Privacy Policy

• This website uses no cookies at all, and has no Google Analytics, no Facebook pixel, and no third-party trackers. None.
• The artificial intelligence model that talks with your customers runs on infrastructure operated by Andavor itself. The content of the conversations is not sent to any third-party AI provider.
• We do not sell, rent out, or hand over anyone's data.
• We do not store card numbers. Payment takes place outside Andavor: at the provider you connected or, for Pix sent to the store's key, at the customer's bank.
• The servers are located in the United States. That is an international transfer, and it is explained in section 9, along with what the law requires.
• To request deletion of your data, section 15 says exactly how — and it is an email, not a hidden form.
• If your business connects Google Calendar, section 19 says exactly what we access and what goes to Google.
• If you use the Andavor mobile app, section 21 says what it asks your device for, what it keeps on the device, and how to delete what it keeps.

• To the visitor of this website (andavor.com).
• To the merchant who creates an account and subscribes to the platform.
• To the team member the merchant invites to use the dashboard or the app.
• To the end customer served by the AI attendant, on the merchant's website or on the connected messaging channels.

If you are a customer of a store served by Andavor and want to know what the store does with your data, the store is the first to answer — it is the Controller. Section 3 explains why, and section 15 explains how to request deletion either way.

In conversations with the store's customers, the MERCHANT is the Controller and Andavor is the Processor. For the data of the merchant's account, of the team accounts the merchant invites, and of visitors to this website, Andavor is the Controller.

In practice, this means that Andavor processes the data of a store's customers only to perform the contract with that store and in accordance with its instructions — it does not decide on its own to use that data for any other purpose. The merchant's own registration, billing, and access data, and the registration and access data of the team the merchant invites, on the other hand, are Andavor's decision, and that is the data for which we answer as the Controller.

When the Controller is Andavor, the person behind the name is 69.217.692 CLEVERSON ANDRE DA CUNHA FILHO, CNPJ 69.217.692/0001-20, headquartered in Cachoeira Alta, Goiás, and the channel for contacting it is the email address at the end of this page — the same channel as the Data Protection Officer (Encarregado), in section 17.

Each store's data is kept isolated from the other stores' data within the database, by a rule enforced in the database itself. Without the store's context, a query returns no rows at all — the default is to deny, not to allow.

We do not ask for, and do not want, sensitive personal data — health, biometrics, religion, political opinion, union membership. If a customer writes something like that in a conversation, the data is processed only as part of that service interaction and is never used for any other purpose.

We do not store card numbers, security codes, or bank passwords. Payment takes place outside Andavor. When it goes through the provider you connected, it takes place within the provider's environment, and Andavor only sees the result: paid, pending, or declined. When the customer pays directly to the store's Pix key, it takes place at the customer's bank, and Andavor sees the receipt, if the customer sends it in the conversation.

We never ask the end consumer for consent to provide the service they themselves sought out. Consent requested where it does not belong is consent that is not valid — and it would turn every conversation into a pop-up.

The model that talks with your customers runs on infrastructure operated by Andavor itself. The content of the conversations is not sent to OpenAI, Google, Anthropic, or any other third-party model provider.

This is a concrete difference, not a figure of speech: on platforms that call a third-party model, every message from your customer leaves the company you hired and enters another company's infrastructure, under that company's retention policy. That does not happen here.

The attendant identifies itself as automated at the start of the conversation. This is not configurable and not optional: hiding from consumers that they are talking to a machine is contrary to the Código de Defesa do Consumidor (Brazilian Consumer Protection Code) and to the channels' policies.

No decision with legal effect on the end customer is made by the machine alone. The attendant conducts the conversation and builds the order; refusing a sale, canceling, issuing a refund, or handling exceptions is the store's decision, and the customer can ask for human assistance at any time — they just have to write that in the conversation.

Andavor may use effectively anonymized information to evaluate and improve its own systems and models. Data is treated as anonymized only when, considering the reasonable technical means available, it cannot be associated, directly or indirectly, with a person.

Removing a name, phone number, email address, or ID number is not enough if the rest of the content still makes it possible to identify someone. As long as a piece of information remains personal data, it remains subject to the LGPD and to this policy — and only once it has been anonymized may it be used for improvement.

