Privacy Policy
Last updated: November 12, 2026
Introduction
Ohanax, a brand of Metav Tecnologia da Informação Ltda (CNPJ 41.546.982/0001-07) ("we", "our" or the "Company"), operator of the Cenvia platform, is committed to protecting the privacy of those who use our services. This Privacy Policy describes how we collect, use, store and protect personal information when you use Cenvia.
Cenvia is an omnichannel customer service platform: it brings into a single inbox the conversations your company holds with customers through the WhatsApp Business Cloud API, Messenger, Instagram and Telegram, distributes those conversations among the team, keeps the history within the company and offers automations and artificial intelligence features on top of that service.
Two different roles — read this before the rest
This policy covers two distinct relationships, and the difference between them determines whom you should ask to exercise your rights:
2.1 When your company subscribes to Cenvia
With respect to account data (your agents, your configuration, your subscription), Ohanax is the controller. Most of the sections below deal with this relationship.
2.2 When a consumer talks to a company that uses Cenvia
That consumer's messages, phone number and files are processed by Ohanax as a processor, following the instructions of the company that serves them. The one who decides why that data is collected and for how long it is kept is the subscribing company, which is their controller.
In practice: if you are a consumer and want to access, correct or delete what you discussed, ask the company you spoke with directly. Within Cenvia, it has the tools to handle your request. If you do not know whom to turn to, write to privacidade@tzo.com.br and we will forward it to the controller.
Data we collect
3.1 Registration and access
- User's name and email address
- Authentication performed by Authify (Ohanax's identity service) — the password is stored and verified there, in encrypted form, never in clear text
- Company the user belongs to, role (administrator, supervisor, agent) and departments
- Agent availability (on duty, at lunch, busy, off duty)
3.2 Company configuration
- Company name, connected channels and identification of each number/account
- Departments, queues, service hours and distribution rules
- Automation flows, quick messages and message templates
- Closing reasons, satisfaction survey and response time targets
3.3 Conversations and messages
This is the most sensitive data the platform processes, and it belongs to the subscribing company (section 2.2):
- Phone number and contact identifier on the originating channel
- Display name of the contact's profile on WhatsApp, Messenger, Instagram or Telegram
- Content of received and sent messages, including text, location and shared contact cards
- Files exchanged in the conversation: photo, video, audio and document
- Delivery and read status, date and time of each message
- Internal team notes (whispers), which the customer does not see
- Service history: who took over, transferred, closed, and when
- Service rating (score given by the customer) and closing reason recorded by the agent
- Contact records that the company keeps on the platform
3.4 Channel credentials
- Access tokens, signing key and verification token of the Meta accounts the company connects
- Number, page and business account (WABA) identifiers
These credentials are stored encrypted and used only to send and receive messages on behalf of the company that connected them.
3.5 Knowledge base and AI features
- Documents the company uploads to the base (PDF, DOCX, XLSX, CSV, TXT, HTML, subtitles and emails)
- Website pages the company asks to be synchronized
- The excerpts and vector representations (embeddings) generated from that material, used for search
- Questions and answers approved by the company itself based on its service
- A record of each AI call charged to the wallet: what the AI received and what it answered, with CPF, phone number and email masked as they were sent to the provider (the ads assistant is not part of this record)
3.6 Usage, session and audit
- IP address and browser identification
- Session cookie (httpOnly) and login and logout records
- Audit trail of the actions performed on the platform, for the company's own supervision
- Technical operating metrics (volume, latency, errors), without message content
3.7 Payment
- Subscriptions and credits are processed by Billify, Ohanax's billing service
- We do not store credit card data — it stays with the payment processor
- We keep only the subscription status and the available balance
How we use this data
- Providing the service: receiving, displaying, distributing and sending service messages
- Organizing the work: queues, departments, transfers, service hours and response deadlines
- Automating: running the flows the company itself designed
- AI features: answering with an agent, suggesting text to the agent, searching the knowledge base and observing conversations according to the monitors the company configures
- Reports: producing the company's own service indicators
- Security: authentication, abuse prevention and audit trail
- Billing: controlling subscription and consumption
- Support: handling tickets from the subscribing company
What we do not do: we do not sell personal data, we do not use the content of our customers' conversations to train artificial intelligence models, and we do not use that content for advertising.
