TalksHaaify Talks Privacy Policy
Version 2.1 · October 30, 2026 · Download PDF
Haaify Talks is a messaging and customer-service support app for company teams, provided by HAAIFY SOLUCOES E TECNOLOGIA LTDA, CNPJ 45.890.870/0001-11, headquartered in Belo Horizonte/MG, Brazil ("Haaify"), purchased directly from Haaify or as an extension in the Blip Store. This policy explains which personal data we process, why, with whom we share it, how long we keep it and what your rights are, under the Brazilian General Data Protection Law (Law 13,709/2018 – LGPD).
1. Who is responsible for the data
- Customer Company (controller): the company that purchases Haaify Talks decides who takes part, which integrations are turned on and how the tool is used. It is the controller of its team's data, of the conversations and of the end-customer data that comes from Blip.
- Haaify (processor): stores and processes that data only to provide the service, following the Customer Company's instructions and the Data Processing Agreement (DPA), which is part of the Terms of Use.
- Haaify (controller): only for the Customer Company's own registration and billing data, for feedback sent to Haaify and for the security and access records required by law.
2. Data we process
| Category | Examples | Source |
|---|---|---|
| User profile | Name, nickname, work e-mail, job title, department, mobile number (optional), photo (optional), status | Customer Company or the user |
| Google account photo | Address of the Google profile photo, shown instead of the initials when the user has not uploaded a photo | Google, at sign-in |
| Content | Messages, files, images, audio, polls, reactions, reminders, notes and scheduled messages | Users |
| Access records | Date, time and IP address of each access and sign-in method | Generated by use |
| Usage and security | Access times, features used, read receipts, technical server logs (without message content) | Generated by use |
| Notifications | Technical notification address of each device and where the user wants to be notified | User's browser/device |
| Calendar (optional) | Upcoming events and meetings created, when the user connects Google Calendar, Outlook / Microsoft 365 or a calendar link (.ics) | Google, Microsoft or the link provided by the user |
| Blip data (Service+) | Blip Desk queue and tickets, end-customer name and phone, contact fields, comments, tags, conversation summary, campaign results | Blip, through the keys configured by the Customer Company |
| Customer-service actions | Who transferred, closed, blocked or unblocked a customer, and when | Generated by use |
| Feedback | Name, e-mail, company and the text the user chooses to send to Haaify | User |
| Subscription | Plan, subscription status, person responsible for the purchase | Blip Store or direct agreement |
Haaify Talks is not designed for sensitive personal data (health, religion, biometrics, etc.). If the Customer Company needs to process it, it should instruct its team to send only what is necessary.
3. Why we use it (and the legal basis)
| Purpose | Legal basis (LGPD) |
|---|---|
| Enable communication among people in the same company | Performance of the agreement with the Customer Company (art. 7, V) |
| Show and act on Blip customer service (queues, tickets, customers, blocks, campaigns, alerts) | Performance of the agreement and legitimate interest of the Customer Company (art. 7, V and IX), defined by it as controller |
| Authenticate access (Google account or code by e-mail or WhatsApp) | Performance of the agreement (art. 7, V) |
| Show the calendar and create meetings, when the user connects a calendar | Performance of the agreement (art. 7, V), with the user's authorization in the Google or Microsoft account |
| Send notifications to the devices chosen by the user | Performance of the agreement (art. 7, V) |
| Usage reports for the Customer Company's own administrators | Legitimate interest of the Customer Company (art. 7, IX) |
| Reply to feedback and support requests | Legitimate interest of Haaify (art. 7, IX) and performance of the agreement |
| Billing, subscription management and account notices (free trial, storage, incidents) | Performance of the agreement (art. 7, V) |
| Keeping access records for 6 months | Compliance with a legal obligation (art. 7, II; Internet Civil Framework, art. 15) |
| Security, monitoring and fraud prevention | Legitimate interest (art. 7, IX) |
4. Blip integration
When the Customer Company connects Haaify Talks to Blip by providing the router and service bot keys, the app queries Blip to show the Blip Desk queue, the end-customer profile, saved replies, campaigns and platform status, and to carry out the actions an authorized user requests (transfer, close with tags, comment, block or unblock a customer). The conversation summary shown in the customer profile is generated by Blip itself (Copilot), when available in the Customer Company's Blip agreement; otherwise Talks builds a simple summary, without artificial intelligence. Keys are stored only on the server, never in the browser. End-customer data stays in Blip; Haaify Talks keeps only what the feature needs (for example, the record of who blocked a customer and the card a user chose to share in a conversation).
