Felku Connect Privacy Policy
Version 2026-11-01 — in force since November 1, 2026 (previous version: 1.0, of October 28, 2026)
This Policy is a translation of the Portuguese version, which prevails in case of any discrepancy.
Contents
Controller and data protection officer
Data we process
Purposes and legal bases
Sharing and where data is kept
Retention and deletion
Your rights
Security
Cookies and browser storage
International transfers
Changes and contact
This policy explains what personal data Felku Connect processes, why, with whom it is shared, how long it is kept and how you exercise your rights, under Brazil's General Data Protection Law (Law 13.709/2018, "LGPD") and the Brazilian Internet Civil Framework (Law 12.965/2014). The rules for using the service are in the Terms of Use.
The summary in five lines:
Your AI agent only reads the chats you put on your contact list.
We keep messages for a short time: 24 hours, 7 days or 30 days, depending on the plan, and only what arrived after you connected.
When you disconnect a number or a bot, we immediately delete from our database the credential and the stored messages of that connection; once the backup is active, the encrypted copies are gone within 8 days.
The AI service that reads your messages is the one you chose; Felku does not control it.
We don't sell data, we don't use your messages to train AI and we don't use tracking, analytics or advertising cookies.
1. Controller and data protection officer
Controller of your account, billing, service usage and website data: Paulo Henrique Reis Alves (sole proprietor), CNPJ 65.508.556/0001-39, Av. Eng. Luiz Carlos Berrini, 1681, conj. 111 e 112, Cidade Monções, São Paulo, SP, Brazil, CEP 04571-011 ("Felku", "we"). It is the same business that operates Felku's sticker bot and app; this Policy applies only to Felku Connect. Felku Connect's data is kept in its own area of the database (separate from the sticker bot's) and the data of the two services is not cross-referenced.
Content of your chats: when the service processes messages from your chats (including data of the people you talk to), we do it for you and according to your instructions (what you connect, your contact list, the retention plan). In that role, Felku acts as processor and you are the controller of that data, including data of underage contacts.
Data protection officer (DPO): Paulo Henrique Reis Alves · contato.suporte@felku.com.br.
2. Data we process
| Category | Examples | Where it comes from |
|---|---|---|
| Account | name, email, password (stored only as a hash), language, date and version of your acceptance of the Terms and this Policy | you, at sign-up |
| Email and password confirmation | 6-digit code sent to your email (we keep only a fingerprint of it, valid for 10 minutes) | generated by us |
| Login session | IP address and browser, while the login session is active (up to 7 days) | dashboard usage |
| Billing | Stripe customer identifier, plan, payment history, card brand and last 4 digits, billing country. We don't receive the full card number. | you and Stripe |
| Sign-up source | where you came from before creating the account: campaign name (utm parameters), the site you came from (only the site's address, not the page) and the first page you opened (no parameters); and your browser's time zone | your browser, at sign-up |
| Connections | connected WhatsApp number, profile name, connection state; WhatsApp session credential and Telegram bot token (both encrypted); bot name | you, WhatsApp and Telegram |
| Contact list | phone numbers and identifiers of the contacts and chats you allow | you |
| Chat content | messages from chats on the contact list that arrived after you connected: text, sender, time, message identifier; messages sent by your agent. Images and documents are not stored | WhatsApp and Telegram, from your chats |
| Keys and usage | access keys (we keep only what is needed to validate them), scopes, and a record of each call by your agent: tool used, date and time, duration and result; and a connection activity log (drops, pauses, accepted messages, with a pseudonymized code of the sender, without the number or the text). We don't record message content in this log. | service usage |
| Access logs | IP address, date and time (with time zone) and the type of event: sign-up, login, failed login attempt, sign-out, password change, agent call, dashboard action. They are kept in a separate area that the service itself can only write to and delete by expiry, without reading | service usage |
| Free trial control | a pseudonymized code (HMAC with a secret key) of your email and of the card identification Stripe gives us. We don't store the email or the card in plain text in this record. It is still personal data: with the key, it is possible to check whether an email or card has already had a trial. | generated by us when the trial starts |
| Support | emails and messages you send us | you |
Optional features not available yet: history import and received media are off and, today, cannot be turned on in the dashboard; so we don't process that data. When they are released, this Policy will be updated first (section 10).
About the people you talk to: they don't have a Felku account. Their data passes through the service because you connected your number and put them on your contact list. See section 6 for how they exercise their rights.
The service is not intended for people under 18 and we don't accept minors as customers.