Artificial intelligence: what leaves the platform
Cenvia's AI features (answering agent, agent copilot, monitors, ads assistant and knowledge base search) depend on a language model provided by Ohanax: the company does not choose a provider or register an API key.
- Who processes it: each AI call goes directly to DeepSeek or through OpenRouter (United States), an intermediary that routes it to AI providers contracted through it, among which may be DeepSeek and OpenAI. These providers may be outside Brazil (section 11)
- What is sent: the text needed to generate the response, such as excerpts of the conversation and the agent's instructions. Before sending, the platform automatically masks CPF, phone number and email found in the text. The masking recognizes the format of these three kinds of data: names, addresses and other information freely written in the conversation are not masked
- What the provider does with the text: how long it keeps it and whether it uses it for other purposes follows each provider's privacy policy and is not set by this Policy
- What Ohanax does not do: it does not use the content of conversations to train artificial intelligence models (section 4)
- Embeddings (the numerical representation used to search the knowledge base) are generated by Ohanax's own service
AI-generated responses may contain inaccuracies. It is up to the subscribing company to review, set limits and decide where automation operates — see the Terms of Use.
Storage and security
- Traffic always encrypted in transit (HTTPS/TLS)
- Meta channel credentials stored encrypted
- Authentication by httpOnly cookie, which the page's JavaScript cannot read
- Isolation by company in every query: a user can only reach data from the company they belong to
- Media files stored on Amazon S3, served through a temporary signed link
- Managed databases, with regular backups
- Technical logs without message content, full phone number or token
- Infrastructure access restricted, by key, and monitored
- Automatic availability monitoring every minute, with 24x7 on-call coverage for critical incidents
- Backups made regularly and retained for up to 90 days, with the same level of protection as production data
No security measure is absolute. If a security incident occurs that may cause relevant risk or harm to data subjects, Ohanax will notify the affected subscribing companies (controllers) within 48 hours after becoming aware of it, with the information available about what happened, the data involved and the measures adopted, so that they can meet their own obligations. In cases where Ohanax is the controller (section 2.1), it notifies the National Data Protection Authority and the data subjects within the deadlines set by ANPD regulations.
Who we share it with
We do not sell personal data. We share it only with the providers strictly necessary for the platform to work:
Messaging channels
- Meta Platforms — WhatsApp Business Cloud API, Messenger and Instagram, to deliver and receive the company's own messages
- Telegram — to deliver and receive the company's own messages on the Telegram channel
Ohanax platform
- Authify — authentication and access management
- Billify — subscription, credits and billing
- Ohanax embeddings service — knowledge base search
Infrastructure and AI
- Amazon Web Services — media file storage
- Hosting provider for the application servers and databases
- OpenRouter (United States), an intermediary that routes Cenvia's AI calls to language model providers — among them may be DeepSeek and OpenAI — and, in some cases, DeepSeek directly (section 5)
- Language model providers for the Assistant (AI) on the ads screen (the same as in section 5), only when an administrator asks a question (section 9.1)
We may also share information when there is a legal obligation (law, regulation or court order) or to protect rights, property or safety.
Your rights (LGPD)
The Brazilian General Data Protection Law (LGPD, Law No. 13,709/2018) guarantees you:
- Access — knowing which of your data is processed and obtaining a copy
- Correction — correcting incomplete, inaccurate or outdated data
- Deletion — requesting the elimination of your personal data
- Portability — receiving your data in a structured format
- Revocation — withdrawing consent at any time
- Objection — objecting to processing carried out on another legal basis
- Information — knowing which entities your data has been shared with
To exercise any of them, write to privacidade@tzo.com.br or use our data deletion page. If the request concerns a conversation you had with a company that uses Cenvia, reread section 2.2: the request needs to go to that company, and we help you reach it.
