Privacy Policy

Your account data (sign-up, billing, website usage): Hasos is the controller.

Data of the people you talk to through Hasos (phone numbers, recordings, transcripts, call history and leads): the customer is the controller and Hasos acts as a processor, processing this data only to provide the service, according to the customer’s instructions. Requests from data subjects about this data should be directed to the customer; when we receive them, we will forward them.

• Sign-up: name, business email, password (stored hashed, never in plain text), company name, contact WhatsApp number and details of the users you invite.
• Billing: plan, amounts and payment status. Card details are collected and stored by Stripe; Hasos only sees the card brand, last 4 digits and expiration date.
• WhatsApp session: the linked-device keys required to keep your number connected.
• Calls: originating and destination numbers, date, duration, status, assigned rep and, where applicable, audio recordings.
• AI Pack (optional): transcripts and summaries of recordings.
• Leads and integrations: contacts and information you add or sync with your CRM; integration credentials are stored encrypted.
• Usage and browsing: pages visited, traffic source (such as UTM and referring site), device, browser, IP address and product usage events.

• Providing the service (connecting the number, making and recording calls, generating reports and transcripts, integrating with the CRM) — performance of contract (art. 7, V).
• Billing and fraud prevention — performance of contract and legitimate interest (art. 7, V and IX).
• Account communications (welcome, limit notices, billing, security) — performance of contract.
• Marketing and activation communications (usage tips, offers) — legitimate interest, with an option to unsubscribe.
• Product improvement and metrics — legitimate interest.
• Legal obligations and defense in proceedings — compliance with a legal obligation and regular exercise of rights (art. 7, II and VI).

We do not sell personal data. We only share it with suppliers needed to operate:

• Stripe — payment processing;
• Resend — sending transactional emails;
• PostHog — website and product usage metrics;
• OpenAI — transcription and summarization of recordings, only when the AI Pack is active;
• ElevenLabs — AI voice agent, only when the customer configures it with their own account;
• Integrations chosen by the customer (RD Station, Pipedrive, HubSpot, webhooks and systems via API or SIP), which receive call data at the customer’s initiative;
• Authorities, when required by law or court order.

Platform data, including recordings, is stored on servers in Brazil. Some of the suppliers listed above (such as Stripe, Resend, PostHog and OpenAI) may process data outside Brazil, especially in the United States. In these cases, the transfer takes place for the performance of the contract and with suppliers that adopt data protection safeguards compatible with the LGPD (art. 33).

We keep data while the account is active. Recordings, transcripts and call data remain available until the customer deletes them or requests their deletion. After the account is closed, we delete or anonymize the data upon request, except when we need to keep it to comply with legal obligations (such as tax records) or for the regular exercise of rights.

We adopt technical and administrative measures to protect data: encrypted communication (HTTPS), per-account data isolation, hashed passwords, encrypted integration credentials, signed webhooks (HMAC) and restricted internal access. No system is completely immune to incidents; if a relevant incident occurs, we will notify those affected and the ANPD (Brazil’s National Data Protection Authority), as required by the LGPD.

We use essential cookies to keep you signed in (session) and analytics cookies/local storage (PostHog) to understand how the website and product are used. You can block cookies in your browser; essential cookies are required for sign-in to work.

Under the LGPD (art. 18), you may request: confirmation of and access to your data, correction, anonymization, blocking or deletion of unnecessary data, portability, information about sharing, withdrawal of consent and review of automated decisions. You may also file a complaint with Brazil’s National Data Protection Authority (ANPD).

To exercise your rights, write to suporte@hasos.com.br.

Privacy and data protection officer contact: suporte@hasos.com.br.

We may update this Policy; material changes will be communicated by email or in the dashboard. The date of the last update is shown at the top of this page.