3. Purposes and legal bases
| Purpose | Data | Legal basis (LGPD) |
|---|---|---|
| Create and maintain the account, authenticate, provide the contracted service | account, login session, connections, keys | performance of a contract (art. 7, V) |
| Receive, keep for the plan's period and deliver to your agent the messages from the contact list; send the messages your agent asks for | chat content, contact list | as processor, according to the customer's instructions; the legal basis is defined by the customer, who is the controller |
| Bill and meet accounting obligations | billing, account | performance of a contract (art. 7, V) and compliance with a legal obligation (art. 7, II) |
| Know where customers come from, to decide where to promote the service | sign-up source | legitimate interest (art. 7, IX), with no browser identifier and no cross-site matching |
| Service notices (account, billing, security, changes to these documents) | performance of a contract (art. 7, V) | |
| Sending guards, prevention of spam, fraud and abuse, service security | usage log, sending metadata, access logs | legitimate interest (art. 7, IX), with logs limited to metadata |
| Ensure one free trial per person | free trial control | legitimate interest (art. 7, IX), fraud prevention, with a pseudonymized code only |
| Keep access logs for 6 months | access logs | compliance with a legal obligation (art. 7, II; Internet Civil Framework, art. 15) |
| Handle support and data subject requests | support | performance of a contract and compliance with a legal obligation |
| Defend rights in judicial, administrative or arbitration proceedings | whatever is necessary | regular exercise of rights (art. 7, VI) |
What we don't do: we don't sell data; we don't use the content of your chats to train AI models or for advertising; we don't send events to Google or ad networks; we don't use visitor analytics tools; we don't send marketing emails; we don't read your messages, except when you ask us to in a support request or when the law requires it.
Automated decisions: the sending guards may delay or refuse a send, hold it until you confirm in the dashboard (sending to another chat right after reading messages from someone else, forwarding) or automatically pause a connection to protect your number. The reason is returned to your agent and shows in the dashboard, under Activity. You can ask for a review of that decision through the contact in section 10 (LGPD, art. 20).
4. Sharing and where data is kept
Where your data is kept. The service has two parts, both in Brazil (and, once it is turned on, an encrypted backup in the United States):
Main database (account, login sessions, keys, billing, acceptances): Supabase, with servers in São Paulo (
sa-east-1region).Connection server (stored messages, usage log and encrypted WhatsApp and Telegram credentials): a dedicated server (VPS) from Hostinger, in São Paulo.
Connection backup, once active (it is not active yet): one per day, encrypted before it leaves the server, with a key that is not kept on the server, stored at Cloudflare R2, in the United States. It will only be used to restore your connection if the server fails (see section 9).
Providers that process data for us:
| Who | What for | Data | Where |
|---|---|---|---|
| Supabase | main database | account, sessions, keys, billing, acceptances | São Paulo, Brazil; company in the United States |
| Hostinger | server that runs the connections and stores the messages | chat content, encrypted credentials, usage log | São Paulo, Brazil |
| Cloudflare (R2) | encrypted backup of the connections, once active | chat content, connection credential and usage log, all encrypted | United States |
| Stripe | process payments and subscriptions | account and billing | United States and other countries |
| Resend | send the service's emails (confirmation code, billing, notices) | email, name, notice content | United States |
| Authorities | comply with the law or a court order | whatever is required | Brazil |
For chat content, we process the data as a processor for whoever contracts Felku Connect; in that part, Hostinger and, once the backup is active, Cloudflare act as sub-processors.
Services you choose (they are not Felku's providers):
Your AI agent and the AI service it uses (for example, Anthropic, OpenAI, Google). When your agent reads a message through Felku Connect, the content goes to that service on your initiative, under its privacy policy. Felku does not choose, control or answer for that service. Check how it handles data before connecting.
WhatsApp (Meta) and Telegram. They are the services where your accounts exist; they already process those messages under their own policies.
In case of a merger, acquisition or sale of the business, data may be transferred to the successor, who remains bound by this Policy.
5. Retention and deletion
| Data | How long |
|---|---|
| Chat messages | 24 hours (trial and Personal plan), 7 days (Pro) or 30 days (Business) from receipt, and only what arrived after you connected. When you change plans, the new plan's period applies. |
| Received images and documents | not stored |
| WhatsApp session credential and Telegram token | while the connection is active |
| When you disconnect a number or bot | we immediately delete from the database the credential and the stored messages of that connection (WhatsApp and Telegram); once the backup is active, its encrypted copies are deleted within 3 days and, in any case, within 8 days |
| Encrypted backups of the connections (once active) | one per day, kept for up to 7 days; after you disconnect or delete the account, deleted within 3 days and, in any case, within 8 days |
| Declined payment | after the 7-day grace period, sending is blocked and the subscription is canceled; connections and messages are not deleted because of this and follow the rules above |
| Account, contact list and login sessions | while the account exists; when you delete the account, we delete them immediately, and the subscription is canceled at Stripe |
| Sign-up source | while the account exists; when you delete the account, we delete it immediately |
| Free trial control (pseudonymized code) | 24 months from the start of the trial, even if the account is deleted earlier, because its purpose is precisely to prevent a second trial with the same email or card; after that it is deleted automatically |
| Stripe record (email and billing identifiers) | Stripe keeps the billing record even after the account is deleted, for tax and fraud-prevention purposes, for the period required by tax law and Stripe's policy |
| Access logs (IP, date, time and event) | 6 months (183 days), as required by the Internet Civil Framework (art. 15), or longer under a court order. They are kept for the legal period even if you delete the account; after that they are deleted automatically |
| Log of what keys did: each send and agent action (key, action, destination as a code, result), without the text | 30 days (trial and Personal), 90 days (Pro) or 90 days (Business). When you change plans, the new plan's period applies. |
| Connection activity log (Activity screen): drops, pairing, pauses, accepted messages and limit decisions, without the text. For received messages it keeps only a pseudonymized code of the sender, not the number | the same period as the log above, by plan |
| Support | 2 years after the request |
About "deleting": when we delete data, it leaves the database and is no longer used or shown. In the message database, the space of what is deleted is overwritten so that the content is not recoverable from disk: when you disconnect or delete the account, immediately; when the retention period expires or a plan change shortens it, at the next automatic cleanup, within 10 minutes. Once the connection backup (section 4) is active, the encrypted copies are not deleted immediately: when you disconnect or delete the account, they are deleted within 3 days and, in any case, within 8 days. Until then they stay encrypted and would only be used to restore your own connection.
