1. Scope and acceptance
This Policy applies to the wisedataforms.com website, to the WiseData Forms platform and to communications related to those services.
By using any of these services, you declare that you are aware of the practices described here. This Policy is part of the Terms of Use.
2. Audience and minimum age
The Platform is intended for professional use by companies and self-employed professionals. It is not intended for people under 18, and we do not knowingly collect data from children or teenagers.
If we identify a registration that breaks this rule, the account may be closed and the data erased.
3. Roles under the LGPD
We are controllers of the data of those who subscribe to or show interest in the Platform: account registration data, billing data, access logs and support interactions.
We are processors of the data the Customer enters into the Platform in the course of its own business: data of the people it invites to its team and the responses respondents submit to the forms it publishes. In that case, the Customer is the controller and defines the purposes of processing — it decides what the form asks and how long the responses are kept.
As processors, we handle that data solely according to the Customer's instructions and as needed to deliver the contracted service.
4. What data we collect
Registration data: name, e-mail, password in encrypted form, preferred language and, where applicable, phone number.
Tax and billing data: legal or full name, tax ID, address and the data required to issue a tax document. Full credit card data is not stored by us — processing is handled by third-party payment processors.
Platform usage data: the records the Customer creates during operation, according to the features of the contracted plan.
Data of people who respond to forms, processed on the Customer's behalf: the answers typed and, by default, the origin of the visit (campaign parameters, landing page and referring site), the device type, the browser, the operating system, the approximate city, state and country, and the time taken to fill in the form. The location comes from the website's delivery network, and the IP address is not stored in the response. The exception is signatures and terms acceptance: for those, the IP address and browser are stored together with the date and time, as evidence of the act. The public form does not store any cookie of its own in the respondent's browser.
Technical and security data: IP address, browser and device type, date and time of access, session history and logs of security-relevant events.
Website browsing data: pages visited, visit source and campaign parameters, collected as described in section 6.
Communication data: messages exchanged with support, including those exchanged with the artificial intelligence assistant, and the content of contact forms.
5. Purposes and legal bases
Performance of contract: creating and maintaining the account, providing the contracted features, processing payments, issuing tax documents and providing support.
Compliance with legal or regulatory obligations: retention of access logs under article 15 of the Brazilian Civil Rights Framework for the Internet, and tax and accounting obligations.
Legitimate interest: Platform security, fraud and abuse prevention, performance measurement and product improvement, always with an assessment of the impact on data subject rights.
Consent: sending marketing communications and using non-essential cookies. Consent may be withdrawn at any time, with no effect on the contracted service.
Institutional promotion: use of the Customer's business name, brand and voluntary testimonials to publicly identify the relationship, as authorized in the Terms of Use. A company name is not personal data, but a testimonial signed by a person is — in that case the basis is consent, revocable at any time.
We do not use the data Customers enter into the Platform to train artificial intelligence models, nor do we sell it, under any circumstances.
7. Data sharing
We share data only with processors necessary to deliver the service, always under contract and bound by confidentiality, listed in section 8.
We may share data to comply with a legal obligation, court order or request from a competent authority, and to exercise our rights.
We do not sell personal data and do not transfer it to third parties for advertising.
8. Subprocessors
The providers below process personal data on our behalf, each limited to the stated purpose. The list is kept current on this page; a new subprocessor is reflected here before it goes into operation.
Internal administrative tools that do not receive Licensee Content are not part of this list.
Nor are the systems to which the Customer chooses to send responses — the server receiving the webhook, the spreadsheet in its Google account or the artificial intelligence assistant it connects through MCP. The copy sent is kept in the system chosen by the Customer, under its responsibility.
| Subprocessor | Purpose | Location |
|---|---|---|
| Cloudflare | Delivery network and protection for the website, the Platform and the forms, bot verification (Turnstile), approximate location of respondents, certificate for the Customer's custom domain and generation of response PDFs | United States and global network |
| Amazon Web Services | Encrypted database backups and the delivery infrastructure for transactional e-mails, through the group's WiseData Mail platform | Brazil |
| Stripe | Payment processing and subscription billing | United States |
| Sentry | Error monitoring and failure diagnosis | United States |
| Sending responses to a Google Sheets spreadsheet, when the Customer enables that integration, and measurement on the website and the Platform, with consent | United States |
9. Sharing within the WiseData group
WiseData Business LTDA runs other products under the WiseData brand. Registration and contact data may be shared among the group's companies for unified customer service, fraud prevention, management of the commercial relationship and offering the group's own products.
