Article 33 of the LGPD, with providers that adopt data protection contractual clauses and appropriate security measures.
7. Information security
We adopt technical and organizational measures to protect data: encrypted connections (HTTPS), two-factor authentication for users, access control by role and by client (each business only accesses its own data), signature verification of notifications received from Meta, and access logs.
8. Data retention
Platform data, including WhatsApp conversations and media, is kept for as long as the contract with the client business is in force. After the contract ends or upon request, data is deleted within 30 days, except data we must keep due to legal obligations, for the period required by law. Sales contact data is kept for as long as necessary for the purposes described above.
9. Your rights as a data subject (LGPD)
You have the right to: confirm whether your data is processed; access your data; correct incomplete, inaccurate or outdated data; request anonymization, blocking or deletion of unnecessary data; request portability; be informed about who your data was shared with; withdraw consent; and request deletion of data processed based on consent.
10. How to exercise your rights and delete your data
Send an e-mail to tech@qubitxsolutions.com.br. We will respond within 30 days. If you are a contact of a business that uses our platform, you may send your request directly to that business or to us, and we will forward it to the controlling business. Full instructions, including how to remove our app's access on Facebook, are on the Data Deletion page. To stop receiving marketing messages on WhatsApp, reply asking to unsubscribe (for example, "STOP").
11. Data Protection Officer (DPO)
Qubitx's Data Protection Officer is Felipe Braga, reachable at tech@qubitxsolutions.com.br.
12. Changes to this policy
This policy may be updated to reflect changes in our practices, services or the law. The date of the last update is always shown at the top of this page.
13. Contact
Questions about this Policy or about how your data is processed: tech@qubitxsolutions.com.br. See also our Terms of Use.