Privacy policy
Version 2.0 · Last updated: September 5, 2026
1. Processing roles (controller and processor)
WiseData NPS is a product operated by WiseData Business LTDA, registered under CNPJ 53.182.850/0001-14, headquartered in Goiânia, GO, Brasil. For the purposes of Brazil's General Data Protection Law (LGPD — Law 13,709/2018), WiseData Business holds two distinct roles: (a) it acts as controller of the data of platform users — clients who contract the service, including registration data, access, browsing on www.wisedatanps.com, and platform usage; (b) it acts as processor of the data of contacts imported by users — survey recipients — processing such data exclusively in accordance with user instructions and only to the extent necessary to provide the contracted services. The User is solely responsible for the collection, legality, accuracy, and legitimacy of the personal data of imported contacts, including obtaining consent or an adequate legal basis under the LGPD.
2. Data we collect
We collect: (a) registration data — name, email, phone number, CNPJ/CPF, company name; (b) usage data — access logs, platform actions, surveys created and sent, responses collected; (c) contact data imported by you — names, emails, phone numbers of survey recipients; (d) technical data — IP address, User-Agent, cookies, approximate geolocation, and device data; (e) payment data — processed directly by Stripe; we do not store card numbers; (f) browsing data — pages visited, time on site, traffic source, clicks, conversions, collected by analytics tools and tracking pixels.
3. Purposes of processing
We use your data to: operate and provide the platform; send surveys through contracted channels (Email, WhatsApp, Embed); process payments and issue invoices; provide technical support; analyze sentiment and categorize responses using AI; improve the product based on aggregated and anonymized data; prevent fraud and abuse; comply with legal and regulatory obligations; send marketing communications and newsletters (with consent); measure the effectiveness of advertising campaigns; create audiences for remarketing on advertising platforms. AI-based analysis may involve automated processing of survey comments, but does not involve automated decisions with legal effects or significant impacts on data subjects, under article 20 of the LGPD.
4. Legal bases (LGPD)
We process data based on: (a) contract execution — to provide the contracted services to platform users; (b) consent — for sending marketing communications, newsletters, use of non-essential cookies, and activation of tracking pixels; (c) legitimate interest — for product improvement, fraud prevention, platform security, protection of shared sending reputation, and aggregated usage analysis; in such cases, we balance the legitimate interests of WiseData Business against the rights of data subjects, always adopting adequate safeguards; (d) legal obligation — for tax and regulatory retention. The sending of satisfaction surveys (NPS and its variations) to imported contacts is performed under the User's responsibility, with a legal basis defined by the User, which may include prior consent (opt-in) or legitimate interest, as applicable to their context and duly documented by the User.
6. Marketing communications and email
We may send email communications, including: newsletters with product updates; feature launch campaigns; educational content about NPS and customer experience; onboarding emails for new users; communications about upgrades, promotions, and events. All marketing communications are sent only with prior consent (opt-in). Each email includes an unsubscribe link (opt-out) that is processed immediately. We use Mautic as our marketing automation platform, which records opens, clicks, and interactions to personalize communications. You can revoke your consent at any time via the unsubscribe link or through the public privacy request form.
7. Data sharing
We never sell, rent, or transfer your data to third parties for their own commercial purposes. We share only with the processors below, each limited to the purpose described and bound by a data processing agreement (DPA) or by terms that include data protection clauses in compliance with the LGPD:
Mautic, our marketing automation tool, runs on WiseData's own infrastructure in Brazil: the data it processes is not sent to third parties and does not leave the country.
| Processor | What for | Where it processes |
|---|---|---|
| Twilio SendGrid | Transactional and survey email delivery | United States |
| Meta Platforms | Survey delivery through the WhatsApp Business API and Meta Pixel | United States and Ireland |
| Amazon Web Services (AWS) | Hosting, storage and CDN | United States |
| Stripe, Inc. | Payment processing and subscription management | United States |
| MillionVerifier | Email validation before sending, to protect delivery reputation | European Union |
| OpenAI, L.L.C. | Sentiment analysis and topic categorisation of comments | United States |
| Google LLC | Tag Manager, Analytics and Google Ads | United States |
| LinkedIn Ireland Unlimited Company | Insight Tag, for conversion attribution | Ireland and United States |
| Functional Software, Inc. (Sentry) | Application error and performance monitoring | United States |
| VisitorAPI | Country, region, language and currency from the IP address, to adapt site content | United States |
8. International transfer
Most of the processors listed in the previous section handle data outside Brazil, with the location of each one shown in the table. In those cases the transfer takes place under articles 33 to 36 of the LGPD, with standard contractual clauses and verification that the recipient offers an adequate level of protection. Data is transferred only to the extent necessary for the provision of services.
The exception is our marketing automation tool, which runs on WiseData's own server in Brazil.
9. Data retention
We keep each piece of data for as long as the purpose behind it requires — and the longest period is always the one the law imposes:
Anonymisation is irreversible and technically distinct from deletion: anonymised data loses its link to the data subject and may be retained for statistical purposes and product improvement, under article 12 of the LGPD, but no longer allows identification.
Mind the difference between cancelling and deleting: cancellation opens the 30-day window described above; deleting the account from the dashboard is immediate and irreversible, with its own periods described on the account deletion page.
| Data | Period | Why |
|---|---|---|
| Account, surveys, contacts and responses | While the account is active. After cancellation, 30 days in read-only mode for export and then anonymisation within 1 hour | Performance of contract |
| Tax data (invoices and receipts) | 5 years | Tax legislation |
| Security logs and audit records | 6 months | Incident investigation and article 15 of the Internet Civil Framework |
| Marketing data (opens, clicks, Mautic browsing) | 24 months or until consent is revoked, whichever comes first | Consent |
| Third-party cookies and pixels (Meta, Google, LinkedIn) | As per each platform's retention policy, with the durations listed in the Cookie policy | Consent |
| Account deletion audit trail | 60 days with the email in clear text; after that only the hash, which recognises without identifying | Evidence of compliance and fraud prevention |
10. Your rights (LGPD)
Under the LGPD, you have the right to: confirmation of the existence of processing; access to your data; correction of incomplete or outdated data; anonymization, blocking, or deletion of unnecessary data; data portability to another provider; deletion of data processed based on consent; information about sharing with third parties; revocation of consent at any time, including for marketing and cookies.
