Privacy Policy
1. Who we are
Fragata Private Brokers is a real estate advisory firm based in São Paulo, Brasil. We are the controller of the personal data described here, under Brazil's General Data Protection Law (LGPD, Law 13.709/2018). Questions: maestro@fragata.club.
2. Our application and the Meta APIs
We operate our own customer messaging and relationship platform, integrated with the Meta WhatsApp Business Platform. Our Meta application uses exactly these permissions, and no others:
whatsapp_business_messaging— to send and receive messages on the business phone numbers we manage, and to upload and retrieve message media.whatsapp_business_management— to manage WhatsApp Business Accounts, business phone numbers, message templates and webhook configuration.public_profile— to identify the person who authorizes the integration during onboarding.
We use Meta's Embedded Signup, including coexistence mode, which allows a business phone number to operate simultaneously in the WhatsApp Business app and on the Cloud API. In coexistence, messages our own team sends from the app are also delivered to our system through the smb_message_echoes, smb_app_state_sync and history webhooks, so that our records of a conversation stay complete.
3. What information we collect
3.1 From people who message us on WhatsApp
- WhatsApp phone number and profile name.
- Message content: text, voice notes, images, documents and other media.
- Message metadata: message identifiers, timestamps, delivery and read status.
- Conversation history synchronized when a business phone number is onboarded in coexistence mode, where the account holder explicitly authorizes that sharing.
- Information the person voluntarily provides in conversation: property interest, price range, preferred neighborhoods, scheduling availability and other details relevant to a real estate enquiry.
3.2 From our own operation
- Property and building records maintained by the company.
- Service records produced by our team in internal real estate management systems.
3.3 Collected automatically
- Technical delivery data returned by the WhatsApp Business Platform (status codes, error codes, timestamps).
- Server logs of our own application, used for security and troubleshooting.
- Cookies and browsing identifiers of visitors to the fragata.club portal, as described in section 7: the portal's own, to measure how the site is used, and those of measurement and advertising partners (Google and Meta), the latter only with your consent.
We do not knowingly collect data from children and do not collect sensitive personal data on our own initiative.
4. How we process it, and why
- To answer and follow up on enquiries started by customers and prospective clients.
- To present properties matching the interest a person has expressed.
- To schedule viewings and coordinate commercial follow-up.
- To keep a relationship history so service is continuous and people are not asked the same question twice.
- To comply with legal and regulatory obligations applicable to real estate brokerage in Brazil.
We use artificial intelligence models to draft and organize replies. Every conversation stays under human supervision: a member of our team can read any conversation and take it over at any moment, and when a human replies, the automated assistant stands down.
We do not make automated decisions producing legal effects on a person without human review.
5. Legal basis (LGPD)
- Consent and pre-contractual procedures (art. 7, I and V) for handling enquiries and brokerage.
- Legitimate interest (art. 7, IX) to maintain relationship history and improve service quality.
- Legal obligation (art. 7, II) where applicable.
- Legitimate interest (art. 7, IX) to measure the use of the fragata.club portal with our own identifiers (section 7.1), with the right to object at any time.
- Consent (art. 7, I) for partners' measurement and advertising cookies (Google and Meta) and for sharing with advertising platforms (sections 7.2 and 8).
6. Who we share with
- Meta Platforms, as the operator of the WhatsApp messaging infrastructure.
- Technology vendors contracted as data processors, bound by confidentiality and limited to the purposes above:
- Google LLC (Google Cloud Platform) — hosting of our application server and database, in the
southamerica-east1region. Processes data in Brazil and in the United States. - Anthropic, PBC — natural language processing: generating replies from the text of messages. United States.
- Deepgram, Inc. — speech-to-text transcription of voice messages sent by customers. United States.
- ElevenLabs, Inc. — text-to-speech synthesis of replies when a voice reply is requested. United States.
- Pinecone Systems, Inc. — vector database storing the long-term memory of conversations. United States.
- Google LLC (Google Cloud Platform) — hosting of our application server and database, in the
- Google and Meta, as advertising platforms, only with your consent and as described in sections 7 and 8.
- Public authorities, where required by law or court order.
We do not sell personal data.
7. Cookies, measurement and advertising
7.1 Portal measurement
To understand how the portal is used and to improve our service, we record, using the portal's own identifiers:
- the pages visited, the time spent on each and how far down each page was scrolled;
- taps on contact buttons, use of the financing simulator and the steps of the sign-up;
- where the visit came from (the ad or the site you came from, including the ad click identifier, kept for up to 90 days);
- the type of device, the browser and the approximate city, estimated from the network.
We do not record what is typed into form fields. Your IP address is not stored: we only use an encrypted, irreversible version of it.
This data is not sent to advertising platforms. If you sign up or talk to us, it becomes part of your service history. We keep these records for up to 24 months from your last contact with us.
The legal basis is legitimate interest (art. 7, IX). You can object at any time under “Cookie preferences”, in the portal footer, or under “Customise”, in the cookie notice; from then on, measurement stops on your device.
7.2 Partners' measurement and advertising
With your consent, we also use the Google tag (Google Ads and Google Analytics) and, where applicable, the Meta pixel, to measure visits and contacts generated by ads and to show ads to people who have already visited the portal (remarketing).
These tools use first-party and third-party cookies, including Google's and Meta's.
The legal basis is consent (art. 7, I): these cookies are only activated after you accept them, and you can withdraw your consent at any time under “Cookie preferences”, in the portal footer.
You can also turn them off:
- in your browser settings;
- in Google's My Ad Center;
- in Meta's ad preferences.
See also how Google uses information from sites or apps that use its services.
8. Sharing with advertising platforms
With your consent, we may send Google and Meta your email address and phone number in encrypted form (hash), to show our ads to clients of the firm and to people with a similar profile (Google's Customer Match and Meta's Custom Audiences).
The platforms process this data under their own terms and do not receive it in plain text.
You may withdraw this consent at any time by writing to maestro@fragata.club, after which you are no longer included in these lists.
9. Retention
We keep service data for as long as necessary for the purpose that originated it and for legal compliance. After that, data is deleted or anonymized.
10. Security
Encrypted transmission, individual access credentials, segregated environments, and audit logging of operations performed by the system.
11. How to request deletion of your data
Send an email to maestro@fragata.club with the subject "Data deletion request", stating the phone number you used to contact us.
We confirm deletion in writing within 15 days. We delete your conversation history, your contact record and any notes associated with it, except data we are legally required to retain — in which case we tell you exactly what was kept and why.
You do not need an account with us to make this request, and there is no cost.
12. Your other rights
Under art. 18 of the LGPD you may request confirmation of processing, access, correction, anonymization, portability, information about sharing, and withdrawal of consent. Write to maestro@fragata.club; we respond within 15 days.
This includes withdrawing your consent to advertising and asking to be removed from the advertising lists sent to Google and Meta (section 8), through the same email.
Stopping messages
Reply "stop", "parar" or any equivalent in a conversation. Opt-out is immediate, permanent, and recorded in our system.
13. Changes
We may update this policy. The effective date at the top indicates the current version.
Previous version: effective from October 10, 2026, superseded by this one. This version measures the use of the portal on the basis of legitimate interest, with the right to object (section 7.1), and separates this measurement from partners' measurement and advertising, which still depends on your consent (section 7.2).
This English translation is provided for convenience only. In case of any discrepancy or conflict, the Portuguese version prevails: it is the version submitted to Meta and reviewed by our legal counsel. Read the Portuguese version.
