Privacy Policy

1. Who we are

GovTools is a Brazilian technology company that develops and operates GovTools HUB, a Software as a Service (SaaS) platform designed exclusively for public administration agencies. The HUB provides citizen service tools, process automation, and communication via WhatsApp Business API for city governments, state governments, and other governmental entities in Brazil.

GovTools operates as a technology provider and data processor. The government agencies that contract our services are the data controllers, responsible for defining the purposes and means of processing personal data of the citizens served through the platform.

2. Operating model

GovTools HUB operates under two integration models with the WhatsApp Business API, depending on the technological structure of the contracting government agency:

• Agency's own account: when the government agency has its own Meta Business Suite account, GovTools connects as an authorized technology provider, accessing the WhatsApp Business API on behalf of the agency under formal authorization
• GovTools-managed account: when the government agency does not have a Meta Business Suite account, GovTools registers and manages the WhatsApp phone number under its own Meta Business account, operating exclusively on behalf of and under contractual authorization from the government agency. In this case, GovTools operates the number solely for the purpose of delivering the contracted services

In both scenarios, there is a formal contract between GovTools and the government agency that authorizes the operation of the WhatsApp number and defines each party's responsibilities. GovTools does not operate any WhatsApp number without a valid contractual authorization.

Number portability: the contracting government agency is the rightful owner of the phone number and may request its migration to another Meta Business account at any time, whether to the agency's own account or to another technology provider. GovTools commits to completing the number transfer within the necessary operational timeframe, without restrictions or penalties, upon formal request from the agency.

3. Data we collect

As a technology provider, GovTools may collect and process the following data on behalf of the contracting government agencies:

• Platform operator data: name, institutional email, phone number, and role of the public servants and agents who use the HUB admin panel
• Platform usage data: access logs, actions performed in the admin panel, configurations, and assigned permissions
• Meta integration data: business phone numbers, WhatsApp Business API access tokens, Meta Business account IDs, and message template configurations
• Conversation data: messages exchanged between the government agency's agents and citizens via WhatsApp, including text, media, and delivery metadata, processed to enable citizen service
• Analytics data: service metrics, satisfaction surveys (NPS), response times, and performance indicators generated for public management purposes

4. How we use the data

Data processed by the HUB is used exclusively for:

• Operating the platform features contracted by the government agency, including service queues, conversation management, and notification delivery
• Managing the WhatsApp Business API integration, enabling message sending and receiving on behalf of the government agency
• Processing and delivering message templates previously approved by Meta
• Powering artificial intelligence features for automated citizen service, as configured by the contracting agency
• Generating reports and performance indicators for public managers
• Complying with legal, regulatory, and audit obligations

5. Strict prohibition of marketing messages

GovTools HUB is a platform designed exclusively for citizen service and public service communications. The use of the platform is expressly prohibited for:

• Sending marketing messages, advertisements, or commercial promotions of any kind
• Sending messages with political, partisan, or electoral content
• Sending spam or unsolicited bulk messages unrelated to public service delivery
• Any form of communication that violates Meta's Business Messaging Policies or the WhatsApp Business API Terms of Use

Messages sent through the HUB are limited to public utility communications, such as protocol notifications, appointment scheduling, alerts, responses to citizen requests, and public service information.

All message templates undergo an internal review by GovTools before being submitted for Meta's approval. During this review, the GovTools team analyzes the content to ensure it does not contain marketing language, commercial advertising, political or partisan content, electoral messaging, or any communication not directly related to public service delivery. Templates that do not meet these criteria are rejected internally, before they are ever sent to Meta for approval. GovTools reserves the right to immediately suspend access for any agency that attempts to circumvent this review process or violates this policy.

6. Data sharing

GovTools does not sell, rent, or share personal data with third parties for commercial or marketing purposes. As a data processor, GovTools may share information only in the following situations:

• Meta (Facebook/WhatsApp): data strictly necessary for the WhatsApp Business API integration to function, in accordance with Meta's platform policies
• Infrastructure providers: cloud hosting and storage services (AWS) used to keep the platform operational, with encryption and active data processing agreements in place
• Artificial intelligence providers: conversation content may be processed by language models for automated service features, in a controlled manner, without retention by the providers, and as configured by the contracting agency
• Contracting government agency: data belongs to the government agency (data controller), which can access it in full through the platform dashboard
• Competent authorities: when required by law, court order, or regulatory authority determination

7. Storage and security

Data processed by the HUB is stored on Amazon Web Services (AWS) servers with encryption in transit (TLS) and at rest. Security measures include:

• Role-based access control (RBAC) with data isolation between agencies (multi-tenancy)
• Audit logs for all administrative actions performed on the platform
• Secure authentication for admin panel access
• Complete logical separation of each contracting agency's data

8. Data retention

Data is retained for the period necessary to provide the contracted service and as required by applicable legislation. Conversation and service data is retained according to the policies defined by the contracting government agency and legal requirements for public archiving and transparency. Upon contract termination, data is returned to the agency or deleted according to the contractual agreement.

9. Data subject rights

Under Brazil's General Data Protection Law (LGPD — Law No. 13,709/2018), data subjects have the right to:

• Confirm the existence of personal data processing
• Access their personal data
• Correct incomplete, inaccurate, or outdated data
• Request anonymization, blocking, or deletion of unnecessary or excessive data
• Revoke consent, when applicable
• Request data portability
• Obtain information about entities with which the data has been shared

As GovTools operates as a data processor, requests from data subjects related to conversations and services should be directed to the contracting government agency (data controller). For requests related to platform operator accounts, please contact us directly.

10. Data obtained via Facebook and WhatsApp

GovTools accesses data from the Meta platform (Facebook and WhatsApp) exclusively to enable citizen service on behalf of contracting government agencies. Data obtained through these integrations is used solely for:

• Sending and receiving WhatsApp messages between the government agency and citizens
• Managing message templates approved by Meta
• Maintaining the technical operation of the integration (tokens, account configurations)

No data obtained via Facebook or WhatsApp is used for marketing, advertising, data selling, or any purpose other than delivering the contracted public service. Data usage is in full compliance with Meta's Platform Policies and the WhatsApp Business API Terms of Use.

11. Data deletion

Personal data deletion requests can be made at any time by contacting us at the email address below. After the request, data will be removed within 30 (thirty) days, except when there is a legal obligation for retention or when the data is necessary for fulfilling public service obligations. For data related to citizen services, the request should be forwarded to the controlling government agency.

12. Changes to this policy

This Privacy Policy may be updated periodically. Significant changes will be communicated to the administrators of contracting agencies through the HUB dashboard.

13. Contact

To exercise your rights, ask questions, or make requests related to this policy, please contact us:

• Email: contato@govtools.app
• Website: govtools.app