1. Who we are and what this policy covers
WiseData Business LTDA, CNPJ 53.182.850/0001-14, headquartered in Goiânia, Brazil, is responsible for WiseData Finances.
This policy covers the website, the web application, the mobile app, the Wisebot assistant and the electronic invoice module. It is written in light of Brazilian Law 13,709/2018 (LGPD), the Brazilian Internet Civil Framework (Law 12,965/2014) and the resolutions of the national data protection authority (ANPD).
2. When we are controller and when we are processor
We are the controller of your account data: registration, authentication, billing, platform usage, support, audience measurement and communications.
We are the processor — and you are the controller — for the third-party data you enter: the recipients of your invoices, contacts linked to entries and the members you invite to a Company. In those cases we process the data solely under the instructions you give through the tool.
The distinction is not a formality: it decides who answers to the data subject. A request about data you entered is forwarded to you rather than decided by us, as article 39 of the LGPD requires.
3. Data we collect
- Registration and account: name, e-mail, phone, password (stored only as a hash), profile picture, language and time zone; for Companies, legal name, CNPJ, address and registrations;
- Financial data you enter: entries, accounts, categories, budgets, goals, investments, attachments (receipts, proofs of payment, logos) and generated reports;
- Tax data in the invoice module: recipient details, description, amounts, tax codes and the A1 digital certificate, when provided;
- Payment: plan, cycle, billing history and subscription status. The card number is handled directly by the payment provider and never passes through or is stored by us;
- Usage and device: IP address, device identifiers, browser, operating system, pages visited, access times and traffic source — campaign parameters and referrer;
- Diagnostics: automatic error and performance reports at the moment of a failure, with technical data about the environment — never the content of your entries;
- Support: the messages you send us through the support chat and the contact channels;
- Wisebot: the questions you ask and the conversation history;
- Acceptance records: date, time, IP address and version of the document accepted, for each acceptance of the Terms and the Policy.
4. Why we use data and on what lawful basis
Every processing operation rests on a lawful basis under article 7 of the LGPD. The table below is the full map:
| Purpose | Data involved | Lawful basis |
|---|---|---|
| Create and maintain the account and provide the subscribed service | Registration, financial data entered, platform usage | Performance of contract (art. 7, V) |
| Charge the subscription and issue tax documents | Registration, plan, billing history | Performance of contract and legal obligation (art. 7, V and II) |
| Issue invoices and transmit them to the municipality | Tax data, recipient details, digital certificate | Performance of contract and legal obligation (art. 7, V and II) |
| Send operational alerts by e-mail and WhatsApp | Registration, phone, due dates | Performance of contract (art. 7, V) |
| Answer your questions in Wisebot | The question asked and excerpts of your financial data | Performance of contract (art. 7, V) |
| Provide support and respond to requests | Registration and message content | Performance of contract (art. 7, V) |
| Maintain security and prevent fraud and abuse | IP, device, access logs | Legitimate interest (art. 7, IX) |
| Monitor application errors and performance | Technical data about the environment at the time of the failure | Legitimate interest (art. 7, IX) |
| Measure audience and campaign performance | Cookies, IP, pages visited, traffic source | Consent (art. 7, I) |
| Display ads and run remarketing | Marketing cookies and advertising identifiers | Consent (art. 7, I) |
| Send WiseData group marketing communications | Name, e-mail and declared interests | Consent (art. 7, I) |
| Comply with legal or tax obligations and court orders | Whatever the rule or decision requires | Legal obligation (art. 7, II) |
| Exercise rights in judicial or administrative proceedings | Acceptance, access and billing records | Regular exercise of rights (art. 7, VI) |
6. Where the measurement tools are loaded
Measurement and marketing tools are loaded on the website and also inside the authenticated platform. No area of the product escapes the banner: the choice you make on the site applies in both places, and revoking it in one revokes it in the other.
Inside the platform these tools measure navigation — screens opened, usage flow, subscription funnel. They do not receive the content of your entries, nor amounts, nor attachments, nor the details of your invoice recipients.
7. Wisebot and artificial intelligence
Wisebot answers questions about your finances over WhatsApp or inside the app, always in read-only mode: it queries the data to answer, never creating, editing or deleting entries.
To produce an answer, strictly necessary excerpts of your data are sent, via API, to our artificial intelligence providers. They process that information only to produce the answer and do not use it to train their models.
Use is optional. If you do not link WhatsApp and do not use the assistant, none of your data reaches those providers. Answers may contain inaccuracies and do not replace checking the original data.
8. Automated decisions
We make no solely automated decisions that significantly affect your interests: there is no credit granting, personal risk scoring or profile classification that determines price or access.
What is automatic is operational — due-date alerts, category suggestions and Wisebot's answers. None of it decides anything for you, and you may request a review of any automated processing under article 20 of the LGPD.
9. Invoice module and digital certificate
The electronic invoice module processes tax data and third-party data you enter, in particular the service recipient: name or legal name, tax number, address and amounts. In that processing your company is the controller; WiseData and the technical issuance provider act as processors.
