Privacy Policy

Who we are

LeroLero is a platform operated by AKIO TECH LABS LTDA (OliveSTech brand), CNPJ 59.461.536/0001-57, Divinópolis/MG, Brazil. It connects businesses to the official WhatsApp Business API, provided by Meta. Businesses use it to send reminders, confirmations, login codes and notices to their contacts, and to receive replies.

In this policy, "we" and "AKIO TECH LABS" refer to that company.

To reach our data protection officer, write to desenvolvimento@lerolero.tech.

Our role under data protection law

AKIO TECH LABS plays a different role depending on the data:

• Your LeroLero account data (name, email, phone, company, billing): AKIO TECH LABS is the controller.
• Data of the contacts a business messages (phone, name, message content, consent and opt-out): the business is the controller and AKIO TECH LABS is the processor, acting only on its behalf.
• Resellers (software that uses LeroLero for its own customers): the end customer is the controller, the software is the processor and AKIO TECH LABS is a sub-processor.

Data we process

• Sign-up and access: name, email, phone, password (stored only as a hash), two-step verification, team role and access logs.
• Company and billing: legal name, tax ID (stored encrypted), billing email, plan and invoices.
• Connected WhatsApp numbers: Meta identifiers (WABA and phone number), display name, quality rating and the business access token, stored encrypted.
• Contacts and messages: contact phone, name when provided, message content and status, proof of consent (date, source, text shown) and opt-out requests.
• Technical data: IP address, API call logs (with masked phone numbers) and webhook logs.

LeroLero does not store data from your personal Facebook profile. When a number is connected through Meta, we only receive the business token and the WhatsApp Business Account identifiers.

Why we use it

• To send and receive the messages the business requested, through the official WhatsApp API.
• To enforce opt-in and opt-out rules, sending limits and WhatsApp policies.
• To show message status, reports and alerts in the dashboard.
• To bill the plan, issue invoices and meet legal obligations.
• To protect the platform against fraud, abuse and unauthorized access.

The legal bases are performance of the contract with the business, legal obligations, legitimate interest (security and service improvement) and, where applicable, the consent recorded by the business.

Who we share it with

• Meta (WhatsApp Business Platform): every message goes through Meta, which has its own privacy policy.
• Cloud and infrastructure providers (hosting, database, file storage, email delivery) that process data on our behalf under contract.
• Payment providers, to bill the plan.
• Authorities, when required by law or court order.

We do not sell personal data and we do not use message content for advertising.

How long we keep it

• Message text: 12 months by default, configurable per account. After that, only status, date and cost remain, without the content.
• Raw Meta webhook payloads: 90 days.
• Account data: while the account exists. After a deletion request, up to 30 days.
• Billing data and invoices: for the period required by tax law.

Security

Meta tokens and tax IDs are stored encrypted; for API keys we keep only a hash; phone numbers are masked in technical logs. Dashboard access has roles and permissions, two-step verification and an audit log.

Your rights

Under the Brazilian General Data Protection Law (LGPD, art. 18) you may request confirmation of processing, access, correction, anonymization, portability, deletion, information about sharing and withdrawal of consent.

If you are a contact of a business that uses LeroLero, send your request to that business first, as it is the controller; we help it comply. If you are a LeroLero customer, write to desenvolvimento@lerolero.tech or see the Data deletion page.

Changes to this policy

When this policy changes, the date at the top changes and we notify customers by email when the change is relevant.