Privacy Policy

This is an English translation provided for convenience. The Portuguese version at /politica-de-privacidade is the binding text, and it prevails in case of any discrepancy.

This policy explains how Dulyx (“Dulyx”, “we”) handles personal data collected through the website dulyx.com.br(the “Site”) and the Dulyx platform, including the service channels connected to it, such as WhatsApp and Telegram (the “Platform”), in compliance with the LGPD (Brazilian General Data Protection Law, Law No. 13,709/2018). Sections 2 to 6 cover the Site; section 7 covers the Platform.

1. Who the controller is and who the data protection officer is

Dulyx Sistemas Ltda, registered under CNPJ (Brazilian corporate taxpayer ID) No. 69.185.485/0001-31, headquartered in Paineiras, MG, is the controller of the personal data handled through the Site and of the Platform account data. For the data the Platform handles on behalf of customer companies, Dulyx’s role is described in section 7.

Dulyx’s data protection officer (encarregado) is Carlos Corgozinho, reachable at contato@dulyx.com.br. This is the channel for questions, complaints and any request about your data.

2. What data we collect on the Site

2.1 Data you provide to us

When you sign up for the waitlist, we collect:

• name and e-mail;
• answers to the form: team size, main challenge with AI, current cost range and where you intend to integrate Dulyx, including the free text when you choose “Other”;
• what you expect to see first in early access (optional).

2.2 Data collected automatically

If you accept the analytics cookies in the banner, we collect, in pseudonymized form, while you browse the Site:

• a visitor identifier, to recognize those who have visited the Site before;
• a session identifier, to group the actions of a single visit;
• pages and sections viewed, clicks on interface elements and scroll depth;
• browser language, time zone, screen resolution, window size and pixel density;
• the origin of the visit (referring site, when external, and campaign parameters such as utm_source or gclid);
• the IP address with the last block erased and the approximate city it indicates.

If your browser sends the “Do Not Track” signal, we do not store IP address or location. All of this telemetry is operated by Dulyx’s own infrastructure: no browsing data is sent to third-party advertising or analytics tools.

If you accepted the analytics cookies and sign up for the waitlist, we associate your e-mail with the browsing history of that browser, to understand the path to sign-up. Without that acceptance, the sign-up is not linked to browsing.

3. Cookies and local storage

We use cookies and equivalent technologies (browser local and session storage) in two categories:

• Essential: they store your theme preference (light/dark), the language chosen in the selector at the top and your choice in the cookie notice. They do not depend on consent because they are necessary for the Site to work.
• Usage analytics: the visitor identifier (a cookie valid for up to 365 days, also read by the Platform dashboard) and the session identifier (session storage, expires after 30 minutes of inactivity). They are only enabled if you accept in the cookie banner.

You can change your choice at any time through the “Cookie preferences” link in the footer of the Site. When you decline, the visitor cookie is erased. Browsers also allow you to block or delete cookies in their own settings.

4. What we use this data for

• operating the early-access waitlist (performance of preliminary procedures related to a contract, at your request);
• contacting you about access release or to better understand your needs;
• understanding how the Site is used, to prioritize what to explain better and fix what is not working (consent, through the cookie banner);
• protecting the Site against abuse, fraud and misuse of the sign-up form (legitimate interest).

We do not use the data collected here for automated decisions that produce legal effects on you, nor for third-party targeted advertising.

5. Who we share it with

We do not sell personal data. Site data is stored on servers in Brazil, engaged by Dulyx. The e-mails we send go out through Google Workspace, and sign-in with a Google account, when you choose it, goes through Google. We may disclose data if required by law, court order or a competent authority.

6. How long we keep Site data

• Visitor identifier and browsing history: up to 365 days after the last visit.
• Session identifier: lasts while the tab stays open, or up to 30 minutes of inactivity.
• Waitlist data: up to 24 months from sign-up if you do not open an account, or until you request deletion, whichever occurs first. If you open an account, the account retention periods apply instead.

7. Data handled on the Platform

The Platform is used by companies (“customer companies”) to create AI-powered service assistants connected to their own systems and channels, such as WhatsApp. In this use, the customer company is the controller of its contacts’ and end customers’ data, and Dulyx acts as processor: it handles that data only to provide the contracted service and according to the customer company’s instructions, under the Data Processing Agreement attached to the Terms of Use.

7.1 Account and dashboard use

For the customer companies’ users, we handle name, e-mail, date of birth, access permissions and usage records (such as logins, conversations held in the dashboard and credit consumption), to authenticate access, operate the Platform and bill for use. Here Dulyx is the controller.

7.2 WhatsApp channel

When a customer company connects its own WhatsApp Business number to Dulyx, through Meta’s WhatsApp Business platform, we handle:

• the phone number and profile name of whoever sends a message to that number;
• the content of the messages received and of the replies sent by the assistant, with date, time and delivery status;
• when the company replies on its own through the WhatsApp Business app, only the record that a human reply took place in that conversation, without the content, so that the assistant does not reply over the agent;
• the account and number identifiers and the access authorized by the customer company, used only to send and receive messages on its behalf.

