This Privacy Policy explains how CHAVE MESTRA GESTAO LTDA, the provider of CloudWhats for Bitrix24 (“CloudWhats”, “we”, “us”), processes personal data when an organization installs and uses the Application. It applies specifically to the Bitrix24 integration and supplements any CloudWhats service agreement agreed with the customer.
1. Roles
The customer organization generally determines why and how its CRM contacts, users, and message data are processed and acts as controller or business. CloudWhats generally acts as processor or service provider for that data. CloudWhats may act as controller for developer-account records, billing, security, fraud prevention, legal compliance, and direct support communications.
2. Data we process
- Bitrix24 installation data: account domain, application identifiers, installation state, OAuth access and refresh tokens, token expiration, and granted permissions.
- CloudWhats account data: organization, authorized users, account identifiers, selected WhatsApp credential, plan and entitlement information.
- CRM and messaging data: contact identifiers, names, phone numbers, CRM entity identifiers, message content, approved template names and parameters, delivery status, replies, and timeline references needed for the requested workflow.
- Technical and support data: timestamps, request and response metadata, error details, audit events, IP address and user-agent where recorded, and information submitted to support.
We do not request a user’s Bitrix24 password. Authentication uses the authorization mechanism and tokens supplied by Bitrix24.
3. Purposes
- Install, authenticate, link, configure, and operate the integration.
- Send authorized WhatsApp messages and synchronize supported status and reply events.
- Prevent duplicate processing, maintain audit records, troubleshoot failures, and provide support.
- Protect accounts, detect abuse, enforce service terms, and comply with legal obligations.
- Maintain and improve reliability using aggregated or appropriately minimized operational information.
4. Legal bases
Depending on the context and applicable law, processing is based on performance of a contract, legitimate interests in providing and securing the service, compliance with legal obligations, consent where required, and the customer’s documented instructions. Customers are responsible for determining a valid legal basis for contacts and messages they initiate.
5. Sharing and subprocessors
Data is disclosed only as needed to provide the service, including to Bitrix24, Meta/WhatsApp, infrastructure and database hosting providers, communications providers, monitoring and security providers, and professional advisers under appropriate duties. We may disclose data when required by law or to protect rights and security. We do not sell personal data.
6. International transfers
Because the integration uses global cloud and messaging providers, data may be processed outside the country where it was collected. Where required, CloudWhats uses contractual, organizational, or other legally recognized safeguards for international transfers.
7. Retention
We retain personal data only for as long as necessary for the purposes above, the customer’s active service, security and audit needs, dispute resolution, and legal obligations. OAuth credentials are deleted or invalidated when the integration is disconnected where technically possible. Operational logs are retained according to security and service requirements and are then deleted or de-identified. Customer content retention may be governed by the CloudWhats plan and service agreement.
8. Security
We use administrative, technical, and organizational safeguards designed to protect data, including access controls, tenant separation, encrypted transport, credential protection, request validation, audit logging, and incident response procedures. No system can guarantee absolute security.
9. Your choices and rights
Depending on applicable law, individuals may request access, correction, deletion, restriction, portability, information about sharing, or objection to certain processing. CRM contacts should normally contact the customer organization that controls their data. CloudWhats customers and developer-account users may contact us directly. We may need to verify identity and may preserve information when legally required.
10. Disconnecting the Application
A Bitrix24 administrator may uninstall the Application, and a CloudWhats administrator may disconnect the connector. Disconnecting stops new integration requests but does not automatically remove records that the customer must retain in Bitrix24, CloudWhats, or WhatsApp under its own instructions and legal obligations.
11. Children
The Application is a business service and is not directed to children. Customers must not use it to process children’s data without a valid legal basis and all safeguards required by applicable law.
12. Changes
We may update this Policy to reflect changes in the Application, law, or provider requirements. The current version will be available at this URL with the date of the latest update.
13. Company and contact
CHAVE MESTRA GESTAO LTDA
Brazilian company registration (CNPJ): 41.104.884/0001-01
Avenida Dr. Bruno Cassel, 830, Apt. 101, Vila Rica
São Sebastião do Caí, RS, 95760-000, Brazil
Administrative email: [email protected]
Telephone: +55 51 9774-8001
Privacy and data-protection questions may be sent to [email protected]. Product support is available through the CloudWhats for Bitrix24 support page.