The A1 digital certificate and its password, when provided, are stored encrypted at rest, in a private object with no public access, under restricted and audited access, and used exclusively to sign and issue your own company's invoices.
Data in this module is processed in Brazil, with no international transfer.
11. Tools running on our own infrastructure
Our support chat (Chatwoot) and our marketing automation tool (Mautic) are hosted on WiseData's own infrastructure in Brazil. The data they process is not sent to third parties and does not leave the country.
Orchestration of WhatsApp notifications also runs on our own infrastructure; what leaves it is only the message delivered by the WhatsApp Business API.
12. International transfers
Some of the processors listed above process data outside Brazil, including in the United States. Those transfers take place under articles 33 to 36 of the LGPD, with appropriate contractual clauses and technical safeguards.
Data from the invoice module, the support chat and marketing automation stays in Brazil.
13. How long we keep data
We keep each piece of data for as long as the purpose behind it requires — and the longest period is always the one the law imposes:
| Data | Period | Why |
|---|---|---|
| Registration, entries, attachments and reports | While the account exists; deleted within 90 days of account deletion | Performance of contract |
| Application access logs | 6 months | Article 15 of the Internet Civil Framework |
| Tax documents and payment records | 5 years | Tax legislation |
| Invoices issued and recipient data | 5 years | Mandatory retention of tax documents |
| A1 digital certificate | While valid or until you remove it | Performance of the invoice module |
| Records of acceptance of the Terms and Policy | Applicable limitation periods | Regular exercise of rights |
| Wisebot conversations | While the account exists | Performance of contract |
| Record of the deletion request itself | 5 years | Evidence of compliance with article 18 |
14. Security
We apply technical and organisational measures proportionate to the risk: encryption in transit (TLS) and at rest, passwords stored only as hashes, two-factor authentication, role-based access control, segregation by account and by company, audit logging and regular backups.
Internal access to data is restricted to what is strictly necessary and is logged. No system is impregnable, but we work continuously to reduce the attack surface.
15. Security incidents
Should an incident pose a relevant risk to your rights, we will notify you and the ANPD within a reasonable period, under article 48 of the LGPD, stating what happened, which data was affected, what has already been done and what you can do.
Keeping your e-mail address up to date is what makes that notice possible.
16. Fraud and abuse prevention
We analyse signs of abusive use — multiple accounts to get around plan limits, registrations with false data, bulk automation and unauthorised access attempts — on the basis of legitimate interest.
That analysis may lead to suspension of the account. It is not credit scoring and is not shared with credit bureaus.
17. Children and adolescents
The Platform is intended for people over 18 and we do not knowingly collect data from minors.
If we identify such data without the specific and prominent consent of a parent or guardian required by article 14, § 1 of the LGPD, we delete it.
18. Browser extension (Chrome)
Our free Chrome extension runs entirely on your device and collects, transmits and shares no personal data: it requires no account, uses no cookies, includes no analytics or advertising tools and sends no information to our servers or to third parties.
The only information stored is your language preference, kept locally in the browser purely to remember your choice. The values you type into the calculators are not recorded by us.
19. WiseData group communications
With your consent, we may use your contact details to tell you about other WiseData group products.
The unsubscribe link is in every message and takes effect immediately. It does not affect transactional communications — billing, security and contractual notices — which are part of the service and cannot be switched off while the account exists.
20. Your rights as a data subject
Article 18 of the LGPD gives you the right to obtain:
- Confirmation that processing exists and access to the data;
- Correction of incomplete, inaccurate or outdated data;
- Anonymisation, blocking or deletion of unnecessary or excessive data, or data processed unlawfully;
- Portability to another provider;
- Deletion of data processed on the basis of consent;
- Information about with whom we share data and about the possibility of refusing consent;
- Withdrawal of consent at any time;
- Objection to processing based on legitimate interest;
- Review of automated decisions, under article 20.
21. How to exercise your rights
All requests go through a single public channel that issues a tracking number and works even for those who have already closed their account and no longer have access to the app:
22. Deadlines, data protection officer and complaints to the ANPD
Deadlines. Confirmation of processing and access are answered in simplified form immediately or, as a full statement, within 15 days, under article 19 of the LGPD. Other requests are handled within a reasonable period, and we will tell you if one cannot be met, saying why.
Officer. WiseData Business is a small-scale processing agent under ANPD Resolution 2/2022 and is therefore exempt from formally appointing a data protection officer (art. 11, § 1). As the rule requires, we maintain a channel of communication with data subjects — the form above — and the company's management answers for processing decisions.
ANPD. You may petition the Brazilian National Data Protection Authority directly at any time. We would rather settle it with you first, but that right does not depend on trying us first.
23. Changes to this policy
We may update this policy. Material changes are announced by e-mail or by notice in the platform before they take effect.
The version and update date sit at the top of this page, and the version published here is always the one that applies.