This data is used to understand the message and query the customer company’s own systems; generate and send the reply; keep the context of the conversation with that contact; apply the rules set by the company (which numbers receive messages from the assistant and the pause time after a human reply); and diagnose delivery failures. Messages travel through Meta’s WhatsApp Business platform, which is subject to Meta’s own terms and privacy policy.

When connecting a number that is already in the WhatsApp Business app, Meta may offer to share the contacts and the conversation history. Dulyx does not store this data.

7.3 Telegram channel

When a customer company connects a Telegram bot to Dulyx, we handle the Telegram account identifier, the name and username of whoever talks to the bot, the phone number when the person shares it in the conversation, and the content of the messages received and sent, with date and time. The uses are the same as for the WhatsApp channel. Messages travel through the Telegram platform, which is subject to Telegram’s own terms and privacy policy.

7.4 Chat on the customer company’s website

When a customer company places the Dulyx chat on its own website or shares a conversation link, we handle the messages of whoever is chatting, a visitor identifier that keeps the context of the conversation in that browser, and the IP address, used to limit abuse.

7.5 Artificial intelligence processing and other providers

The text of the messages and the information queried in the customer company’s systems are processed by AI model providers engaged by Dulyx as subprocessors, exclusively to generate the reply. CPF and CNPJ (Brazilian individual and corporate taxpayer IDs) are partially masked in the default configuration. Dulyx does not use the content of conversations to train AI models, does not sell this data and does not use it for advertising.

Through Vercel’s AI Gateway, the Platform uses models from OpenAI, Google, Meta, Alibaba, Moonshot AI, DeepSeek and Z.ai, run by the infrastructure providers that Vercel chooses for each model, mostly in the United States. The customer company is notified 15 days in advance when a subprocessor is added or replaced.

International transfer. Subprocessors outside Brazil receive data on the basis of the standard contractual clauses approved by the ANPD (Brazilian Data Protection Authority; Resolution CD/ANPD No. 19/2024) or, where applicable, because they are in a country recognized by the ANPD as providing an adequate level of protection (LGPD, art. 33).

Each assistant reply generates a technical record with the text sent to the model and the data queried, used to diagnose failures and to show the customer company which data was used in each reply.

7.6 How long we keep it

Data of customer companies and their contacts (default periods; some can be shortened by the customer company in the agent settings):

Data for which Dulyx is the controller:

Once the period has passed, the data is deleted automatically, every day. When the customer company disconnects a number on the Platform, Dulyx stops replying to messages through it.

7.7 How to export and delete

• User of a customer company: in Settings, in the “Your account” section, you download a file with your data and delete your account, confirming with a code sent to your e-mail. The conversations you had in the dashboard stay with the company, without your name. The account owner is notified.
• Company account owner: in Settings, in the “Contract” section, you export all the account data in a .zip file and close the account. The closure can be undone within 7 days; after that, there are 30 days to export the data and, after a notice by e-mail, it is deleted 15 days later, including from backups in the rotation cycle. Only the data that the law requires to be kept, such as tax documents, remains.
• Anyone who talked to a company’s assistant: the request goes to the company itself, which locates, exports and deletes your data through the dashboard, searching by phone number, Telegram account or the site chat. If the request reaches Dulyx, through the data protection officer’s e-mail, we forward it to the company within 5 business days and tell you who it is.

You can also make the request by e-mail at contato@dulyx.com.br. The account deletion page summarizes the paths.

7.8 Payments

Payments for plans and credits are processed by Stripe. Card data is entered in Stripe’s own fields and does not pass through Dulyx’s servers, which keep only the billing identifiers.

8. Your rights under the LGPD

As a data subject, you may request, at any time:

• confirmation that we process your data, and access to it;
• correction of incomplete, inaccurate or outdated data;
• anonymization, blocking or deletion of unnecessary data or data processed outside what this policy describes;
• portability of the data to another provider, upon express request;
• information about who we share your data with;
• withdrawal of consent and deletion of the data resulting from it;
• objection to processing carried out on the basis of another legal ground.

To exercise any of these rights, write to the data protection officer at contato@dulyx.com.br, with the subject “LGPD”. We reply within 15 days. You may also file a complaint with the ANPD (Brazilian Data Protection Authority).

9. Security

Each customer company’s data is isolated from that of the others in the database. Passwords are stored with a slow, salted hash; session and API tokens only as a hash; channel and integration credentials, encrypted. Traffic is encrypted and administrative access is restricted. No system is entirely free of risk: if a security incident may affect your data, we will notify you as required by the LGPD.

10. Minors

The Site and the Platform are not directed at persons under 18, and registration in the dashboard requires being 18 or older.

11. Changes to this policy

We may update this policy as the Site and the Platform evolve. The date at the top of this page indicates the latest revision. Relevant changes in the way data is handled will be highlighted on this same page.