11. How to exercise your rights
All requests go through a single public form that issues a tracking number and stays traceable. It is public on purpose: a large share of this product's data subjects are the survey respondents, who never had an account and have no dashboard to log into.
Confirmation of processing and access are answered in simplified form immediately or, as a full statement, within 15 days, under article 19 of the LGPD. Other requests are handled within a reasonable period, and we will tell the data subject if one cannot be met, saying why.
We may ask for additional information to confirm the identity of whoever is asking. That is not distrust: acting on a deletion request from someone who is not the data subject would itself be an incident.
Shortcuts that skip the form: to delete the account, use the option in the platform dashboard; to opt out of marketing, the unsubscribe link in each email; for cookies, the Cookie preferences link in the footer.
12. Security
We adopt technical and organizational measures to protect your data, including: encryption in transit (TLS 1.3) and at rest; role-based access control (RBAC); two-factor authentication (2FA) available; access and anomaly monitoring; audit logs of administrative actions and critical events for incident investigation; regular backups with limited retention; tenant data isolation; email and WhatsApp number validation before sending; brute-force attack protection and rate limiting.
13. Sensitive personal data
The platform is not designed for the processing of sensitive personal data (racial or ethnic origin, religious belief, political opinion, trade union membership or membership in a religious, philosophical, or political organization, health data, sex life, genetic or biometric data). The User undertakes not to collect sensitive personal data via surveys, except when strictly necessary and supported by a specific legal basis under article 11 of the LGPD, and the User is fully responsible for such processing, including obtaining specific and prominent consent when applicable.
14. Embed and public response pages
Public survey response pages (accessed via unique link) and embed widgets installed on User websites may collect technical data from visitors/respondents, including: IP address, User-Agent, device identifiers (fingerprint via third-party library), interaction time, browser language, and basic screen data. Collection has the sole purpose of: preventing duplicate responses, identifying bots and fraud, ensuring response integrity, and protecting the Platform's shared sending reputation. This data is stored in aggregated or pseudonymized form, linked to the invitation or response, and retained for the survey's retention period. The fingerprint is not used for advertising profiling nor shared with third parties for marketing purposes.
15. Children's data
The platform is not intended for individuals under 18 years of age. We do not intentionally collect data from minors. If we identify data from minors, it will be deleted immediately.
16. Do Not Track (DNT)
Browsers may send a Do Not Track (DNT) signal. As there is no single industry standard for interpreting this signal, our measurement and advertising scripts currently do not change their behavior based on it. To prevent these cookies, use your browser settings or the platforms' ad controls, as described in the Cookie policy.
17. Changes to this policy
We may update this policy periodically. Material changes will be communicated by email with at least 30 days' notice. Continued use of the platform after the new version takes effect constitutes acceptance.
17.1. Where the measurement tools are loaded
Measurement and marketing tools are loaded on the website and also inside the authenticated platform. No area of the product escapes the banner: the choice made on the site applies in both places, and revoking it in one revokes it in the other.
Inside the platform they measure navigation — screens opened, usage flow, subscription funnel. They do not receive survey content, nor respondents' answers, nor the contacts imported by the User.
17.2. Security incidents
Should an incident pose a relevant risk to data subjects' rights, we will notify those affected and the ANPD within a reasonable period, under article 48 of the LGPD, stating what happened, which data was affected, what has already been done and what the data subject can do.
When the incident reaches imported contact data, the notice goes to the User who imported it, who is the controller of that data and must inform their own data subjects.
18. Data protection officer
WiseData Business LTDA, headquartered in Goiânia, GO, Brazil, is a small-scale processing agent under ANPD Resolution 2/2022 and is therefore exempt from formally appointing a data protection officer (art. 11, § 1).
As the rule requires (art. 7), we maintain a channel of communication with data subjects — the public request form — and the company's management answers for processing decisions.
19. Marketing communications and WiseData group products
WiseData Business may send, to the registered User, communications related to: (i) the WiseData NPS platform itself — product updates, new features, educational content on customer experience, NPS, CSAT, CES and eNPS, commercial offers, and event invitations; (ii) other products and services of the WiseData Business group — including, without limitation, WiseData Business, WiseData Marketing, WiseData Leads, WiseData Agency, and other brands of the same economic group (cross-sell and cross-promotion). These communications are carried out based on legitimate commercial interest (Art. 7, IX, of the LGPD) and the contractual relationship itself, and may be sent by email, in-app notifications on the authenticated platform, and/or through the WhatsApp number provided at registration. The User may, at any time, adjust or disable their communication preferences in the platform dashboard, use the unsubscribe link present in each email, or request interruption through the public privacy request form.
20. Sharing with group companies and corporate transactions
In addition to the providers listed in section 7, we may share personal data with: (i) other companies of the WiseData Business group for cross-sell, integrated service, and common administrative operations purposes, observing the purposes of this Policy and the applicable legal bases; (ii) public authorities, when required by law, judicial decision, or order of competent authority; (iii) third parties involved in corporate reorganizations (merger, acquisition, restructuring, asset transfer), with preservation of the protections set forth in this Policy and the data subject's rights under the LGPD.