Privacy Policy

This Privacy Policy explains how Atendmax Tecnologia Ltda, Brazilian company registration number (CNPJ) 60.304.087/0001-12, headquartered at Rua Deputado Heitor Alencar Furtado, 3350, Suite 907, Mossunguê, Curitiba, Paraná, Brazil ("Vinica," "we," or the "controller"), collects, uses, stores, shares, and protects your personal data when you use the Vinica application, available at vinica.tech and through WhatsApp.

Vinica is a financial management platform for individuals (CPF) and businesses (CNPJ), with an AI assistant that organizes transactions, cards, accounts, and appointments from WhatsApp messages and a web dashboard. We process your data in accordance with Brazil's General Data Protection Law (Law 13,709/2018, or LGPD).

1. Who controls your data

The controller responsible for processing your personal data is Atendmax Tecnologia Ltda (CNPJ 60.304.087/0001-12). For privacy matters, contact hello@vinica.tech.

2. Data we collect

We collect only the data needed to provide the service:

• Registration data: your name, email address, and WhatsApp number used to create and access your account. Login uses a code sent to your email, without a password.
• Financial data you record: incoming and outgoing transactions, categories, bank accounts, cards, statements, payables, receivables, suppliers, projects, and other information you provide, separated into personal (CPF) and business (CNPJ) records.
• WhatsApp messages and media: content you send to the assistant, including text, voice notes, and photos of receipts or documents, so it can understand, classify, and record the information.
• Google Calendar data (optional): if you connect Google Calendar, we access calendar events to read availability and create, edit, or delete appointments. See section 6.
• Files and receipts: documents and images you attach or send for recording.
• Payment data: when you subscribe, transaction data is processed by our payment provider. We do not store full card numbers on our servers.
• Technical data: minimal usage and security information, such as access date and time and session identifiers, needed to operate and protect your account.

3. How we use your data

Provide, maintain, and improve Vinica's features;

• Understand, classify, and record transactions from your messages, voice notes, and photos;
• Separate personal (CPF) and business (CNPJ) finances and generate the combined financial review;
• Send useful notices, such as upcoming bills, statement closing dates, and monthly summaries;
• Sync appointments with Google Calendar when you enable the integration;
• Authenticate access, provide support, and protect your account against fraud and abuse;
• Comply with legal and regulatory obligations.

4. Legal basis for processing under the LGPD

We process your data based on performance of the contract and preliminary procedures (Article 7, V), compliance with legal obligations (Article 7, II), legitimate interests in security and service improvement (Article 7, IX), and, where applicable, your consent (Article 7, I), such as when connecting Google Calendar.

We use AI models (Google Gemini) to understand your messages, voice notes, and photos. Submitted content is processed solely to provide the functionality you see in the product, including recording, classification, and assistant replies, and is not used to train third-party models.

When you send a photo of a card, we mask sensitive numbers (PAN and CVV) before storage or display. We recommend sharing only the card information strictly necessary.

6. Google API data (Google Calendar)

The Google Calendar integration is optional and only enabled after you authorize access through Google's consent screen. In that case:

• What we access: we request only the https://www.googleapis.com/auth/calendar.events scope, which allows reading, creating, editing, and deleting calendar events. We do not request access to other Google account data.
• How we use it: we read your availability so the assistant can check your calendar, and create, change, or remove events when you ask to schedule, reschedule, or cancel an appointment.
• How we store it: Google access tokens are stored encrypted using AES-256-GCM and used only to maintain synchronization. We do not sell or share Google data with third parties.
• How to revoke access: you can disconnect Google Calendar at any time in Settings > WhatsApp & AI, or revoke access directly at myaccount.google.com/permissions.

Limited Use. Vinica's use and transfer of information received from Google APIs will comply with the Google API Services User Data Policy, including its Limited Use requirements:

Vinica's use and transfer to any other app of information received from Google APIs will adhere to the Google API Services User Data Policy, including the Limited Use requirements.

7. WhatsApp and Meta

Vinica operates through the WhatsApp Business Platform (Cloud API), provided by Meta. Messages exchanged with the assistant are processed to provide the service. WhatsApp use is also subject to the WhatsApp Privacy Policy. We send messages only in the context of the service and in response to your interaction or authorization.

8. Sharing with third parties

We do not sell your data. We share information only with providers that enable the service (processors), as necessary and subject to confidentiality obligations:

• Google — Google Calendar APIs and AI models (Gemini);
• Meta — WhatsApp Business Platform (Cloud API) for messaging;
• Payment provider — subscription processing;
• Email provider — login codes and notices;
• Hosting provider — infrastructure on which the application runs.

We may also share data to comply with a legal obligation or an order from a competent authority.

9. Storage and security

We use technical and organizational safeguards to protect your data: encrypted traffic (HTTPS), sensitive tokens encrypted at rest (AES-256-GCM), card-number masking, and permission-based access controls you set for your team. Internal access is restricted to what is necessary to operate and support the service.

10. How long we retain data

We retain your data while your account is active and for as long as necessary to meet legal, accounting, and regulatory purposes. After that, it is deleted or anonymized. You may request deletion at any time; see section 11 and the Data Deletion page.

11. Your rights and how to exercise them

As a data subject, the LGPD gives you the right to:

• confirm whether processing takes place and access your data;
• correct incomplete, inaccurate, or outdated data;
• request anonymization, blocking, or deletion of unnecessary data;
• request data portability;
• withdraw consent and request deletion of data processed on that basis;
• obtain information about how your data is shared.

To exercise these rights, write to hello@vinica.tech. We will respond within 15 days. To delete your account and data, see the Data Deletion page.

12. Cookies

We use cookies strictly necessary to authenticate your session and remember preferences, such as the dashboard theme. We do not use your data for third-party advertising.

13. International transfers

Some providers, such as Google and Meta, may process data on servers outside Brazil. In those cases, processing follows the safeguards required by the LGPD for international data transfers.

14. Children and teenagers

Vinica is intended for people aged 18 and over. We do not knowingly collect data from minors.

15. Changes to this policy

We may update this Policy periodically. The last updated date appears at the top of this page. Significant changes will be communicated through our channels.

16. Data Protection Officer and contact

For questions, requests, or complaints about privacy and data protection, contact our Data Protection Officer, Kainan Arantes, at hello@vinica.tech. You may also contact the controller, Atendmax Tecnologia Ltda, at Rua Deputado Heitor Alencar Furtado, 3350, Suite 907, Mossunguê, Curitiba, Paraná, Brazil.