Licensee Content — the data you enter in your operation — is not shared between group products, except where you subscribe to an integration that requires that flow, and only to its extent.
Offering other group products through marketing communications depends on consent and may be cancelled at any time.
In case of corporate reorganization, merger, spin-off, acquisition or sale of assets, data may be transferred to the successor under the conditions of this Policy, with prior notice to data subjects.
10. International transfer
Some of the subprocessors in section 8 maintain infrastructure outside Brazil, which constitutes an international transfer of data.
Those transfers comply with article 33 of the LGPD and are supported by contractual clauses ensuring a level of protection compatible with Brazilian law, as provided by the International Data Transfer Regulation approved by ANPD Resolution 19/2024.
Where an equivalent alternative with infrastructure in Brazil exists, it is preferred.
11. Artificial intelligence and data
No feature of WiseData Forms sends forms, responses or any other data the Customer enters into the Platform to an artificial intelligence provider, and the Platform does not use a language model to analyze, classify or generate content from that data.
The only way an artificial intelligence assistant can access the account is the MCP (Model Context Protocol) integration, available on the Pro and Business plans and initiated by the Customer itself: it is the Customer who connects the assistant it has contracted — such as Claude or ChatGPT —, authorizes the connection on the consent screen and decides, through the account owner, whether it is read-only or read and write. The connection may be revoked at any time in Settings. The data the assistant reads is then processed by the provider chosen by the Customer, which is why that provider is not listed in section 8.
Support, provided through the WiseData group's help center, includes an artificial intelligence assistant. It receives what you write in the conversation and, from the account, only subscription, invoice and plan data — never forms or responses. Avoid sending unnecessary personal data, sensitive data or trade secrets in the conversation: the response is generated by an automated system and the history is kept in your support record.
Generated responses are suggestions and do not replace human analysis. Section 12 deals with automated decisions.
12. Automated decisions
Article 20 of the LGPD grants data subjects the right to request review of decisions made solely on the basis of automated processing that affect their interests, including those intended to define a personal, professional, consumer or credit profile.
The Platform does not make solely automated decisions that produce legal effects on data subjects or otherwise significantly affect them. The calculations, indicators, classifications and suggestions presented are inputs to a human decision — the Customer decides.
In automated security and anti-fraud controls, such as a preventive block due to suspicious activity, the measure is always reviewable by a person upon request through the support channels.
Should a feature come to produce a solely automated decision with relevant effect, we will state here the criteria and procedures used and make the review request available, subject to commercial and industrial secrecy.
13. Information security
We adopt technical and administrative measures to protect data, including encrypted traffic, passwords stored with a key derivation algorithm, two-factor authentication available, role-based access control, isolation between different customers' accounts and logging of security events.
Access by the Licensor's personnel to customer data is restricted to what is necessary for support and maintenance, logged and subject to a confidentiality commitment.
No system is completely immune to incidents, and no security measure eliminates risk entirely.
14. Security incidents
Should a security incident occur that may cause relevant risk or damage to data subjects, we will notify those affected and the Brazilian Data Protection Authority as provided in article 48 of the LGPD, describing the data involved, the risks and the measures taken.
Where we act as processors, we will notify the controlling Customer as soon as we become aware, so that it can fulfil its own notification duties.
15. Retention and storage periods
We keep data for as long as the contractual relationship lasts and, after it ends, only for the periods below. Once those periods are met, data is erased or anonymized.
| Data | Period | Basis |
|---|---|---|
| Account and Licensee Content | During the relationship. After account deletion, up to 30 days for erasure from backups | Performance of contract |
| Form responses | For as long as the Customer decides: on the Business plan, for the retention period set on each form; with no period set, until the Customer deletes them or deletes the account | Instructions of the Customer, controller of that data |
| Account audit log | 1 year | Security and exercise of rights |
| Application access logs | 6 months | Article 15 of the Brazilian Civil Rights Framework for the Internet |
| Tax documents and billing records | 5 years | Tax legislation |
| Account deletion record (date, reason, IP and author) | 5 years | Exercise of rights and proof of proper handling |
| Contact data for marketing | Until consent is withdrawn | Consent |
| Support and service history | 5 years after the account is closed | Exercise of rights |
16. Account and data deletion
Account deletion is requested inside the Platform, by the account owner, and is immediate and irreversible. The full procedure is on the account deletion page.