In practice, improving means evaluating the attendant's answers against the operation's rules, measuring where it makes mistakes, building example and test datasets, and adjusting Andavor's model based on them.

What we never do: adjust the model with identified content; use one store's catalog, prices, or manuals to serve another; and send conversation content to a third-party AI provider.

The merchant may object to this use at any time by writing to the contact email address. We record the request and begin excluding their account from this use within 15 calendar days, with no change in price and no change in how the customer service works.

Only with those needed for the purchase to happen, and only what is necessary. These are the processors the platform uses today:

We may also disclose data when the law or a court order requires it. When we are able to notify you beforehand, we do.

If a new processor is added to this list, this table is updated and the date at the top of the page changes. We do not sell, rent out, or hand over data to anyone — under any circumstances, for any amount.

Andavor's servers are located in the United States. This means that the data processed by the platform leaves Brazil, and the LGPD requires this to be stated explicitly — which is what this section does.

The transfer takes place because it is necessary to perform the contract with the merchant and the preliminary procedures requested by the data subject during the service interaction (art. 33, IX, together with art. 7, V, of the LGPD). The connected messaging channels (Meta and Telegram) also operate outside Brazil, and messages travel through them by the decision of whoever chose the channel.

Where there is an international transfer, we require the supplier to make a contractual commitment to protection equivalent to that of the LGPD. All traffic between your browser, the platform, and these services is encrypted in transit.

If this infrastructure moves to another country, this section changes with it and the date at the top of the page is updated.

Once these periods have passed, the data is deleted or anonymized. If there is a lawsuit, investigation, or legal obligation in progress, we keep what is strictly necessary until it ends — and nothing more.

This website (andavor.com) uses no cookies at all. No analytics, no pixel, no third-party trackers, no cookie banner — because there is nothing to consent to.

The merchant dashboard (app.andavor.com) uses only strictly necessary cookies. The main one keeps you signed in after you log in: it is signed, expires in 30 days, and is not used to track browsing — without it, there is no way to stay logged in. The others are temporary. They are created when you sign in with an account from another service, such as your Google account, when you authorize connecting an account to the store (Google Calendar, Google Drive, Mercado Pago, or Melhor Envio), or when you pick Google Drive files through the app. They keep only that sign-in or connection request — in the connection ones, with the store and the email of whoever started it — and expire on their own within 30 minutes. Besides cookies, the dashboard keeps in your browser your preferences, such as the text size, the text you started writing and have not sent yet, and the open conversation with your attendant. When you sign out, the text and the conversation are deleted from the browser; the preferences stay. The browser also keeps copies of the images, audio, and videos you opened in the dashboard, so they are not downloaded again, and the desktop app does the same. Signing out does not delete those copies: in the browser, they are removed when you clear your browsing data. In the mobile app, they are deleted when you sign out (section 21).

The customer service that runs on the merchant's website keeps the conversation — what the visitor wrote and what the attendant answered — so the store can read it in its dashboard, for the period in section 10. To recognize returning visitors, it keeps an anonymous identifier in the visitor's browser; after the attendant answers, the same identifier goes into a cookie of the store's own website, for 30 days, so the store can tell whether a purchase came from the conversation. It does not track which pages of the website the visitor has visited.

• The credentials you connect are stored encrypted in the database, with a key that never leaves the server, and are never returned by any API route — an automated test locks this in.
• Each store's data is isolated by a rule enforced within the database itself. A query without the store's context returns no rows at all: the default is to deny.
• The dashboard reads the database of conversations and orders with a user that can only run SELECT, and its process does not write to disk. What you change through the dashboard — catalog, instructions, profile, team — is written to the platform's database through a separate path, and each write applies only to your store. The actions that affect the service live in a separate process, with a closed list of commands and no access from the internet.
• Merchant passwords are stored as hashes, never as plain text. No one at Andavor can read your password.
• All traffic is HTTPS, with HSTS enabled. The dashboard runs with a restrictive content policy and loads third-party code in only two cases: Meta's, when you open the WhatsApp connection through Meta, and Google's, when you open the Google Drive connected to the store. In the mobile app, neither one loads.
• Access by Andavor's own team is limited to what is necessary for support to work, and actions that change the store are recorded in a log that cannot be rewritten.
• There are periodic backups and restore drills, so that a disk failure does not turn into data loss.

