Privacy Policy

Last updated: October 6, 2026 · VTNA ARTE DESING LTDA · CNPJ 39.408.276/0001-49

This Privacy Policy explains how KLÜR (klur.io), a product operated by VTNA ARTE DESING LTDA, CNPJ 39.408.276/0001-49, Londrina, Paraná, Brazil (“KLÜR”, “we”, “us”), collects, uses, stores, shares and deletes personal data. It applies to our website, our web app, our online stores, and our integrations with Meta products, including Facebook Login for Business, the WhatsApp Business Platform (Cloud API) and WhatsApp Embedded Signup. It complies with the Brazilian General Data Protection Law (LGPD – Law 13.709/2018) and the Meta Platform Terms.

Summary. We only use data to run the service the business asked for: connect its WhatsApp Business number, show and answer its customer conversations, and run its store and catalog. We do not sell personal data, we do not use Meta data for advertising profiles, and anyone can ask us to delete their data at klur.io/legal/data-deletion.

1. Who we are and our roles

KLÜR is a software platform (SaaS) that helps businesses — such as car dealerships and furniture stores — sell online and serve customers on WhatsApp. KLÜR is a Meta Tech Provider: businesses connect their own WhatsApp Business Account to KLÜR through Meta’s official Embedded Signup flow.

Business customers (our clients): for their account data (login, company, billing), KLÜR is the controller.
End users (people who message a business): the business is the controller of its customer conversations; KLÜR acts as operator/processor on the business’s behalf and only follows its instructions.

2. Data we collect

Category	Examples	Source
Account data	Name, email, password (stored hashed), company name, phone, business address	Provided by the business user
Catalog and store data	Products, vehicles, photos, prices, store settings	Provided by the business
Conversation data	WhatsApp messages, media, the sender’s phone number and WhatsApp profile name, timestamps, delivery/read status	Received through the WhatsApp Business Platform
Store visitor data	Pages and products viewed, chat messages on the store, contact data the visitor chooses to send	Provided by the visitor
Technical data	IP address, browser, device, logs, cookies needed for login	Collected automatically

3. Data from Meta (Facebook Login for Business and WhatsApp)

When a business connects WhatsApp through KLÜR, Meta asks it to grant permissions to our app. With the business’s authorization we receive and use:

whatsapp_business_management — to read the business’s WhatsApp Business Account ID, phone number ID, display phone number, verified name, quality rating and message templates, and to subscribe our app to the account’s webhooks. Used only to set up and manage that business’s connection inside KLÜR.
whatsapp_business_messaging — to receive incoming messages through webhooks and send replies on behalf of the business, so the conversations appear in the business’s KLÜR inbox.
business_management (when requested) — to identify the Business Portfolio that owns the WhatsApp account during setup.
Access tokens issued by Meta, stored on our servers outside the public web folder and used only for the business that granted them.
From Facebook Login: the user’s name and email (when granted), used to identify who connected the account.

We use Meta Platform Data only to provide the features the business requested. We do not sell it, license it, use it to build advertising or marketing profiles, share it with data brokers, or use it to discriminate against anyone. Businesses using KLÜR must also follow the WhatsApp Business Policy and the WhatsApp Business Terms.

4. How we use data (and legal bases)

Provide the service: inbox, replies, catalog, store, scheduling, order and lead tracking — performance of contract (LGPD art. 7, V).
Connect and maintain the WhatsApp integration — performance of contract.
Account security, fraud prevention and logs — legitimate interest and legal obligation (Marco Civil da Internet, Law 12.965/2014).
Support and service messages to our business clients — performance of contract.
Marketing to business clients only with consent, which can be withdrawn at any time.

We do not send unsolicited messages to end users. Messages to end users are sent by the business, within WhatsApp rules (24-hour customer service window or approved templates with opt-in).

5. AI-assisted features

A business can turn on an AI assistant that suggests or sends replies, searches its catalog and creates product images. To do that, the text of the conversation and catalog data may be processed by AI model providers acting as our sub-processors. They process the data only to return the answer, under contracts that forbid using it for their own purposes. The business can turn the assistant off and take over any conversation at any time.

We share personal data only when needed to run the service:

Meta Platforms (WhatsApp Business Platform) — to send and receive messages.
Cloud hosting and infrastructure providers — servers, storage, backups and email delivery.
AI model providers — only when the business uses AI-assisted features (section 5).
Payment providers — when the business sells online or pays for KLÜR plans.
Authorities — when required by law or court order.

We never sell or rent personal data.

7. International transfers

Some providers (including Meta and AI providers) may process data outside Brazil. When this happens we rely on the safeguards allowed by LGPD art. 33, such as contractual clauses and providers with adequate protection.

8. Retention

Account, catalog and conversation data: while the business account is active.
After the account is closed or a deletion request is confirmed: deleted or anonymized within 30 days, except backups, which are overwritten within 90 days.
Access logs: 6 months, as required by the Marco Civil da Internet.
Meta access tokens: deleted as soon as the business disconnects WhatsApp or removes our app.

9. Security

We use HTTPS/TLS on every page and API, hashed passwords, access tokens stored outside the public web folder, restricted server access, per-business data separation and continuous monitoring. Only authorized staff can access data, and only to provide support.

10. Your rights (LGPD)

You can ask us to: confirm whether we process your data; access it; correct it; anonymize, block or delete it; port it; know who we share it with; and withdraw consent. Send your request to privacidade@klur.io. We answer within 15 days. If you are a customer of a business that uses KLÜR, you can also contact that business directly. You may also file a complaint with the Brazilian Data Protection Authority (ANPD).

11. How to delete your data

See the step-by-step instructions at klur.io/legal/data-deletion. In short: email privacidade@klur.io with the subject “Delete my data”, or remove the app in your Facebook settings — we delete the related data within 30 days.

12. Cookies

We use essential cookies to keep you logged in and to keep the store cart working. Stores may also use analytics cookies (such as Meta Pixel) when the business turns them on. You can block cookies in your browser; essential features may stop working.

13. Children

KLÜR is a business tool and is not directed to children under 18. We do not knowingly collect children’s data.

14. Changes

We may update this policy. The date at the top always shows the latest version, and important changes are announced to business clients by email or inside the app.

15. Contact / Data Protection Officer

VTNA ARTE DESING LTDA — CNPJ 39.408.276/0001-49 — Londrina, Paraná, Brazil.
Email: privacidade@klur.io · Website: klur.io