You can delete the account at any time in the dashboard. When you cancel the subscription, connections stay active until the end of the paid period and then follow the rules above.
6. Your rights
Under the LGPD (art. 18) you can ask for: confirmation that we process your data; access; correction; anonymization, blocking or deletion of unnecessary data or data processed in breach of the law; portability; deletion of data processed with your consent; information about with whom we share it; information about the possibility of not consenting and its consequences; withdrawal of consent; and review of automated decisions.
In the dashboard: delete the account, disconnect numbers and bots, revoke keys and edit your contact list.
By email: contato.suporte@felku.com.br, for other requests, including a copy of your data in electronic format. We may ask you to confirm your identity before acting on it. We reply within 15 days.
People you talk to: someone who is not a customer and wants to exercise rights over messages that passed through Felku Connect should first contact the customer who owns the number (who is the controller). If they contact us, we forward the request to the customer. The customer can remove the person from the contact list (the agent stops reading and replying to that chat immediately); that person's messages already stored are deleted at the end of the plan's retention period or when the customer disconnects the number.
You can also complain to Brazil's National Data Protection Authority (ANPD), at gov.br/anpd.
7. Security
Connections to the website, the dashboard and the API use encryption (HTTPS/TLS).
The WhatsApp session credential and the Telegram token are stored encrypted, with the encryption key kept separately from the data, and are never returned through any tool.
Passwords are stored only as a salted hash, never in plain text.
Internal access to data is restricted to those who need it, and usage logs don't store message content.
Security incident. No system is completely secure. If there's a security incident involving personal data: your account data (we're the controller): we notify you and the Brazilian data protection authority (ANPD) within the ANPD's deadline; messages in your conversations (we're the processor): we notify you without delay and within 72 hours of confirming the incident, with what we know so far. As the controller, you decide whether to notify the ANPD and the people affected, and we help. We keep a record of each incident for the period the ANPD requires.
You also protect your data: keep your password and keys safe, revoke keys you don't use and prefer a dedicated number.
8. Cookies and browser storage
We only use the necessary login session cookie (
__Host-felku-connect.sid), which keeps you signed in to the dashboard. Without it, login doesn't work; that's why we don't ask for consent.Your browser also keeps, without cookies: the theme (light or dark) and the plan you chose before subscribing (local storage), and a summary of your account so the dashboard opens faster, which disappears when you close the tab. The language comes from the page address; if you pick another one in the selector, that choice is stored (local storage), as is a language suggestion you dismissed. And, until you close the tab, the visit source (campaign and the site you came from) is kept, and it goes along with your sign-up if you create an account; if your browser's time zone is in Europe (or a European territory, or not disclosed), it isn't stored: only what is in the address of the sign-up page itself is sent.
We don't use advertising, tracking or analytics cookies.
On the payment page, Stripe may use its own cookies for fraud prevention, under its policy.
9. International transfers
Your chat messages and credentials are kept in Brazil. Once the daily connection backup is active, it will be encrypted before it leaves the server and kept at Cloudflare (R2), in the United States, for the periods in section 5. Some providers are outside Brazil, mainly in the United States (Stripe, Resend, Cloudflare once the backup is active, and Supabase as a company, although the main database is in São Paulo). In those cases, the transfer is made to perform the contract with you and with the safeguards provided for in the LGPD (art. 33), such as the standard contractual clauses approved by the ANPD or the equivalent contractual instruments offered by those providers.
Sending your messages to the AI service you chose (which may be in another country) is done by your agent, on your initiative, and follows that service's policy.
10. Changes and contact
We may update this Policy. The version and effective date are at the top, and the acceptance at sign-up records the accepted version. Relevant changes are announced by email and in the dashboard at least 30 days in advance.
Data protection officer: Paulo Henrique Reis Alves · contato.suporte@felku.com.br.
Controller: Paulo Henrique Reis Alves (sole proprietor), CNPJ 65.508.556/0001-39, Av. Eng. Luiz Carlos Berrini, 1681, conj. 111 e 112, Cidade Monções, São Paulo, SP, Brazil, CEP 04571-011.