No measure eliminates risk completely, and anyone who promises that is lying. What we promise is what is written in section 13.

If there is an incident that may cause relevant risk or damage, we notify the Autoridade Nacional de Proteção de Dados (ANPD, Brazil's National Data Protection Authority) and the affected data subjects within a reasonable time, as required by art. 48 of the LGPD.

The notice will say what happened, which data was affected, what we have already done, and what you can do. We do not give vague notices to make it look like everything is fine: if we do not yet know the extent, the notice will say that too.

The LGPD guarantees that, at any time and at no cost, you can:

• Know whether we process your data, and which data.
• Access that data and receive a copy.
• Correct anything that is wrong, incomplete, or out of date.
• Request anonymization, blocking, or deletion of anything that is unnecessary, excessive, or processed unlawfully.
• Request portability to another provider.
• Know who we share your data with — section 8 already answers this in writing.
• Object to processing carried out on the basis of legitimate interest.
• Withdraw consent, when the processing was based on it.
• Request review of an automated decision that affects your interests.

To exercise any of these rights, write to this page's contact email address. We respond within 15 calendar days, and we may ask you to confirm your identity first — not to make things harder, but because handing data over to someone who is not the data subject would itself be a leak.

If you are a customer of a store served by Andavor, the request goes first to the store, which is the Controller. If you write to us anyway, we forward it to the store and follow up until it is handled — no one is left without an answer because of whom they wrote to.

You can also file a complaint directly with the ANPD, the Brazilian data protection authority, at gov.br/anpd.

Send an email to sales@andavor.com with “Data deletion” as the subject, saying which account, phone number, email address, or profile should be deleted. That is all. This is also how to request deletion of the account used in the dashboard and in the Andavor app, with the data linked to it. If you have that account, you can also ask from inside the app or the dashboard, under Settings › Account › Delete the account, with the account's password: the request reaches Andavor in the same way, and you get a receipt at the account's email address.

We confirm receipt within 3 business days and complete the deletion within 15 calendar days. If the account has a subscription, the deletion request also cancels it: there is no need to cancel first. After that, all that remains is what we must keep by law or for security, for the periods in section 10 — orders, charges, and receipts, and access logs — and even these are blocked from any other use.

If you talked to a store's attendant through Instagram, Messenger, WhatsApp, or Telegram, deleting the conversation there deletes your copy, not ours. The email request is what deletes it from our systems.

If you joined the website's waitlist before launch, the same email takes care of it: you are removed from the list and the record is deleted, along with the IP address and browser.

The platform is not directed at anyone under 18, and we do not intentionally collect data from children or adolescents. If we find that such data was collected without the legal basis required by art. 14 of the LGPD, we delete it as soon as we become aware of it. If you are a parent or guardian and believe this has happened, write to us.

The channel for the Data Protection Officer (the Encarregado pelo tratamento de dados pessoais — the DPO, under art. 41 of the LGPD) is the contact email address shown in the footer of this page. It handles data subject requests, questions about this policy, and communications from the ANPD.

Just write in plain language, however you can. There is no required format and no hidden form: an email saying what you want is enough.

When this policy changes, the date and version at the top of the page change with it. If the change is material — a new processor, a new purpose, a longer retention period — we notify the merchant by email and in the dashboard before it takes effect.

The version number and the date of the last update are at the top of this page. Previous versions are available through the contact email address.

This section applies only to a business that connects Google Calendar to Andavor so the assistant can book appointments.

• What we access: we create a calendar called “Clientes · [your business]” in your Google account and create, change, and delete events only in it. In your other calendars we see only the busy times, with no title, description, or attendees.
• What goes to Google: each booked appointment becomes an event in that calendar, with the service, the customer's name and, when available, the phone number and the location.
• What for: to offer your customers the free times and to record the booked appointments.
• How we store it: the Google authorization is kept encrypted in our database. We do not keep a copy of your events.
• Who we share it with: no one. The data we receive from Google is not used to train the artificial intelligence or for advertising.
• How to turn it off: in Connections, “Disconnect”, or in your Google Account, in the list of apps with access to the account. What is already in the customers' calendar stays there.