How long we keep it
- Active account — we keep the data for as long as the account exists
- Conversations and contacts — they remain for as long as the subscribing company wants to keep them, with no expiration period and no limit on quantity; it is the one who decides on disposal
- Media files and knowledge base — same rule as conversations, within the storage allowance provided in the Terms of Use; reaching the allowance never deletes data
- Channel credentials — deleted as soon as the channel is disconnected
- After the account is closed — the data remains available for export and is removed within 30 days
- Backups — backups expire within 90 days
- Audit trail — retained for at least 1 year
- AI call records — kept for 90 days and deleted automatically; only the company's administrators (and supervisors, for the conversations in their departments) can see them, and every access goes to the audit trail
- Legal obligations — whatever the law requires us to keep, we keep for the required period
Meta data: ads and leads
Ad accounts (ads_read)
With the consent of the person connecting, we read from the ad accounts the account's name, currency, time zone and status, campaigns, ad sets, ads, creative thumbnails and performance indicators (impressions, reach, frequency, clicks, amount spent, results and costs), only to show the company itself how its ads are doing. Access is read-only: we never create, change or pause ads. We store the token, encrypted, and the identifier of the person who authorized it. The indicators are not saved in our database: they stay in a temporary cache of at most 6 hours and are never linked to a person or a lead.
Ad images
When someone starts a conversation through an ad, Meta sends the ad image along, and we keep a copy to show in the conversation where the contact came from. If Meta does not send the image and the company has connected the ad account for that ad, we may fetch the image through the ad account itself (ads_read), also only to display it in the conversation. It is the company's own advertising content, with no personal data. The copy that came with the conversation is kept for as long as the company is a customer; the one we fetch through the ad account is deleted when the ad account leaves Cenvia, for example when it is disconnected in Channels.
Lead Ads (leads_retrieval)
On the Pages the company connects, we receive the name, phone number, email and form answers of each lead, including answers to custom questions, in order to register the contact and send the first message via WhatsApp with an approved template. The message is only sent if the lead ticked the form's consent box, which mentions the company and WhatsApp. All these answers stay on the contact, with the same retention as contacts; each lead's record keeps only identifiers and the result of the send. From the Page, we keep the name, the ID, the access token (encrypted) and the identifier of the person who connected it on Meta, used only to verify access to the leads and to handle deauthorization and deletion requests. The advertising company is the controller of this data.
Ads assistant (ads_mcp_management)
When a company administrator uses the Assistant (AI) on the ads screen, Cenvia queries, through Meta's ads server (Ads MCP Server) and read-only, the company's own ads data: indicators, recommendations and opportunity score, alerts, delivery errors, account change history and pixel quality. When the administrator asks a question, the question and this ads data are processed by the language model providers for Cenvia's AI functions (section 5), which act as processors, only to answer that question. We do not send conversations, contacts or leads to the assistant. The assistant never creates, changes or pauses ads. We store the question in the company's audit history; the answer is not stored.
How to request deletion of Meta data
- In Cenvia, whoever connected the ad account or the Page can disconnect it in Channels.
- On Facebook: Settings & privacy → Settings → Business integrations → Cenvia → Remove.
- In the company's business portfolio: Business settings → Integrations → Cenvia → Remove.
- Or write to privacidade@tzo.com.br.
When you remove Cenvia, Meta sends us the deletion request (Data Deletion Callback) and shows you a confirmation code with a link to track the request. Upon receiving the request, we disconnect the Lead Ads Pages that person has connected, deleting each Page's token and its identifier, and we deactivate the messaging channels they connected, deleting their tokens. If anything fails, we try again every hour, within the period of up to 30 days.