Removal reaches the records created during use, not just the main registration. Only data whose retention is required by law or necessary to exercise rights remains, as set out in section 15.
Before deleting, the Customer may export its content using the Platform's features.
Moving to a smaller plan does not imply deletion: data that stops being displayed remains stored and becomes accessible again if the plan is resumed.
Accounts with no active subscription and no access for an extended period may be deactivated and their data erased. Keeping data nobody uses indefinitely runs against the necessity principle in article 6, III, of the LGPD. Before erasure we give notice by e-mail, in advance and with the opportunity to reactivate or export.
17. Data subject rights
Under article 18 of the LGPD, you may request: confirmation that processing exists; access to the data; correction of incomplete, inaccurate or outdated data; anonymization, blocking or erasure of unnecessary or excessive data, or data processed in breach of the law; portability to another provider; erasure of data processed with consent; information about who we share the data with; information about the possibility of withholding consent and its consequences; and withdrawal of consent.
You also have the right to request review of automated decisions, as set out in section 12.
Requests concerning data entered by a Customer into the Platform must first be addressed to that Customer, who is the controller of such data. When we receive requests of that kind, we forward them to the responsible controller and provide the necessary support.
Anyone who responded to a form should contact whoever published it. On every plan, the Platform gives the account owner a tool to find a data subject's responses by the e-mail address or tax ID (CPF/CNPJ) provided and erase them permanently, bypassing the trash.
18. How to exercise your rights, and response times
Open a request in our public privacy form, stating the right you wish to exercise and the data that allows us to locate your record. The form requires no sign-up and no login — it also serves people who are not customers and those who have already closed their account — and returns a ticket number so you can follow its progress.
If you have an active account you may instead open the request through the service center, under the Privacy and LGPD category. It is the same flow and the same deadline.
Confirmation that processing exists and access in simplified format are provided immediately. The clear and complete statement, with the origin of the data, the criteria and the purpose of processing, is provided within 15 (fifteen) days, as required by article 19 of the LGPD.
We may request additional information to confirm the requester's identity before fulfilling the request — a protection for the data subject themselves — and the period then runs from that confirmation.
Manifestly excessive or repetitive requests may be refused with justification, and the reason explained.
19. Data protection officer and communication channel
WiseData Business LTDA qualifies as a small-scale processing agent under ANPD Resolution 2 of 27 January 2022.
Under article 11, § 1, of that Resolution, a small-scale processing agent is not required to appoint a data protection officer, provided it offers a communication channel with the data subject. Article 7 of the same Resolution allows that service to be provided by electronic means, as long as LGPD rights are ensured and access to information is made easy.
Our official channel is the public privacy request form, open to anyone, with no sign-up and no login. We chose a form over an e-mail address precisely because of that ease of access: the request gets a ticket number, stays traceable and is routed internally without depending on someone watching an inbox.
Requests received through that channel are handled by an internally designated person, who responds within the deadlines in section 18.
Should the Licensor cease to qualify as a small-scale agent, we will formally appoint a data protection officer and their identification will appear in this section.
21. Communications and anti-fraud
We send transactional communications required by the relationship, such as registration confirmation, billing notices and security notifications. These do not depend on consent and cannot be turned off while the account is active.
Marketing communications depend on consent and may be cancelled at any time through the unsubscribe link in each message.
We may analyze usage patterns to identify abuse, fraud or improper automated use, based on the legitimate interest of protecting the Platform and other customers.
To check the truthfulness of a registration and to prevent parallel accounts created to work around limits or repeat the trial period, we cross-reference signals such as tax ID, e-mail, phone, payment method, IP address and device characteristics. We may request documentary proof before releasing or reactivating access. This processing is limited to that purpose and feeds no commercial profile or advertising.
A block resulting from that check is always reviewable by a person, as set out in section 12.
22. Changes to this policy and governing law
We may update this Policy from time to time. The most recent version will always be available on this page, with a version number and date. For material changes, we will notify you by e-mail or by a notice inside the Platform.
This Policy is governed by Brazilian law. The courts of the District of Goiânia, State of Goiás, Brazil, are elected to settle any disputes, except for the courts of the domicile of an individual consumer data subject.