5. Use of Google and Microsoft data
When signing in with Google, we receive the name, e-mail and profile photo address to confirm identity and show the photo on the profile (the user can change or remove it in My profile; the image is loaded directly from Google's servers). If the user connects a calendar (Google's calendar.events.owned permission, limited to the user's own calendars, or the Outlook / Microsoft 365 calendar, which is not a sign-in method), the app creates the requested meetings and shows upcoming events. We do not store calendar content on our servers, only the meeting card the user shared in a conversation. Use of information received from Google APIs adheres to the Google API Services User Data Policy, including the Limited Use requirements. Authorization can be removed at any time at myaccount.google.com/permissions or in the Microsoft account settings.
If the user provides a calendar link (.ics), the Talks server downloads it to show the events and keeps the copy only in memory, for up to 5 minutes; nothing is written to disk.
6. Cookies and browser storage
- Session cookie (essential): keeps the user securely signed in. It is protected (httpOnly, secure connections only) and no script on the page can read it. Sign-in does not work without it.
- Browser preferences: light/dark theme, language and notices already seen are stored in the user's own browser.
- We do not use advertising or third-party tracking cookies. Haaify Talks public pages do not load third-party fonts or scripts.
7. Who we share data with
We use providers (sub-processors) that process data only under our instructions and with security and confidentiality obligations:
| Provider | Purpose | Location |
|---|---|---|
| DigitalOcean | Hosting of the app, database, files and backups | United States |
| Resend | Sending e-mails: access codes, free-trial and account notices, alerts and incident notices | United States |
| Sign-in, profile photo, Google Calendar and Google Meet (when the user uses them) | Global | |
| Microsoft | Outlook / Microsoft 365 calendar and Teams (when the user connects them) | Global |
| Blip / Take Blip | Customer-service integration (including the Copilot conversation summary), Blip Store subscription and WhatsApp code (when enabled) | Brazil |
| Browser notification services (Apple, Google, Mozilla, Microsoft) | Deliver notifications to the user's device (encrypted content) | Global |
| GIPHY | GIF search (receives only the search term) | United States |
We may also share data when required by law or by order of a competent authority. Extra integrations turned on by the Customer Company itself (for example, Monday or webhooks) receive only the data it configures.
8. International transfer
Some providers are located outside Brazil (mainly in the United States). These transfers follow article 33 of the LGPD and ANPD Resolution CD/ANPD No. 19/2024, with contractual clauses and safeguards that ensure a level of protection compatible with Brazilian law.
9. How long we keep data
- During the agreement: message history is permanent by product design (messages cannot be deleted by users; edits keep the previous version).
- After cancellation: access is suspended and the Master user can download the data in Administration → Export conversations for up to 30 days. Data is deleted within 90 days after cancellation, including from backups at the end of the rotation cycle.
- Access records (date, time and IP): 6 months, as required by the Internet Civil Framework (Law 12,965/2014); then deleted automatically.
- Technical server logs (without message content, e-mails or phone numbers): 30 days.
- Database backups: 30 days.
- Tax and billing data: for the period required by tax law.
10. Security
Encrypted connection (HTTPS), data separated by company, signed and temporary file links, integration keys stored only on the server, protected session cookie, protection against forged requests (CSRF), access profiles (administrator, supervisor and user), 24-hour monitoring with automatic alarms, daily backups with automatic restore checks and logging of customer-service actions. If Talks goes down, we notify the Customer Company administrators within 30 minutes of identifying the problem. In case of a security incident that may cause relevant risk or harm to data subjects, we notify the Customer Company within 24 hours of confirming it, so that it can notify the ANPD and the data subjects, as required by the LGPD.
11. Your rights
You may request: confirmation that we process your data, access, correction, anonymization, blocking or deletion of unnecessary data, portability, information about sharing and withdrawal of consent. Because Haaify acts on behalf of the Customer Company, requests about conversations and your company's data are forwarded to its administrator; we help fulfil them within 15 days.
12. Contact and Data Protection Officer (DPO)
Haaify Data Protection Officer: Daniel Batista Ferreira · daniel.ferreira@haaify.com. Support: suporte@haaify.com · talks.haaify.com/en/support.
13. Changes
This policy may be updated. Relevant changes will be announced in the app in advance. See also the Terms of Use and the Data Processing Agreement (DPA). The Portuguese version prevails in case of discrepancy.
Documents: Terms of UseData Processing Agreement (DPA)Support