PRIVACY POLICY AND DATA PROTECTION — CHATBOTFY

Last updated: August 30, 2026

NX DESENVOLVIMENTO DE SOFTWARE LTDA - ME (trade name NX TECNOLOGIA), a private-law legal entity registered under CNPJ No. 65.607.305/0001-01, headquartered at Rua Paes Leme, No. 215, Suite 1713, Pinheiros, São Paulo/SP, CEP 05424-150, owner and operator of the CHATBOTFY platform (https://chatbotify.com.br), establishes this Privacy Policy to regulate the processing of personal data in accordance with the Brazilian General Data Protection Law (Law No. 13,709/2018 - LGPD) and the Brazilian Civil Rights Framework for the Internet (Law No. 12,965/2014).

1. IDENTIFICATION OF THE CONTROLLER AND CONTACT

Company Name: NX DESENVOLVIMENTO DE SOFTWARE LTDA - ME Trade Name: NX TECNOLOGIA CNPJ: 65.607.305/0001-01 Address: Rua Paes Leme, 215, Suite 1713, Pinheiros, São Paulo/SP, CEP 05424-150 Phone: +55 (11) 99310-4510 Contact Email and DPO: [email protected] Official website: https://chatbotify.com.br

2. ROLES UNDER THE LGPD: CONTROLLER AND PROCESSOR

2.1. NX Tecnologia as Controller: We act as Controller in the processing of registration, financial and browsing data collected from our direct Customers and Partner Agencies for billing, support, authentication and compliance with legal obligations.

2.2. NX Tecnologia as Processor: We act as a technical Processor in the processing of messages, flows, leads, appointments and conversations carried out by our Customers and Partner Agencies. The Customer is the Controller of the data of its own leads and end consumers, and is legally responsible for obtaining consent and defining the legal bases for processing.

3. DATA COLLECTED AND PURPOSES

3.1. Registration Data of Customers and Users: We collect full name, business email, phone/WhatsApp, CPF or CNPJ, company name, address and application access records (IP address, date and time). Purpose: Performance of the SaaS service agreement, session authentication, issuance of invoices, technical support and fraud prevention. Legal Basis: Performance of a Contract (Article 7, V, LGPD) and Compliance with a Legal Obligation (Article 7, II, LGPD).

3.2. Data Processed in the Services (CRM, AI Agents and Automations): We process lead names, phone numbers, text and audio message history, status in Kanban pipeline stages, appointment records, integrated order data and custom variables configured in the flow builder. Purpose: Execution of automated customer service flows, generation of artificial-intelligence responses, appointment scheduling and CRM management as configured by the Customer. Legal Basis: Defined and managed by the Contracting Customer (Controller).

4. DATA SHARING AND SUBPROCESSORS

NX Tecnologia shares strictly the data necessary for the services to work with the following providers:

4.1. Infrastructure and Security: Supabase: Secure database storage and user authentication management. Cloudflare: Content delivery network (CDN), protection against cyberattacks (DDoS) and SSL/TLS encryption. Cloud Servers: Hosting with encryption and high availability.

4.2. Messaging and WhatsApp Connectivity: Meta Platforms Inc. (WhatsApp Business API) and Approved Connectivity Providers: Transmission, routing and receipt of instant messages.

4.3. Artificial Intelligence and Voice Processing: OpenAI (ChatGPT) and Google Gemini: Natural language processing and response generation in the artificial intelligence modules. Under the Bring Your Own Key model, data travels under the Customer's key, respecting the model non-training terms. ElevenLabs: Voice synthesis and cloning for automated audio, when enabled by the Customer.

4.4. Payments: Partner Financial Institutions: Secure processing of charges and subscriptions.

5. INTERNATIONAL DATA TRANSFER

Because of the use of global technology infrastructure (cloud servers, Meta, OpenAI and Google APIs), NX Tecnologia carries out international data transfers, ensuring that all partners comply with international security standards equivalent to those of the LGPD.

6. INFORMATION SECURITY AND DATA RETENTION

6.1. Protection Measures: We use encryption of data in transit (TLS protocols) and at rest (AES-256 standard), as well as strict access control and logical isolation between accounts.

6.2. Retention Period: Data is kept while the Customer's registration is active. After the account is cancelled, operational data remains available for export for up to 30 (thirty) days and is permanently deleted after that period, subject to legal retention obligations arising from the Brazilian Civil Rights Framework for the Internet and tax rules.

7. RIGHTS OF DATA SUBJECTS

Under Article 18 of the LGPD, data subjects may request confirmation of processing, access, correction, anonymization, blocking or deletion of their data.

7.1. Leads and End Consumers: They must direct their requests straight to the company or agency they dealt with (the Controller). NX Tecnologia will provide technical assistance to the Controller to handle the requests.

7.2. Chatbotfy Customers and Users: They may exercise their rights by contacting our Data Protection Officer directly at [email protected].

8. CHANGES TO THE PRIVACY POLICY

NX Tecnologia may update this Privacy Policy periodically. Notices of relevant changes will be given through the platform itself or by the registered email.