Ad accounts are connected with a system user token from the company's business portfolio, and the request Meta sends identifies the person, not that system user; for this reason, today, it does not guarantee their deletion. For ad accounts, the guaranteed path is to disconnect in Channels: the account leaves Cenvia immediately, along with the images fetched through it, and the token is deleted when it was the last account of that authorization. You can also write to privacidade@tzo.com.br.
Messages and contacts follow the retention of this policy, since they are the client company's data, as are the ad images that arrived with the conversations.
Cookies
For the service to work, Cenvia uses the minimum necessary:
- httpOnly authentication cookie, which keeps you logged in
- Browser local storage for interface preferences
Audience and advertising measurement
Our website and the sign-up screen also use three measurement tools, which store their own cookies:
- Google Analytics 4 — how many people visit, which pages they go through and how many complete sign-up.
- Meta Pixel — measures the results of our ads on Facebook and Instagram and allows showing ads to those who have already visited the site.
- OpenAI Pixel — measures the results of our ads on ChatGPT: it stores for 30 days the identifier of the click on the ad and records when a form is submitted.
When you fill in one of our forms, the pixel may send Meta a one-way encrypted version (SHA-256 hash) of what you typed, calculated in your own browser — the original value never leaves your device. The fields our forms collect today that may become this code are name, phone number and city; Meta's feature also accepts email, state, ZIP code and date of birth, which we do not ask for. Meta uses these codes only to recognize whether you have an account there and attribute the visit to the correct ad.
Legal basis and how to refuse: this processing relies on the legitimate interest of measuring the effectiveness of our advertising (Article 7, IX of the LGPD), and you may object at any time — by blocking cookies in your browser, through Meta's and Google's ad preferences, or by contacting us through the channel at the end of this page. Refusing changes nothing in your service.
Those who talk to Cenvia itself on WhatsApp: after our service records the outcome of the conversation (for example, whether your business fits the product), we may send Meta your phone number one-way encrypted (SHA-256 hash) to measure our ads and decide to whom to show or not show our ads. The number itself never leaves Cenvia, and the content of the conversation is not sent. This processing also relies on legitimate interest (Article 7, IX of the LGPD); to object, contact us through the channel at the end of this page, and the number is removed from the audiences within 15 minutes.
Those who sign up to try Cenvia: we may send Meta the email and phone number of the account owner and administrators, one-way encrypted (SHA-256 hash), to show our ads to those who tried it and have not yet subscribed, or to stop showing them to those who are already customers. The same legal basis applies here, and you may object through the same channel.
Note: the conversations your company handles in Cenvia — your customers' messages, contacts and history — never feed these tools. They measure browsing and sign-up, not the service provided to the platform's customers.
International transfer
Part of the processing may take place on servers outside Brazil:
- Meta Platforms, for messaging channel traffic
- Amazon Web Services, for media file storage
- Hosting provider for the application servers
These transfers are carried out with adequate safeguards, including contractual clauses and compliance with the LGPD requirements for international data transfer.
The text sent to the AI (section 5) may also leave Brazil: each call goes directly to DeepSeek or through OpenRouter. DeepSeek is a company in China, and OpenRouter, in the United States; the AI providers it routes to may be in other countries, and among them may be DeepSeek and OpenAI, a company in the United States. For these providers the transfer results from the use of their services, under the terms and privacy policy of each, and Ohanax masks CPF, phone number and email before sending.
Minors
Cenvia is a corporate tool, intended for companies and their customer service teams. It is not directed at people under 18 and we do not intentionally collect data from minors to create accounts. If we identify that an account was created by a minor, we will take steps to delete it.
Changes to this policy
We may update this Privacy Policy periodically. Relevant changes will be communicated through the platform or by email, and the "last updated" date at the top of this page always indicates the version in force.
Contact
Questions about this policy or about the processing of your data:
By using Cenvia, you acknowledge that you have read and understood this Privacy Policy.