Privacy Policy — Wata

Version 1.1 — effective as of September 9, 2026

This Privacy Policy explains how ATLANTIS AI SOFTWARE COMPANY LTDA, Brazilian company registered under CNPJ no. 67.927.278/0001-80, headquartered at Rua Alexandre Von Humboldt, 871, Casa 23 — Condomínio Paysage di Padova, Pilarzinho, Curitiba/PR, Brazil, ZIP 82.110-000 ("Atlantis", "we", "us"), processes personal data within the Wata platform, in compliance with the Brazilian General Data Protection Law (LGPD — Law no. 13.709/2018).

1. Controller and Data Protection Officer (DPO)

The controller of the data processed in the context of your account is Atlantis AI Software Company Ltda. To exercise your rights or ask privacy questions, contact our Data Protection Officer: contato@wata.studio.

2. Roles: when we are a Controller and when we are a Processor

As a Controller: for the registration and usage data of the Customer itself (name, email, account data, billing data, access logs).
As a Processor: for the data of the Customer's End Contacts (WhatsApp messages, phone numbers, conversation content), processed on behalf of and under the instructions of the Customer, who is the Controller of that data. The Customer is responsible for having a legal basis and consent (opt-in) to communicate with its End Contacts.

3. Data We Collect

Registration and account data: name, email, password (stored encrypted), organization/company, job title and invitation or sign-up information.
Usage data: IP address, date/time of access, actions on the Platform, technical logs and device/browser data.
Billing data: information required for the subscription and invoicing (processed by payment providers).
Customer Content: messages, media and contact lists that the Customer enters or processes to communicate with its End Contacts (processed by us as a Processor).

4. Purposes and Legal Bases

We process personal data to: provide and operate the Service (performance of a contract — art. 7, V of the LGPD); create and manage the account and authenticate users (performance of a contract); billing and fraud prevention (performance of a contract and legal obligation — art. 7, II); operational and support communications (legitimate interest / performance of a contract); security and performance of the Platform (legitimate interest — art. 7, IX); compliance with legal obligations (art. 7, II).

5. Sharing and Sub-processors

We share data, to the extent necessary, with:

Meta Platforms (WhatsApp Business Platform / official API) to send and receive messages;
Anthropic PBC (Claude API), the AI provider that processes message content required to generate reply suggestions and reports; it does not use our data to train models;
Fly.io Inc. — application hosting (region gru, São Paulo, Brazil);
Neon Inc. — managed PostgreSQL database, where conversations and contacts are stored (access tokens are encrypted at rest);
Upstash Inc. — managed Redis, used as the queue for background tasks;
Cloudflare Inc. — DNS/CDN and R2 object storage for media exchanged in conversations, served through URLs valid for one hour;
Functional Software Inc. (Sentry) — application error monitoring;
Resend — transactional email;
Google LLC (Identity Services) — optional sign-in for Platform users;
Mercado Pago — subscription billing of the Customer.

We do not sell personal data.

6. International Data Transfers

Some sub-processors (for example, Anthropic and Meta) may process data outside Brazil, including in the United States. In such cases, we adopt the safeguards required by the LGPD for international transfers. By using the Platform, you acknowledge this transfer.

7. Retention

We keep data for as long as necessary for the purposes described, for the duration of the relationship with the Customer and for the legally required periods. After the account is closed, data may be deleted or anonymized, except where retention is mandatory.

8. Security

We adopt reasonable technical and administrative measures to protect data against unauthorized access, loss or destruction, including password encryption and access control.

9. Requests from Public Authorities

We may receive requests for personal data from public authorities. When that happens:

we review the legality of every request before disclosing anything, and we do not disclose data on the basis of an informal request;
we disclose only the minimum information necessary to answer that specific request — never broader datasets;
where we consider a request unlawful or excessive, we take steps to challenge it, including through legal counsel.

Where the law allows, we notify the affected Customer before disclosing data relating to its end users.

10. Data Subject Rights

Under the LGPD (art. 18), you may request: confirmation of the existence of processing; access; correction; anonymization, blocking or deletion of unnecessary data; portability; information about sharing; and withdrawal of consent, where applicable. Contact: contato@wata.studio. For End Contact data, requests must be addressed to the Customer (Controller); we will support the Customer in fulfilling them.

11. Cookies

The Platform and the website may use cookies and similar technologies for authentication, operation and to improve the experience. You can manage them in your browser.

12. Changes to this Policy

We may update this Policy from time to time. Material changes will be communicated through the Platform or by email. The effective date at the top indicates the current version.

13. Contact

Data Protection Officer: contato@wata.studio.
ATLANTIS AI SOFTWARE COMPANY LTDA — CNPJ 67.927.278/0001-80.

This is a courtesy translation. In case of conflict, the Portuguese version prevails.