Privacy Policy
1. Who we are
Fragata Private Brokers is a real estate advisory firm based in São Paulo, Brasil. We are the controller of the personal data described here, under Brazil's General Data Protection Law (LGPD, Law 13.709/2018). Questions: maestro@fragata.club.
2. Our application and the Meta APIs
We operate our own customer messaging and relationship platform, integrated with the Meta WhatsApp Business Platform. Our Meta application uses exactly these permissions, and no others:
whatsapp_business_messaging— to send and receive messages on the business phone numbers we manage, and to upload and retrieve message media.whatsapp_business_management— to manage WhatsApp Business Accounts, business phone numbers, message templates and webhook configuration.public_profile— to identify the person who authorizes the integration during onboarding.
We use Meta's Embedded Signup, including coexistence mode, which allows a business phone number to operate simultaneously in the WhatsApp Business app and on the Cloud API. In coexistence, messages our own team sends from the app are also delivered to our system through the smb_message_echoes, smb_app_state_sync and history webhooks, so that our records of a conversation stay complete.
3. What information we collect
3.1 From people who message us on WhatsApp
- WhatsApp phone number and profile name.
- Message content: text, voice notes, images, documents and other media.
- Message metadata: message identifiers, timestamps, delivery and read status.
- Conversation history synchronized when a business phone number is onboarded in coexistence mode, where the account holder explicitly authorizes that sharing.
- Information the person voluntarily provides in conversation: property interest, price range, preferred neighborhoods, scheduling availability and other details relevant to a real estate enquiry.
3.2 From our own operation
- Property and building records maintained by the company.
- Service records produced by our team in internal real estate management systems.
3.3 Collected automatically
- Technical delivery data returned by the WhatsApp Business Platform (status codes, error codes, timestamps).
- Server logs of our own application, used for security and troubleshooting.
We do not knowingly collect data from children, do not collect sensitive personal data on our own initiative, do not use cookies for advertising, and do not build advertising profiles.
4. How we process it, and why
- To answer and follow up on enquiries started by customers and prospective clients.
- To present properties matching the interest a person has expressed.
- To schedule viewings and coordinate commercial follow-up.
- To keep a relationship history so service is continuous and people are not asked the same question twice.
- To comply with legal and regulatory obligations applicable to real estate brokerage in Brazil.
We use artificial intelligence models to draft and organize replies. Every conversation stays under human supervision: a member of our team can read any conversation and take it over at any moment, and when a human replies, the automated assistant stands down.
We do not make automated decisions producing legal effects on a person without human review.
5. Legal basis (LGPD)
- Consent and pre-contractual procedures (art. 7, I and V) for handling enquiries and brokerage.
- Legitimate interest (art. 7, IX) to maintain relationship history and improve service quality.
- Legal obligation (art. 7, II) where applicable.
6. Who we share with
- Meta Platforms, as the operator of the WhatsApp messaging infrastructure.
- Technology vendors contracted as data processors, bound by confidentiality and limited to the purposes above:
- Google LLC (Google Cloud Platform) — hosting of our application server and database, in the
southamerica-east1region. Processes data in Brazil and in the United States. - Anthropic, PBC — natural language processing: generating replies from the text of messages. United States.
- Deepgram, Inc. — speech-to-text transcription of voice messages sent by customers. United States.
- ElevenLabs, Inc. — text-to-speech synthesis of replies when a voice reply is requested. United States.
- Pinecone Systems, Inc. — vector database storing the long-term memory of conversations. United States.
- Google LLC (Google Cloud Platform) — hosting of our application server and database, in the
- Public authorities, where required by law or court order.
We do not sell personal data and do not share it for third-party advertising.
7. Retention
We keep service data for as long as necessary for the purpose that originated it and for legal compliance. After that, data is deleted or anonymized.
8. Security
Encrypted transmission, individual access credentials, segregated environments, and audit logging of operations performed by the system.
9. How to request deletion of your data
Send an email to maestro@fragata.club with the subject "Data deletion request", stating the phone number you used to contact us.
We confirm deletion in writing within 15 days. We delete your conversation history, your contact record and any notes associated with it, except data we are legally required to retain — in which case we tell you exactly what was kept and why.
You do not need an account with us to make this request, and there is no cost.
10. Your other rights
Under art. 18 of the LGPD you may request confirmation of processing, access, correction, anonymization, portability, information about sharing, and withdrawal of consent. Write to maestro@fragata.club; we respond within 15 days.
Stopping messages
Reply "stop", "parar" or any equivalent in a conversation. Opt-out is immediate, permanent, and recorded in our system.
11. Changes
We may update this policy. The effective date at the top indicates the current version.
This English translation is provided for convenience only. In case of any discrepancy or conflict, the Portuguese version prevails: it is the version submitted to Meta and reviewed by our legal counsel. Read the Portuguese version.