When a business connects Google Drive, Andavor accesses only the files the business chooses, keeps a copy for the assistant to read, checks once a day whether they changed, and deletes the copies when the business disconnects.

Andavor's use and transfer of information received from Google APIs adheres to the Google API Services User Data Policy, including the Limited Use requirements.

This section applies to anyone who uses the Andavor mobile app (Android and iPhone): the merchant and the team members the merchant invited. The app is the same dashboard the store opens in the browser: the data it handles, what for, with whom, and for how long are what this policy describes for the dashboard. This section covers what it asks your device for, what it keeps on the device, and how to delete what it keeps.

• Account: the app is for people who already have an Andavor account. You cannot open a store's account or make a payment through it. The store's owner can invite team members from the app; each one creates their own password in the browser, through the invitation link.
• How you sign in: with the account's email and password, or with your Google account. When you choose Google, Google's sign-in screen opens in a browser window on your device, and Andavor uses only the email address Google has verified, to find your account. We do not receive your Google password, and this sign-in does not give us access to your emails, files, or calendar. On iPhone, you sign in only with the email and password.
• Microphone: the app asks for access to the microphone the first time you tap to record an audio message in a conversation. It records only when you tap to record, for at most 3 minutes, and the recording ends when you send it, delete it, leave the conversation, or move the app off the screen. The audio leaves the device only when you tap send: it goes to the customer through the conversation's channel and is kept with the conversation.
• Camera: when you tap to take a photo, in a conversation or on a product page, the app opens the device's camera. On Android, it does not ask for the camera permission; on iPhone, the iPhone itself asks for your permission the first time. On neither does it open the camera on its own. The photo is reduced on the device before it is uploaded and goes without the data the camera writes inside the file, such as the place where it was taken. In a conversation, it leaves the device only when you send it: it goes to the customer through the conversation's channel and is kept with the conversation. On a product page, it is added to the store's catalog as soon as it is taken, and the attendant can send it to customers. On Android, the original file stays in a folder of the app on the device, and the app deletes it after one day, the next time it returns to the screen; up to Android 10, other apps with the storage permission can read that folder. On iPhone, the original file stays in the app's temporary folder, which the iPhone itself clears.
• Photos and files on the device: the app has no access to your gallery or your files. When you attach a photo or a document, the list is shown by the device's system (Android or iPhone), and the app receives only what you chose.
• What stays on the device: the cookie that keeps you signed in (section 11); the app's preferences, such as the text size; the text you started writing and have not sent yet; the open conversation with your attendant; copies of the images, audio, and videos you opened, kept in the app's cache so they are not downloaded again; a copy of each photo or document you choose to attach, also in the cache, which is what lets the screen open it; and a marker of the latest Google sign-ins, with none of your data. What the app keeps is not included in Android or iCloud backups: on a new device, you sign in again.
• What the app does not do: it shows no ads, has no analytics, advertising, or tracking tools, and loads no code from other companies over the internet. It does not read your location or your contacts, and it uses the microphone only when you tap to record.
• Who it talks to: Andavor's addresses on the internet, always over an encrypted connection. The connection passes through Cloudflare, the protection service that sits in front of our servers (section 8); from there, the data follows the paths in sections 8 and 9, as it does in the dashboard. Product photos kept outside Andavor, such as those on the store's own website, are fetched by the app directly from their address.
• How to delete: when you sign out, the cookie that keeps you signed in, the unsent text, the open conversation with your attendant, and the cached copies are deleted from the device. The same happens after the session expires or your access is removed, as soon as the app talks to Andavor again. Signing out needs an internet connection: without it, the app tells you that you are still signed in and nothing is deleted. On Android, the original file of the photos you took is removed after one day, as described above, and so is the copy of what you chose to attach: after one day, the next time the app comes back to the screen. On iPhone, these copies stay in the app's temporary folder, which the iPhone itself clears. Uninstalling the app deletes everything it kept on the device. The window in which you sign in with Google belongs to the device's browser: your Google account stays signed in there, and you sign out of it in the browser's settings. None of this deletes your account or what is on our servers: for that, section 15 says how to ask.